Analysis
- user interaction
yes - max time kernel
469s - max time network
469s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 10:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ybjjr.com
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
300 seconds
General
- Target http://ybjjr.com
- Sample260916-maxrsss14r
Malware Config
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
170.62.130.47:449
-
170.62.130.47:443
Signatures
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects ValleyRAT payload 18 IoCs
resource yara_rule behavioral1/memory/1704-139-0x000001E7EE6B0000-0x000001E7EE700000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/1704-141-0x000001E7EE6B0000-0x000001E7EE700000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/1704-142-0x000001E7EE6B0000-0x000001E7EE700000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4396-150-0x0000022D4C7F0000-0x0000022D4C840000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4396-168-0x0000022D4C7F0000-0x0000022D4C840000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4396-167-0x0000022D4C7F0000-0x0000022D4C840000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/812-1571-0x00000200DB4F0000-0x00000200DB540000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/812-1573-0x00000200DB4F0000-0x00000200DB540000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/812-1574-0x00000200DB4F0000-0x00000200DB540000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4672-1674-0x000001F412900000-0x000001F412950000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4672-1677-0x000001F412900000-0x000001F412950000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/4672-1676-0x000001F412900000-0x000001F412950000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/364-2008-0x000001BD15E70000-0x000001BD15EC0000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/364-2009-0x000001BD15E70000-0x000001BD15EC0000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/364-2010-0x000001BD15E70000-0x000001BD15EC0000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/2256-2053-0x000001C23C8E0000-0x000001C23C930000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/2256-2059-0x000001C23C8E0000-0x000001C23C930000-memory.dmp family_valleyrat_stage_2_v2 behavioral1/memory/2256-2060-0x000001C23C8E0000-0x000001C23C930000-memory.dmp family_valleyrat_stage_2_v2 - UAC bypass 3 TTPs 34 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TaxFiling0916.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TaxFiling0916.exe - Executes dropped EXE 35 IoCs
pid Process 4144 ~tmp_29902.tmp 1704 Loader.exe 3312 ~tmp_19512.tmp 4396 Loader.exe 224 ~tmp_97429.tmp 216 ~tmp_95238.tmp 2880 ~tmp_06096.tmp 4212 ~tmp_25295.tmp 812 Loader.exe 1640 ~tmp_73611.tmp 3736 ~tmp_09342.tmp 3736 ~tmp_62507.tmp 4672 Loader.exe 1584 ~tmp_30312.tmp 4968 ~tmp_46014.tmp 948 ~tmp_15896.tmp 364 Loader.exe 4944 ~tmp_22466.tmp 4116 ~tmp_88229.tmp 5092 ~tmp_37024.tmp 2256 Loader.exe 4956 ~tmp_25985.tmp 684 ~tmp_76998.tmp 4116 ~tmp_75762.tmp 3444 Loader.exe 740 ~tmp_63477.tmp 2352 ~tmp_49551.tmp 4908 ~tmp_23765.tmp 2040 Loader.exe 3844 ~tmp_94414.tmp 3844 ~tmp_70482.tmp 2580 ~tmp_94644.tmp 2124 Loader.exe 1220 ~tmp_80899.tmp 5052 ~tmp_57160.tmp - Loads dropped DLL 38 IoCs
pid Process 1704 Loader.exe 1704 Loader.exe 1704 Loader.exe 1704 Loader.exe 1704 Loader.exe 1704 Loader.exe 4396 Loader.exe 4396 Loader.exe 4396 Loader.exe 4396 Loader.exe 812 Loader.exe 812 Loader.exe 812 Loader.exe 812 Loader.exe 4672 Loader.exe 4672 Loader.exe 4672 Loader.exe 4672 Loader.exe 364 Loader.exe 364 Loader.exe 364 Loader.exe 364 Loader.exe 2256 Loader.exe 2256 Loader.exe 2256 Loader.exe 2256 Loader.exe 3444 Loader.exe 3444 Loader.exe 3444 Loader.exe 3444 Loader.exe 2040 Loader.exe 2040 Loader.exe 2040 Loader.exe 2040 Loader.exe 2124 Loader.exe 2124 Loader.exe 2124 Loader.exe 2124 Loader.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceController = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " Loader.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Loader.exe File opened (read-only) \??\Z: Loader.exe File opened (read-only) \??\R: Loader.exe File opened (read-only) \??\X: Loader.exe File opened (read-only) \??\N: Loader.exe File opened (read-only) \??\V: Loader.exe File opened (read-only) \??\W: Loader.exe File opened (read-only) \??\R: Loader.exe File opened (read-only) \??\Q: Loader.exe File opened (read-only) \??\T: Loader.exe File opened (read-only) \??