hxxp://94[.]154[.]43[.]158/killbotx[.]x86

Analysis

user interaction
yes
max time kernel
118s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://94.154.43.158/killbotx.x86
Sample260804-m3fc8aybqa

Score

3^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4768	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 2485bff555e3dc01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A2827C5C-8FF3-11F1-9F3C-5AB93EA64185} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff50020000f0000000d0040000d0020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1998636711"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff50020000f0000000d0040000d0020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31269888"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CAFE05CB-8FF3-11F1-9F3C-5AB93EA64185} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{6343556B-3254-4153-9B8A-C99F8C378EEC}"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303147629048773"	chrome.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.x86	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\x86_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\䢸㞞ɖ临仨	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ꬽᘖᴀ蠀	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\x86_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\x86_auto_file\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\x86_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\䢸㞞ɖ临仨\ = "x86_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\x86_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\x86_auto_file\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\x86_auto_file\shell\open\CommandId = "IE.File"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.x86\ = "x86_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ꬽᘖᴀ蠀\ = "x86_auto_file"	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
744	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe
Token: SeShutdownPrivilege	2624	chrome.exe
Token: SeCreatePagefilePrivilege	2624	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2284	iexplore.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe
2624	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe
744	OpenWith.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 4092	2624	chrome.exe	88
PID 2624 wrote to memory of 4612	2624	chrome.exe	89
PID 2624 wrote to memory of 4612	2624	chrome.exe	89
PID 2624 wrote to memory of 4768	2624	chrome.exe	90
PID 2624 wrote to memory of 4288	2624	chrome.exe	91
PID 2624 wrote to memory of 4288	2624	chrome.exe	91
PID 2624 wrote to memory of 2876	2624	chrome.exe	93
PID 2624 wrote to memory of 4056	2624	chrome.exe	94
PID 2624 wrote to memory of 2876	2624	chrome.exe	93
PID 2624 wrote to memory of 4056	2624	chrome.exe	94
PID 2624 wrote to memory of 3972	2624	chrome.exe	95
PID 2624 wrote to memory of 3972	2624	chrome.exe	95
PID 2624 wrote to memory of 2840	2624	chrome.exe	96
PID 2624 wrote to memory of 2824	2624	chrome.exe	100
PID 2624 wrote to memory of 3928	2624	chrome.exe	104
PID 2624 wrote to memory of 3708	2624	chrome.exe	105
PID 2624 wrote to memory of 4764	2624	chrome.exe	106
PID 744 wrote to memory of 2284	744	OpenWith.exe	107
PID 2284 wrote to memory of 3316	2284	iexplore.exe	110
PID 4120 wrote to memory of 824	4120	OpenWith.exe	112
PID 2284 wrote to memory of 1844	2284	iexplore.exe	114
PID 2284 wrote to memory of 3496	2284	iexplore.exe	115
PID 2284 wrote to memory of 4164	2284	iexplore.exe	116
PID 2284 wrote to memory of 3928	2284	iexplore.exe	117
PID 2284 wrote to memory of 1044	2284	iexplore.exe	118
PID 2284 wrote to memory of 4800	2284	iexplore.exe	119
PID 2284 wrote to memory of 2112	2284	iexplore.exe	120
PID 2284 wrote to memory of 1812	2284	iexplore.exe	121
PID 2284 wrote to memory of 1020	2284	iexplore.exe	122
PID 2284 wrote to memory of 1612	2284	iexplore.exe	123
PID 2284 wrote to memory of 1888	2284	iexplore.exe	124
PID 2284 wrote to memory of 4156	2284	iexplore.exe	128
PID 2284 wrote to memory of 3552	2284	iexplore.exe	129
PID 2284 wrote to memory of 4780	2284	iexplore.exe	131
PID 2624 wrote to memory of 1936	2624	chrome.exe	135
PID 2624 wrote to memory of 1772	2624	chrome.exe	136
PID 1772 wrote to memory of 2716	1772	iexplore.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://94.154.43.158/killbotx.x86
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc0506c728,0x7ffc0506c734,0x7ffc0506c740
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,15658185507751050300,11767676730937516149,262144 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1572,i,7865122551983355914,2476990980100738558,524288 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,2219804903474698001,11538765733838629892,524288 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,4485131166632475582,18114218973035457289,2097152 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,9321171074912109254,17021103497349074521,2097152 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,6309341295842695843,14832923363107666685,2097152 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,9798102256965399728,14955806372490700015,524288 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,8638082448174073784,18421636819921337991,524288 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,2088946507778726248,14062977974268731203,524288 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3916,i,14238381056364502193,11701560185994078146,524288 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,6327292553553462226,5631261428339432331,524288 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1092,i,1473448538127396395,16204158693527584997,524288 --field-trial-handle=2000,i,18052425619226514604,13095305824347452396,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\killbotx (2).x86
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:2716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2672

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\killbotx.x86
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:3316
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:17420 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:1844
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\killbotx.x86
    3⤵
    - Modifies Internet Explorer settings
    PID:3496
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:17430 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:4164
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\killbotx.x86
    3⤵
    - Modifies Internet Explorer settings
    PID:3928
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:17440 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:1044
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\killbotx.x86
    3⤵
    - Modifies Internet Explorer settings
    PID:4800
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:17450 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:2112
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\killbotx.x86
    3⤵
    - Modifies Internet Explorer settings
    PID:1812
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:17460 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:1020
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\killbotx (1).x86
    3⤵
    - Modifies Internet Explorer settings
    PID:1612
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:82948 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:1888
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\killbotx (1).x86
    3⤵
    - Modifies Internet Explorer settings
    PID:4156
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:17472 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:3552
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\killbotx (1).x86
    3⤵
    - Modifies Internet Explorer settings
    PID:4780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\killbotx.x86
  2⤵
  - Modifies Internet Explorer settings
  PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a8b56022af2b753d9757e987093fdcd8dddd744885f3ed4218fb4a3921946ecf
MD5 b045f949f7bf2e5b21f9b655e084f679
SHA1 f9c945221c31543591e5697b5b3478d76575d145
SHA512 523361cf8f6a1ba8e82b1eb88656a5d9a42ab4e105928b8f44f30974cc8c541eb2f087a402242c11542f6e1d52d11ccde6ebeccbcea4b8d2e580bd38f30d053b
TLSH
T1C1E02BA9C821EC371CFD575D50944685DA7123571760C85F373D920CCFB166782C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