\Y: Loader.exe File opened (read-only) \??\R: Loader.exe File opened (read-only) \??\X: Loader.exe File opened (read-only) \??\I: Loader.exe File opened (read-only) \??\B: Loader.exe File opened (read-only) \??\T: Loader.exe File opened (read-only) \??\B: Loader.exe File opened (read-only) \??\I: Loader.exe File opened (read-only) \??\X: Loader.exe File opened (read-only) \??\K: Loader.exe File opened (read-only) \??\V: Loader.exe File opened (read-only) \??\W: Loader.exe File opened (read-only) \??\N: Loader.exe File opened (read-only) \??\J: Loader.exe File opened (read-only) \??\W: Loader.exe File opened (read-only) \??\N: Loader.exe File opened (read-only) \??\U: Loader.exe File opened (read-only) \??\O: Loader.exe File opened (read-only) \??\K: Loader.exe File opened (read-only) \??\B: Loader.exe File opened (read-only) \??\H: Loader.exe File opened (read-only) \??\P: Loader.exe File opened (read-only) \??\L: Loader.exe File opened (read-only) \??\S: Loader.exe File opened (read-only) \??\P: Loader.exe File opened (read-only) \??\L: Loader.exe File opened (read-only) \??\G: Loader.exe File opened (read-only) \??\B: Loader.exe File opened (read-only) \??\H: Loader.exe File opened (read-only) \??\N: Loader.exe File opened (read-only) \??\Q: Loader.exe File opened (read-only) \??\R: Loader.exe File opened (read-only) \??\S: Loader.exe File opened (read-only) \??\X: Loader.exe File opened (read-only) \??\H: Loader.exe File opened (read-only) \??\L: Loader.exe File opened (read-only) \??\U: Loader.exe File opened (read-only) \??\O: Loader.exe File opened (read-only) \??\M: Loader.exe File opened (read-only) \??\Q: Loader.exe File opened (read-only) \??\G: Loader.exe File opened (read-only) \??\J: Loader.exe File opened (read-only) \??\U: Loader.exe File opened (read-only) \??\W: Loader.exe File opened (read-only) \??\V: Loader.exe File opened (read-only) \??\M: Loader.exe File opened (read-only) \??\T: Loader.exe File opened (read-only) \??\J: Loader.exe File opened (read-only) \??\T: Loader.exe File opened (read-only) \??\L: Loader.exe File opened (read-only) \??\M: Loader.exe File opened (read-only) \??\Y: Loader.exe File opened (read-only) \??\X: Loader.exe File opened (read-only) \??\S: Loader.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\taskschd.msc mmc.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1644 chrome.exe - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000003 chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\HardwareID chrome.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000003\Service chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340273883704212" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 62 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{CCC5B7FA-0813-4946-8FD8-DF559FFAD108} TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{9A0B70D1-39E6-4EA5-97D2-08DF40DD87EB} TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{27926D03-A35B-41FD-BFC2-B60BDB1FAED7} TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{9A0B70D1-39E6-4EA5-97D2-08DF40DD87EB}\Shell\Manage\command TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{B7578E0F-2D73-4BEF-A497-21ED8597CA7C}\Shell\Manage\command TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{9A0B70D1-39E6-4EA5-97D2-08DF40DD87EB}\Shell TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{CCC5B7FA-0813-4946-8FD8-DF559FFAD108}\Shell TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{1AA1C6D7-EBFE-4D89-AF2A-94BBAC307CB8}\Shell TaxFiling0916.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{705850F7-EB65-44CD-92BC-837F27CCEC96}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " TaxFiling0916.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{CCC5B7FA-0813-4946-8FD8-DF559FFAD108}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{1AA1C6D7-EBFE-4D89-AF2A-94BBAC307CB8} TaxFiling0916.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{98DAE01F-4F2D-454B-915B-EF7C7997B8D9}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{705850F7-EB65-44CD-92BC-837F27CCEC96}\Shell TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{98DAE01F-4F2D-454B-915B-EF7C7997B8D9}\Shell TaxFiling0916.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{27926D03-A35B-41FD-BFC2-B60BDB1FAED7}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{C8C1F8F2-DC53-426E-AA62-263FD89431C7} TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{98DAE01F-4F2D-454B-915B-EF7C7997B8D9}\Shell\Manage TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{27926D03-A35B-41FD-BFC2-B60BDB1FAED7}\Shell\Manage TaxFiling0916.