62456f93-1459-4b71-9d04-4ed2458280c7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\62456f93-1459-4b71-9d04-4ed2458280c7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a91c973805e0c77235b681783d21f8633308468d207a509e558237dee45374aa
MD5 8950773027a59b060af97a42e8364759
SHA1 99736312d0665bd910c5376e75085108bcbf5189
SHA512 d887a1c004fc33ba61d85e3d9ff43e62c284ac0204141af1673798e648b1b1688cfe7582fd422d5b076976b38385ab14df3def547603b14163b9717ced2b2073
TLSH
T1B2418AF793B4897E8A1196E4EA156F1FCE690524031C3CA688D4AE2B83F3872D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5a4ad7bc2bda0c37d7ce834027b5ccb7899d0a62f32bb242474c747b1d766260
MD5 7f4e02dfac448e9d06d1c8d3d0cee9dc
SHA1 de52c9b444344c8cb5cdcc4d823052fcc027104a
SHA512 588fb3ac2a727b69ab5e36a46fc474a681e5a01e07b78122325b277a0712d731823db2cb7e1518ae962bfdea5f82f2e7a91c63908e4c573013850052089c0000
SSDEEP 192:IRUg/DYM8EEDv7ApAPRp2l9qHKlb+WNnOSPHOukwGq6VyIsnAUge:IRUgLYH7kUXmkuLPuuAe
TLSH
T1F142A62EEE10693B9CCBD229FA567763E7F5203520802EC4E6FD996C28D75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1791149f76ec0dd441345ac9ff21e980bb74ed652226bedd380cf26e59696f3d
MD5 3a66a7f77ce84c9b68889bab0f12427e
SHA1 3f89b03c4bf61fe4ae88bd335aa9fe0e06b08b1a
SHA512 e806d20549430e05ebdcf3d675f6ab47f0396573572fde46e30e0bcb3a10ce99b5cb363673f45abb4b6f3903f2f506ddb607bb0342d1ec0c935a935bb0c166bd
SSDEEP 192:IRUgYGN8EE4v7ApAPRp2l9qHKlb+WNnOSP5OukwGqGVyIsnAUgE:IRUg3EkkUXmkuLPYucE
TLSH
T1ED42B62EED10697BACDBD229FA517763E7F5203560802ED4EAFC892C25E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d4ba0e0b9d3a807e137b8c77f52c032611b64f21ed809319cc6e912f2eb92028
MD5 9539338d766a69aed3c21a1024264a0f
SHA1 65e332ebfc316adc8349736753668949c29cf44b
SHA512 58c1c63908677dbd81fee3399fb55dd3b6d6cdc330ca82bfec25f891f61b18aa0f98c7767ef51368c8ffab13bb7b157056ba94cb0fda5ce8ec43745b05871441
SSDEEP 192:IRUVYGN8EE4v7ApJPRpFl9qHKBb+WNnOSP9OukwGqsVyIsnAUgE:IRUV3EkkfXXkyLP8uWE
TLSH
T18552C66EED10693BACCBD229F9517B63E7F5203560902ED4EAFC892C19E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bf307a5f832d96967d2ea6df39303cd37b7c53194966bb11fc1cd33b63490b31
MD5 4d941d7de11a08595d2cc41f8beaa435
SHA1 e44021965f1911f9cec19e0b599c861ac007bd16
SHA512 64cae3a7d56e1e0560ff435ca56c49bf9b270cfb051dfb3d1decd1a7c740c364716537708d4c03345e05198621085d7c94d2ec6b7ec80dd7207878092de5f556
TLSH
T105B0124084025301C84202F811821488B1A46F25970A170143E0A926C825562851C450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589006.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589006.TMP
Size 96B
SHA256 15df7b7192c51ce6fe8b047aa09b492cea594155579a0474caaf978742c86fc7
MD5 f43096032994673a31b76f827f5b688b
SHA1 c6271c0fc680b811dc43e0dec28adca785416300
SHA512 6f4917a2d5ce524fde1c579d418ea090b03bba6c7eb4ca5ab55b89fdee8152d67e40a498c08fd9917ac377931c4380fcf9c9e86710fcf7f69efcddc65b38c658
TLSH
T164B02200C0823202C00303F820B0A0E830B0CF30CA03A202C2E00A22EC28A308030030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 adf2994bfc89deca8ceb4a66bf458bd431621f39d601f130e808054cb643124e
MD5 71274a21e04893fe588eaae85f8d8a2a
SHA1 0a343491547ee18adf21d57d472f46cb71549760
SHA512 5309f41ac4ec61870e48b18d996a42f1f06ba7d81719720ddee73a27d9ca25230b6ca9048a4392918916622550f81dcb7bc1ca0b333cd078c0610dc59136d8bd
SSDEEP 3072:F/zGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Im7Rkm1tYpBeh2BAog
TLSH
T10CC3023B5D75A8375DB9BB0FA08E0B1F1EF249A7C920DE92C8D85A0423F97CD1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 90c79e869ad393472512294a67cf4ca77b7914d197db70af951c626e1e1c5814
MD5 931610633dcf83f5e3f32c5271ec3982
SHA1 a4e4cd747c5a2a9281d3eac6ffc8ed34b9b5fbf9
SHA512 366069102c6dd92761a73556decf979fb2d9d51403dbf0122919205282ba922f034f4bfea1fe2d8ff71737952484bef067d0da7da287868c958d8b09806b0a9f
SSDEEP 3072:AaGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Cm7Rkm1tYpBeh2BAog
TLSH
T1F6C3023B5D75EC3B5CB5A74EB08E0B1E2EF249A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 246c57d34bc70d4c4e5e50a1316acc477379ca255d9c3641b72d14c9d15c1fb8
MD5 fff6583e266096e1c6428b1efcf1479d
SHA1 b6b5b956677221a1277e24b2e4ced158cb220336
SHA512 371233007acb53b70df109e06c76001e6ab78a9a38f33bd52d4327a18e850f435edd5da2d3fe16c3ae789fc6e5befa9cf2375e283c5b6070ac690e46f81e263b
SSDEEP 3072:FwGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:lm7Rkm1tYpBeh2BAog
TLSH
T13AC3123B5D74E8375DB5B71EB08E0A1F1EF249A7C924DE92C8D45B0423EA7CD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b324695cb85d720e72e99d2c57683904a8b16a36a600b6858be0ace8e845ba91
MD5 901eaa0517c39f93cfd29335957bb1af
SHA1 297efd74984e479049a9cb594bb8b19d8d8c7057
SHA512 90c797052ceb34f6e3ce2ae01b988bd58770f064783746366f98f68fbbab5311024847f1f642b66ca975cfd4ecd1a2ceb0ef25122af370238fb2989bb7a127cd
SSDEEP 3072:OwGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:sm7Rkm1tYpBeh2BAog
TLSH
T1C7C3123B5D74E8375DB5B71EA08E0B1F1EF249A7C924DE92C8C45B0423EA7CD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DF1B3F6F26890CC526.TMP