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{705850F7-EB65-44CD-92BC-837F27CCEC96}\Shell\Manage TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{C8C1F8F2-DC53-426E-AA62-263FD89431C7}\Shell TaxFiling0916.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{9A0B70D1-39E6-4EA5-97D2-08DF40DD87EB}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{98DAE01F-4F2D-454B-915B-EF7C7997B8D9}\Shell\Manage\command TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{27926D03-A35B-41FD-BFC2-B60BDB1FAED7}\Shell\Manage\command TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{C8C1F8F2-DC53-426E-AA62-263FD89431C7}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " TaxFiling0916.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{1AA1C6D7-EBFE-4D89-AF2A-94BBAC307CB8}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{27926D03-A35B-41FD-BFC2-B60BDB1FAED7}\Shell TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{B7578E0F-2D73-4BEF-A497-21ED8597CA7C}\Shell TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{C8C1F8F2-DC53-426E-AA62-263FD89431C7}\Shell\Manage\command TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{B7578E0F-2D73-4BEF-A497-21ED8597CA7C} TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{B7578E0F-2D73-4BEF-A497-21ED8597CA7C}\Shell\Manage TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{1AA1C6D7-EBFE-4D89-AF2A-94BBAC307CB8}\Shell\Manage TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{CCC5B7FA-0813-4946-8FD8-DF559FFAD108}\Shell\Manage TaxFiling0916.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{705850F7-EB65-44CD-92BC-837F27CCEC96}\Shell\Manage\command TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{705850F7-EB65-44CD-92BC-837F27CCEC96} TaxFiling0916.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{B7578E0F-2D73-4BEF-A497-21ED8597CA7C}\Shell\Manage\command\ = "\"C:\\ProgramData\\OpenraVPN\\Loader.exe\" " TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{9A0B70D1-39E6-4EA5-97D2-08DF40DD87EB}\Shell\Manage TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{1AA1C6D7-EBFE-4D89-AF2A-94BBAC307CB8}\Shell\Manage\command TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{C8C1F8F2-DC53-426E-AA62-263FD89431C7}\Shell\Manage TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{CCC5B7FA-0813-4946-8FD8-DF559FFAD108}\Shell\Manage\command TaxFiling0916.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{98DAE01F-4F2D-454B-915B-EF7C7997B8D9} TaxFiling0916.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 3448 chrome.exe 3448 chrome.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1684 mmc.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeRestorePrivilege 1224 7zG.exe Token: 35 1224 7zG.exe Token: SeSecurityPrivilege 1224 7zG.exe Token: SeSecurityPrivilege 1224 7zG.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe Token: SeShutdownPrivilege 2760 chrome.exe Token: SeCreatePagefilePrivilege 2760 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 1224 7zG.exe 2792 TaxFiling0916.exe 1704 Loader.exe 4396 Loader.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2760 chrome.exe 2792 TaxFiling0916.exe 1704 Loader.exe 4396 Loader.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe 3764 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1684 mmc.exe 1684 mmc.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2760 wrote to memory of 4548 2760 chrome.exe 85 PID 2760 wrote to memory of 1972 2760 chrome.exe 87 PID 2760 wrote to memory of 1972 2760 chrome.exe 87 PID 2760 wrote to memory of 1644 2760 chrome.exe 88 PID 2760 wrote to memory of 5044 2760 chrome.exe 89 PID 2760 wrote to memory of 5044 2760 chrome.exe 89 PID 2760 wrote to memory of 1032 2760 chrome.exe 91 PID 2760 wrote to memory of 1660 2760 chrome.exe 92 PID 2760 wrote to memory of 1032 2760 chrome.exe 91 PID 2760 wrote to memory of 1660 2760 chrome.exe 92 PID 2760 wrote to memory of 4412 2760 chrome.exe 95 PID 2760 wrote to memory of 4412 2760 chrome.exe 95 PID 2760 wrote to memory of 1536 2760 chrome.exe 97 PID 2760 wrote to memory of 1760 2760 chrome.exe 100 PID 2760 wrote to memory of 3496 2760 chrome.exe 105 PID 2760 wrote to memory of 3224 2760 chrome.exe 106 PID 2760 wrote to memory of 4128 2760 chrome.exe 107 PID 2792 wrote to memory of 816 2792 TaxFiling0916.exe 113 PID 2568 wrote to memory of 1704 2568 explorer.exe 115 PID 2760 wrote to memory of 3448 2760 chrome.exe 128 PID 2760 wrote to memory of 1272 2760 chrome.exe 129 PID 2760 wrote to memory of 1272 2760 chrome.exe 129 PID 1752 wrote to memory of 1552 1752 TaxFiling0916.exe 144 PID 1184 wrote to memory of 812 1184 explorer.exe 146 PID 808 wrote to memory of 1940 808 TaxFiling0916.exe 156 PID 2636 wrote to memory of 4672 2636 explorer.exe 158 PID 4156 wrote to memory of 1168 4156 TaxFiling0916.exe 168 PID 2644 wrote to memory of 364 2644 explorer.exe 170 PID 3848 wrote to memory of 4872 3848 TaxFiling0916.exe 180 PID 728 wrote to memory of 2256 728 explorer.exe 182 PID 2460 wrote to memory of 2680 2460 TaxFiling0916.exe 192 PID 4092 wrote to memory of 3444 4092 explorer.exe 194 PID 3800 wrote to memory of 3808 3800 TaxFiling0916.exe 204 PID 1824 wrote to memory of 2040 1824 explorer.exe 206 PID 1008 wrote to memory of 2292 1008 TaxFiling0916.exe 216 PID 1596 wrote to memory of 2124 1596 explorer.exe 218 - System policy modification 1 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Loader.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Loader.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ybjjr.com1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff87383c728,0x7ff87383c734,0x7ff87383c7402⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,10318607856282548683,4432846110016719754,262144 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1968 /prefetch:22⤵PID:1972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,16397246401652509202,12797181071500737500,524288 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2272 /prefetch:32⤵
- System Time Discovery
PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,9515826860527819305,2652239521131599621,524288 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2536 /prefetch:82⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,11426212772006317508,17042452615047669726,2097152 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3148 /prefetch:12⤵PID:1032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,13943922323265488310,14262807021625659790,2097152 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:1660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,6052150796039852927,6644471271655441721,2097152 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4524 /prefetch:12⤵PID:4412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,13115777380702756059,5140458369343287645,524288 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5144,i,3290104280319903077,11638343855585301131,524288 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4716 /prefetch:82⤵PID:1760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5152,i,12481337562736070026,16587930347681458955,524288 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5644 /prefetch:82⤵PID:3496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,13712826234902124824,4772915276392121461,524288 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5236 /prefetch:82⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,7079050526921967121,13197470890851487534,524288 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5524 /prefetch:82⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5160,i,16633843763706137909,2880788740970118506,262144 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5000 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,17521280163357296946,106881958277329874,524288 --field-trial-handle=1972,i,8315513456166780876,4273219217138225158,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5812 /prefetch:82⤵PID:1272
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2784
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2188
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap27480:94:7zEvent186131⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1224
-
\??\E:\TaxFiling0916.exe"E:\TaxFiling0916.exe"1⤵
- UAC bypass
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\explorer.exeexplorer.exe shell:::{27926D03-A35B-41FD-BFC2-B60BDB1FAED7}2⤵PID:816
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_29902.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_29902.tmp1⤵
- Executes dropped EXE
PID:4144
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- System policy modification
PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_19512.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_19512.tmp1⤵