Path C:\Users\Admin\AppData\Local\Temp\~DF1B3F6F26890CC526.TMP
Size 16KB
SHA256 827923319fd1673b90a9662587955810d5b29a5f4dff10a1be5a98bdcf7acb59
MD5 b3f74c060c202c6829d72a1d6d1a9876
SHA1 6c9070eeee695c998f5bb574f150cabeca23c518
SHA512 eaa153ebe9922f96eac3483246b17eb11e57c8cb2dea5d10b57260e09a37591c8732dc24b64b6b5d399abd6cffd16451a5fc5afc5c01f45bc42321a0fe45b1cb
SSDEEP 6:a/vllEcalKaUwlkxMcv/hynKlTLb4XNW1:i9lEca1B+5lkXNC
TLSH
T18272225687E60A00D3950A3291E553A07333F9203FD10B4AAFB801680C0739AF530B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 7KB
SHA256 9da7b63805313ec048e6c6ce8f2472ab4aeb804063aca36830bbf8aa51cdb50e
MD5 4a7a2b47f27487f8243a9d5030918907
SHA1 a8d5a31772303f876de2046d15e5785cf5802007
SHA512 75895c806f238d546b572257fac1e59e512aff9130d7d0d76dcb094ce940c954a2a538b821e969f96350e995fb578d0d922adcb9f36cdf426fddb6f0550964eb
SSDEEP 48:r/hyqXyR2JpvAEzJvSuzPWlJ/uvy0FJYuM3SQbt7ZadRKT1tXJsuhqlJBu1:8bgNAElDWH+HneXadREjZ6H
TLSH
T150E142A11C45BD27F0405632DF37DA4AA770BE2A9B1548CBF4E4B3C81EB6A11B099728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28c8b86deab549a1.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
Size 3KB
SHA256 d1abc53a8a0e4e09effa136c071e38c457a43cd16a7a11e16432e46dd2edfe4c
MD5 debe3bb5c239a113957c16d9c3a2e8da
SHA1 102c04e643afac1a9f60ed3950a795fe0ddcf9ae
SHA512 287c366f1069eb6a000fd4d52c6c8095e8b68bc2e55e22197514cfd157183e799c831a4f17794071b566bb441322ac802e2833c8c806a3c81cf5e921a28497ca
TLSH
T13061BD5113D21916F1939273EDB6EB01A776BC01A605C69F98C481E808F5204E5BEB7F
MD5 SHA1 SHA512 TLSH

Submit Download

killbotx.x86.crdownload

Path C:\Users\Admin\Downloads\killbotx.x86.crdownload
Size 113KB
SHA256 87f4f402ee39b5c1c0a3e90671f14bbf247a70ffffdfa799edd9d63da6a41290
MD5 31f478ede7cf723b1314df2a09ef06b1
SHA1 3f87a4bff48d1a43019c9fef8f3e9e0b63f033d4
SHA512 2348f72cf31ff805ed716ab08879f91dd557ab0b265cfc889b8dc24be4d9fd3f856cd934da4cca25015ec929540407183f5b054941a503e80ddd8f9484a4d0e6
SSDEEP 3072:ySyB5neo9uK9f9iI4Rnm+hamq2l6vTsk/TEoo6YYYYYYYYY6YYYYYYYYY6YimD:pgD0K98NR67v4oRYYYYYYYYY6YYYYYYQ
TLSH
T1F5B36B82FA93D1F0E4534670002BE76B8F35ED258525DE4AEB683E71ECB1B02495B76C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download