- Executes dropped EXE
PID:3312
-
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"1⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- System policy modification
PID:4396
-
C:\Users\Admin\AppData\Local\Temp\~tmp_97429.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_97429.tmp1⤵
- Executes dropped EXE
PID:224
-
C:\Users\Admin\AppData\Local\Temp\~tmp_95238.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_95238.tmp1⤵
- Executes dropped EXE
PID:216
-
C:\Users\Admin\AppData\Local\Temp\~tmp_06096.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_06096.tmp1⤵
- Executes dropped EXE
PID:2880
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1684
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:952
-
\??\E:\TaxFiling0916.exe"E:\TaxFiling0916.exe"1⤵
- UAC bypass
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\explorer.exeexplorer.exe shell:::{705850F7-EB65-44CD-92BC-837F27CCEC96}2⤵PID:1552
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_25295.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_25295.tmp1⤵
- Executes dropped EXE
PID:4212
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System policy modification
PID:812
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_73611.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_73611.tmp1⤵
- Executes dropped EXE
PID:1640
-
C:\Users\Admin\AppData\Local\Temp\~tmp_09342.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_09342.tmp1⤵
- Executes dropped EXE
PID:3736
-
\??\E:\TaxFiling0916.exe"E:\TaxFiling0916.exe"1⤵
- UAC bypass
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\explorer.exeexplorer.exe shell:::{C8C1F8F2-DC53-426E-AA62-263FD89431C7}2⤵PID:1940
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_62507.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_62507.tmp1⤵
- Executes dropped EXE
PID:3736
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System policy modification
PID:4672
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_30312.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_30312.tmp1⤵
- Executes dropped EXE
PID:1584
-
C:\Users\Admin\AppData\Local\Temp\~tmp_46014.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_46014.tmp1⤵
- Executes dropped EXE
PID:4968
-
\??\E:\TaxFiling0916.exe"E:\TaxFiling0916.exe"1⤵
- UAC bypass
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\explorer.exeexplorer.exe shell:::{B7578E0F-2D73-4BEF-A497-21ED8597CA7C}2⤵PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_15896.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_15896.tmp1⤵
- Executes dropped EXE
PID:948
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System policy modification
PID:364
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_22466.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_22466.tmp1⤵
- Executes dropped EXE
PID:4944
-
\??\E:\TaxFiling0916.exe"E:\TaxFiling0916.exe"1⤵
- UAC bypass
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\explorer.exeexplorer.exe shell:::{9A0B70D1-39E6-4EA5-97D2-08DF40DD87EB}2⤵PID:4872
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_88229.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_88229.tmp1⤵
- Executes dropped EXE
PID:4116
-
C:\Users\Admin\AppData\Local\Temp\~tmp_37024.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_37024.tmp1⤵
- Executes dropped EXE
PID:5092
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:728 -
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System policy modification
PID:2256
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_25985.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_25985.tmp1⤵
- Executes dropped EXE
PID:4956
-
C:\Users\Admin\AppData\Local\Temp\~tmp_76998.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_76998.tmp1⤵
- Executes dropped EXE
PID:684
-
\??\E:\TaxFiling0916.exe"E:\TaxFiling0916.exe"1⤵
- UAC bypass
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\explorer.exeexplorer.exe shell:::{CCC5B7FA-0813-4946-8FD8-DF559FFAD108}2⤵PID:2680
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_75762.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_75762.tmp1⤵
- Executes dropped EXE
PID:4116
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System policy modification
PID:3444
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_63477.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_63477.tmp1⤵
- Executes dropped EXE
PID:740
-
C:\Users\Admin\AppData\Local\Temp\~tmp_49551.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_49551.tmp1⤵
- Executes dropped EXE
PID:2352
-
\??\E:\TaxFiling0916.exe"E:\TaxFiling0916.exe"1⤵
- UAC bypass
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\explorer.exeexplorer.exe shell:::{1AA1C6D7-EBFE-4D89-AF2A-94BBAC307CB8}2⤵PID:3808
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_23765.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_23765.tmp1⤵
- Executes dropped EXE
PID:4908
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System policy modification
PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_94414.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_94414.tmp1⤵
- Executes dropped EXE
PID:3844
-
C:\Users\Admin\AppData\Local\Temp\~tmp_70482.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_70482.tmp1⤵
- Executes dropped EXE
PID:3844
-
\??\E:\TaxFiling0916.exe"E:\TaxFiling0916.exe"1⤵
- UAC bypass
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\explorer.exeexplorer.exe shell:::{98DAE01F-4F2D-454B-915B-EF7C7997B8D9}2⤵PID:2292
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_94644.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_94644.tmp1⤵
- Executes dropped EXE
PID:2580
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\ProgramData\OpenraVPN\Loader.exe"C:\ProgramData\OpenraVPN\Loader.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- System policy modification
PID:2124
-
-
C:\Users\Admin\AppData\Local\Temp\~tmp_80899.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_80899.tmp1⤵
- Executes dropped EXE
PID:1220
-
C:\Users\Admin\AppData\Local\Temp\~tmp_57160.tmpC:\Users\Admin\AppData\Local\Temp\~tmp_57160.tmp1⤵
- Executes dropped EXE
PID:5052
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\OpenraVPN\Loader.exe
- Size 35KB
- SHA256 b92632bdc48ba876cb7bbbda4348eac771fc5a450f4b4f3afa09b2efcedd79f6
- MD5 162262bed55ed7282dad1277936716d5
- SHA1 b50d2e594e6a9999970d4bb47e40fdd92d344e3d
- SHA512 8df774adc17ec97055570e7a7b188a8ebfb89eb58e657beb2df043f5cdeb14592f2c4b88c2b87c6d16a09568567290e9b3c121bdc974b0a6f446983b1ca3a792
- SSDEEP 384:a1LkkX41705BjYjLq91cpUokGkrmf0aGa4rsHDgvKvCy8RbmL4nNy7hFjO:wfS44UokhrO0aGa/8v/5ALTFq
- TLSH T116F2A5F24618090AE89BBA7DB497F93D54347D21AE83D2AD71E8DC333D3A78269C7105
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\VCRUNTIME140.dll
- Size 83KB
- SHA256 6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
- MD5 0c583614eb8ffb4c8c2d9e9880220f1d
- SHA1 0b7fca03a971a0d3b0776698b51f62bca5043e4d
- SHA512 79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64
- SSDEEP 1536:ikqwmvKrSgB91BDJ25Tg/G0G5r4Gt7qNBPS9DH6ecboHjPxu+dBsi6:i3CuavtckJSVqNBPSUecboHjPx/O
- TLSH T15A838C4567E802B6E06B9130C0E28E47FB76B485877047DF037A56AE1F53BE18B3AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\_Bottom.dat
- Size 35KB
- SHA256 c5d9b6e889ac776410b9e70930bc12afa202843d8ec2aa971204c416a3251c76
- MD5 79483a9f07969ab33e5ecbe12b29d769
- SHA1 64a09342152fe750082abac628e6bc94cae0202f
- SHA512 48c1d86e99691877b2ab6ecc4c684151689273c382a8919a443f7c90e9acfb5e53f816a1f53b9ec24794135ce1a7520b9cec9097ca6bf1f6f0a74699e645f08b
- SSDEEP 192:FeOKWCNEMIHSya1GIWobDdYgo/l7w+7w9Q+avOVigD482B1jcpTmKBK/UVJJT1Wc:QglNjAtoW+bvOecpqyXWCEEM90MG0C
- TLSH T17EF2B5748790832F5753221D542989CBE2A29728E3F271683FC7684F18BD8F3961DD6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\_Driver.cnf
- Size 144KB
- SHA256 51d8b26a76c165de9aa855dd1945c976afdc99a30a9d46bdc6ecebecc17dab8c
- MD5 2fee59648fc8e854c7c06bc1e9a5889a
- SHA1 fca7b17bb72fac0e9e9e2a1a26f0b59534d5509e
- SHA512 737c562354bf7fc07300c65dac24f4c7dea12abc987011477d4b410d455869d1a0976e82e5f7981622f4904f7f1e25bf15c6251023af32302a53b7ea906f62aa
- SSDEEP 3072:qInX8ZIf12XeFO4/sMDkrTqXC0Cwvb+ClIq0bCKbC/wvNLwv/NyTuD5uVufDRbCR:P1Fz/sohfD+zqYvVV03YTe5u4bhaauqQ
- TLSH T11FE3A6277C9B190A3F0A3363AB93F8596973CEB56FD0BEC8508B50E960997171D809C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\_Top.dat
- Size 453KB
- SHA256 42f21f4389db441c9b57b765320ba628673bd9856002bb20f0359bfd783d48a9
- MD5 b3f9cede4d9f8a731fd0692628eff2aa
- SHA1 b9836eb17dcbc47fb62b3b7f2cc99b9bd074d6c5
- SHA512 133fd48849e696531fdddb26fa9c9b315eb17cbf1720f45911718e66516f7668b63653795d72d58cdccd7e126de261988bf7a908b19ef46d95d338df0075c3b1
- SSDEEP 6144:VDMSTEXUiscf77mIjrqzMDhYhpp5vcIiAOaSzcchtHC48:uvscf77mIflDW15vcIZOaSx8
- TLSH T1DFA43E2C8B50876F8787100E542986EBE222A759D3FA72587FC7280F68EE5F3550ED1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\calibre-launcher.dll
- Size 156KB
- SHA256 25c29732f36d130709e40b8e5cbde2c205273af16ccc830c81577e434d97e84f
- MD5 630c904fdacba981052a085a10bc82c7
- SHA1 1d59e6fa7e92c5258de81525cc3155d82d3e2706
- SHA512 e38c2ee75023c9f504e6ce17cc21ae7c8e3cb9579a4935f4980c4444c1b1932a0dbcdeab128bea6c8311359a0b20806bba5107f8c593743bcaec12f5b11d5c96
- SSDEEP 3072:srH06rT0r9ZaWzS0HvbysEqfLHmJlOh9+n3v:aH06v0r9Z/9zyjqfLHVh9+n/
- TLSH T180F3F74723F80469F2F76778EDB60502EE72BD960721D34F1250A16E0F66F90BE66722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\msvcp140.dll
- Size 620KB
- SHA256 76c9060fd749d837c92b716a91a190b038f2c03e46da124a36f88075361a9be5
- MD5 ab15feb56d735f4589217d02464b1a06
- SHA1 1362b65006aad34031e51ab005ea54b7337c734a
- SHA512 031a85e5f6973d473641cb84668a3923682b9ab92958a23b3a68f2fb2ccfc79ae0982c7cdef1a28bdfad486c0b411c9eee40188cec6724099e68fa3a2a2543bd
- SSDEEP 12288:CKud5zgdkWhgdq/fazwEQ96d2GYGyQEKZm+jWodEEVmHT:0KqzwEQ9+2D9QEKZm+jWodEE0z
- TLSH T196D41923EB590AA0D091D3B851874742E7F1BC158B21EBC752EBE26D2F277C5A23B750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\OpenraVPN\vcruntime140_1.dll
- Size 36KB
- SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
- MD5 7667b0883de4667ec87c3b75bed84d84
- SHA1 e6f6df83e813ed8252614a46a5892c4856df1f58
- SHA512 968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
- SSDEEP 384:5InvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWj14gHg:dCm5yhUcwrHY/ntTxT6ovR7VxIV1z
- TLSH T172F24A8167788096E46B95B0C4A35F27FB38F9616750938F0BA4825D2F637D0F63E31A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 6df545ecdd99f656fc2a29d36350a9522b62b0ee8adda22f4b1b5d74f3080833
- MD5 6237b0d72e9251a0bf52cf3959f7f974
- SHA1 3adfc9806ae1ebf9aed1582eca4ee4044b6b70be
- SHA512 90c0deb540041de3e39e85befab69dd397e952cfcc539b2398f03598f42965bfa51dc3af0c40ecee9e4300594766c3d25bc6483a60814f0f5b4320f336d9d0fa
- TLSH T13FE0ABA9C861AC7B2DFC032820940B46E650036737404A0B373CD9098FF423B01858AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 f2232a28b8195a82f605003b47b180d0a15371471a6a6be28ccc010f3198d503
- MD5 63fbd1ea800f0a586c64a385129f9deb
- SHA1 f24f722eda03337bba3d9ddc5f4bbe10b26055fb
- SHA512 a6cc11edd513512e0ecc0671e2a569bf06a0dedfdacfb216548748164c26479a500922f7941fd316d4d645ed79054d40b57d69c908af33e307e43f30303dc4f3
- TLSH T19D518EF7C3E8867DC94156F49B256E1FCE2D0A14532C3C66C8D4AF1B93E29B1D21068E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 d2f1e851912b104985acad278c51012158a410a7bc07d83a8a3419ec9bf481c6
- MD5 f8b6ee9d4ddf2859e0f333e7f6d8b56d
- SHA1 45afc0928c2229855b2445e836649352c7a3282f
- SHA512 275814d459a5db27c24f6cedfec24357f3422da2093919c45c901fd2bc3daceaee50db5c0297d9a932f539f2529f8379ebd326f02c14977efa17be2dbf097d26
- TLSH T1CA517FF7C3E8867DC95156F49B156E1FCE2D0A14532C3C66C8D4AF1B93E29B2D21068E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 d5b5f4eb6da2b2e3017f8b9deff1f4c9c1cba78765c7ab8d9808ab46007a8d1f
- MD5 e9b5b8e1d573de7bd074df2d39d10fcc
- SHA1 8cabc7e354101eba640e246a415a448a3c7a74a6
- SHA512 bfb6c8db21914261e62d4e6793a1bde8e1cde576a88bc0b60373a0ffdd7219ed30afe7c991e0bde401a2ac218fa8d08fbbbf329c897de5171235d5b925983d12
- TLSH T144516DF7C3E88A7D890156F4AB156F1FCE690914532C3C66C8D4AF1B93E29B1D21068F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 826eba07de44bf86a38ca3bf66c898afb0df2bde3606840ad0c2148cbbc53961
- MD5 3037d9bf8b2007aa1dedc77950e9e42d
- SHA1 9c4a3c5752d7bae4652b8fec6aad921cf45c0d1d
- SHA512 5af067e26be2f6aef9f4d7f82eaed0210312714f86ff102af34b97be8c9f4ec51e17b59c09a54e5090dde86621bf41b231d095da0e410bb61f22e5b3380dc26c
- TLSH T128517EF7C3E89A7DC90156F4A7156E1FCE690914532C3C66C8D4AF1B53E29B1D20068E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 b97c29b60a68eee75ee521f2292f5c5bdca1df3ab4867c6d8d588b6fee9206fa
- MD5 84fa31cf0d7ae90531ee0d3f62b6e365
- SHA1 5372ee3d687b906611fe151f978446fe128a367f
- SHA512 ccf61231d770efe78423d045b475a9f3919c2856a4c55fe373e2099fcce5381732b8582809069128c13ff013af72d1aab60038b9497cf41daf95aaf1d9ff37ef
- SSDEEP 192:iRb4LK2Gw88+Z6jyEv7UpAPRp2lbK9/Hsb+WNnbnXObQ3V2L9MS2e+3CVyIsnAUh:iRb4LK2GG66jygAUX2KhwbXIKV2L9WCu
- TLSH T1CE32832DAD10757B5CDBC22AF9627B67E3F5202124942E84E6FC8D7C25E76CC6217407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 2e1769b7865b5a93431a58d3fc1c64014d262ebd2c4a5ba5cd6e93d3eace1765
- MD5 3ba79329830d17a4696586537a10eeb6
- SHA1 ec03c1bdaf80f0a2cce1306eafa7a952a2c8c88a
- SHA512 582cee8defd959af56c9ea0c4843fad68fc39a15bf72ba4980f1eb1d5c0a4e818575b14151370d9263050729a652e54556f78e655fb5acce9bc51bf7376915fc
- SSDEEP 192:iRb4LK2Gw88+Z6jyEv7UpF4PRpgjlbK9/Hsb+WNnbnXObQ3V2Lo4MS2e+rCVyIs7:iRb4LK2GG66jygAzKXglKhwbXIKV2LR6
- TLSH T13E42732EAD10697B5CDBC62AF9627F67D3F5202124902E84E6FC8D3C16E76CD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
- MD5 8620b09f169758aa6d92f2e7b8a4c29c
- SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
- SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
- SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
- TLSH T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 132KB
- SHA256 2333669633f7c10f62176cc4604423cc0e80aba813a317dbe9213bceaf671acf
- MD5 fdb1d36121d44f334595416022fb3d1c
- SHA1 55024f12a3ac6d7808ba9aa3153f36eb827c54c2
- SHA512 cb097918476675ab454546469b71c79b439ce1d055457f2c2cfbab1722d781ac0449e2cf73f0398895b9200a519026d3c2882abcabc9a9f5f772731966e3bb7a
- SSDEEP 3072:OWFm+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:xFm+hFD+7t56OD9ZfSApprE
- TLSH T13DD30232AA95D877C9FD7541F147A304DEA668ED41DE2A0D844A9F8EE09F84C0773A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 9a5650d2c555014624659e345e7c2264814280fd26a3d1a6e877a58eb739f453
- MD5 8407de1b19e182f8416bffee40f793e8
- SHA1 b7f52710584226bc87b1adafbff54593f92eaefa
- SHA512 a8fa9aadf7d2cbb9c796f4acf1787ac45e3f956bbfd0731eec060136eed85c15cd6e5846ee646433a8b6c17e9802f7d0d0c851c47cd4b3f03b45b81d8ac5c5c9
- SSDEEP 3072:OWv+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:xv+hFD+7t56OD9ZfSApprE
- TLSH T126D31232AA95D877C9FD6541F157A300CE7668ED41DE2A0A444A9F8EE09FC4C0773A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 132KB
- SHA256 bc7c1a220f3f1452563c6be934b41ae36f1c940011015985288497078b827c1e
- MD5 a7e2aad6010be9769a1f9c184dde21cd
- SHA1 cf8a1a52da5d9b8a9c7b86b6e92923d1154f7cda
- SHA512 ec27fa979f9b3dddeadde3bb28955b727ca622bd9030292502084ad4d4edfe8eab580eb733ec6314f21f58c8cab740e9af975fa81da39115018b27c3deef41f9
- SSDEEP 3072:KWFm+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:NFm+hFD+7t56OD9ZfSApprE
- TLSH T131D31232AA95D877C9FD7541F147A304DEA668ED41DE2A0D844A9F8EE09F84C0773A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 131KB
- SHA256 574f073e6fb16816f64a63be6d57027a4d38ba079b64e9cf2529a12939f13105
- MD5 d3ff62cb338f554f2ada5cf628cfad16
- SHA1 fabbe11847d2a098cc7bab4cc4f14b47c9f81a20
- SHA512 6d53ffa7292dd501340aba84aafc7c05913c659118c02ad11d0f1cc466b9a58b3035e6cdc9d13b140ef98801f18a20110c2fc661dee1d6b93c0f30b265667ec6
- SSDEEP 3072:1Wv+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:Iv+hFD+7t56OD9ZfSApprE
- TLSH T1A9D31232AA95D877C9FD6541F157A300CEB668ED51DE2A0A444A9F8EE09FC4C0773A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 130KB
- SHA256 b68c3d8ec2b4fdcd906ded2d14e5e680e68a94daa576a2aad55ed0a22dd4bba8
- MD5 95231c235d5c3c6900190cc1c76f1bd0
- SHA1 26e13bcc39b582442d93ae2b65bdf845452aa752
- SHA512 d02e8ef6a8c7852681c7a12f00b4ad04d7608d5bdf313b693c55c24a287aae5325ee8f67248a9f56e35543bedcfc41294606053e4ab1220e9db8d8ece0d1b1fd
- SSDEEP 3072:1PB+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:ZB+hFD+7t56OD9ZfSApprE
- TLSH T182D31232AA95D8BBC9FC6541B157A300DE7668ED41DE2A09444A9F8EE09FC4C0773A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~tmp_29902.tmp
- Size 54KB
- SHA256 81372e638dc556b777e74d924afe3ddff620c7d21fbac0eb5857103825cf7093
- MD5 2c1a1a8b4d0f6ce2f4364d03f672026f
- SHA1 eda732c296834648e08ab17ab7a8e7c39301b6ef
- SHA512 659ac85207d6c4ff3bc6c92e793b10f0ea7579eed19ff87ce730595e54cd370f3051eff6975a9fe4b8c6a65ca474e7d8cfaab473695df0b184a13c5d8b98dc83
- SSDEEP 768:csQDxKVp5f5fLFbXH3wN0ynlbLFcewnBpvwzLOdNqc8ocNe+ScV8D:csUoVpTF8N1l9cewnrwOWc8ocNecV8D
- TLSH T1AB43388357A918C5FAB79EB8D1B89927EDB2F6951F50D4CF116080490E33BD0EE3821B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\K06_701_20260916.zip.crdownload
- Size 1.5MB
- SHA256 e60d6b0f661447f2e52cb90adda3a7b98713d7963b6760b554eb24471fba6895
- MD5 7d7ae620e7f2e237a24f5accf303ea5c
- SHA1 b4239b9708b40aaab97093f3f62d2c5e08b1cd44
- SHA512 4865d41bcb3bec5bf41acb502cadbe1d86c058739675f62d882e4d0fb3a18f5baec1a179507667c1d213e9c895ac2264dcd438bdf5cf4a890bbc86e8a4dc66ce
- SSDEEP 24576:4rh6q+3jjPgzd1pKDt0KpHVz09qfsT23kM2Zz+SlBjldiT5fWiifKdU8KNS1bRbe:4rMdTMzdbKDtVR09qO20dgGBeT5ewXnC
- TLSH T13A7533C41335FF9CAFA22CC6C81E04338A6491C31B2BBF5956ED3AC2B2369D8019945F
- MD5 SHA1 SHA512 SSDEEP TLSH