hxxps://yub-x[.]best/

Analysis

user interaction
yes
max time kernel
299s
max time network
289s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/10/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://yub-x.best/
Sample261017-s85syswtfs

Score

8^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
258	5024	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2814447569-4053889695-374664695-1000\Control Panel\International\Geo\Nation	7zFM.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
4920	7z2604-x64.exe
1724	7zFM.exe
1800	yubx-ui.exe

Loads dropped DLL 2 IoCs

pid	Process
3372	Process not Found
1724	7zFM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yubx-ui.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2604-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2604-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2604-x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	yubx-ui.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	yubx-ui.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5024	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2604-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2604-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2604-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2604-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2604-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2604-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2604-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2604-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2604-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2604-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2604-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2604-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2604-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2604-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2604-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2604-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2604-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2604-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2604-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2604-x64.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
4324	chrome.exe
4324	chrome.exe
1800	yubx-ui.exe
1800	yubx-ui.exe
1800	yubx-ui.exe
1800	yubx-ui.exe
1800	yubx-ui.exe
1800	yubx-ui.exe
1800	yubx-ui.exe
1800	yubx-ui.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4372	7zFM.exe
1724	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
1776	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
4920	7z2604-x64.exe
4920	7z2604-x64.exe
1724	7zFM.exe
1724	7zFM.exe
1800	yubx-ui.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4920	7z2604-x64.exe
4920	7z2604-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 888	440	chrome.exe	84
PID 440 wrote to memory of 3432	440	chrome.exe	85
PID 440 wrote to memory of 5024	440	chrome.exe	86
PID 440 wrote to memory of 3432	440	chrome.exe	85
PID 440 wrote to memory of 2924	440	chrome.exe	88
PID 440 wrote to memory of 2924	440	chrome.exe	88
PID 440 wrote to memory of 4900	440	chrome.exe	89
PID 440 wrote to memory of 4900	440	chrome.exe	89
PID 440 wrote to memory of 4588	440	chrome.exe	90
PID 440 wrote to memory of 4588	440	chrome.exe	90
PID 440 wrote to memory of 4892	440	chrome.exe	91
PID 440 wrote to memory of 4892	440	chrome.exe	91
PID 440 wrote to memory of 2108	440	chrome.exe	92
PID 440 wrote to memory of 2108	440	chrome.exe	92
PID 440 wrote to memory of 3944	440	chrome.exe	95
PID 440 wrote to memory of 464	440	chrome.exe	100
PID 440 wrote to memory of 464	440	chrome.exe	100
PID 440 wrote to memory of 3524	440	chrome.exe	101
PID 440 wrote to memory of 3524	440	chrome.exe	101
PID 440 wrote to memory of 4360	440	chrome.exe	103
PID 440 wrote to memory of 4360	440	chrome.exe	103
PID 440 wrote to memory of 2464	440	chrome.exe	105
PID 440 wrote to memory of 2464	440	chrome.exe	105
PID 440 wrote to memory of 3984	440	chrome.exe	106
PID 440 wrote to memory of 3984	440	chrome.exe	106
PID 440 wrote to memory of 3404	440	chrome.exe	107
PID 440 wrote to memory of 3404	440	chrome.exe	107
PID 440 wrote to memory of 4416	440	chrome.exe	108
PID 440 wrote to memory of 4416	440	chrome.exe	108
PID 440 wrote to memory of 1476	440	chrome.exe	109
PID 440 wrote to memory of 1476	440	chrome.exe	109
PID 440 wrote to memory of 3408	440	chrome.exe	110
PID 440 wrote to memory of 3408	440	chrome.exe	110
PID 440 wrote to memory of 4852	440	chrome.exe	112
PID 440 wrote to memory of 4816	440	chrome.exe	113
PID 440 wrote to memory of 1240	440	chrome.exe	114
PID 440 wrote to memory of 3764	440	chrome.exe	115
PID 440 wrote to memory of 3764	440	chrome.exe	115
PID 440 wrote to memory of 2332	440	chrome.exe	116
PID 440 wrote to memory of 2332	440	chrome.exe	116
PID 440 wrote to memory of 4376	440	chrome.exe	117
PID 440 wrote to memory of 4376	440	chrome.exe	117
PID 440 wrote to memory of 3612	440	chrome.exe	118
PID 440 wrote to memory of 3612	440	chrome.exe	118
PID 440 wrote to memory of 2552	440	chrome.exe	119
PID 440 wrote to memory of 552	440	chrome.exe	120
PID 440 wrote to memory of 552	440	chrome.exe	120
PID 440 wrote to memory of 2192	440	chrome.exe	121
PID 440 wrote to memory of 2192	440	chrome.exe	121
PID 440 wrote to memory of 2784	440	chrome.exe	122
PID 440 wrote to memory of 2784	440	chrome.exe	122
PID 440 wrote to memory of 2980	440	chrome.exe	125
PID 440 wrote to memory of 2980	440	chrome.exe	125
PID 440 wrote to memory of 2300	440	chrome.exe	132
PID 440 wrote to memory of 2300	440	chrome.exe	132
PID 440 wrote to memory of 224	440	chrome.exe	133
PID 440 wrote to memory of 224	440	chrome.exe	133
PID 440 wrote to memory of 4324	440	chrome.exe	134
PID 440 wrote to memory of 4004	440	chrome.exe	135
PID 440 wrote to memory of 4004	440	chrome.exe	135
PID 440 wrote to memory of 2780	440	chrome.exe	136
PID 440 wrote to memory of 2780	440	chrome.exe	136
PID 440 wrote to memory of 968	440	chrome.exe	137
PID 440 wrote to memory of 968	440	chrome.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://yub-x.best/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffa4374c728,0x7ffa4374c734,0x7ffa4374c740
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,4011190922861206499,13969338189802590519,262144 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1916,i,17832730962299154001,1153208725250189868,524288 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,3246042601932570947,12388467491467871708,524288 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2256 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3080,i,13708278670368985360,11273650487988469351,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,1264200615729301160,6499545656318007532,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,16030839503145165791,13273550413813837739,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,18000201660122531830,4860870076931398996,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,10520894356282755137,14577483618903691785,524288 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5800,i,1954000432938670769,4475892695333956621,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5784,i,13727669630256579167,15476551655430858151,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5740,i,13606366788510973812,1846808636029537394,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4736,i,600663933624137295,6596186525500747850,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5892,i,12037142878547010760,310308555865346627,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4808,i,13121486303616903581,13545222904715213670,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3684,i,2897239880748088770,6084186120190143653,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4768,i,3401870563001140424,7668266324293140213,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5700,i,700453107147078475,12839720469027634385,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,4664450119120300316,15632688293997093082,524288 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,3478354791835915314,13947745754965060301,524288 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,13005679384146261209,14642906230771040441,524288 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4768,i,8683858394164047265,1917625804225689722,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5664,i,10517669057800276896,2385832199130442807,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6068,i,1032709617272477502,3196039027643452830,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5936,i,11984930448133319957,9190007819738480288,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,9207112467735949247,14329616110227283445,524288 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6132,i,10443174854734416633,631245075789416375,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5824,i,8374439248495408441,17295212649819929114,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6232,i,17798386724420055670,17696872417204599534,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5604,i,5020101938107883893,13637063791353121213,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3104,i,5367478641291858765,953141505595270832,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3640,i,13011642636959705070,17442090965649665451,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3548,i,10285030835652302210,9126287635664347433,262144 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6464,i,17732741759298541033,9137532043944001965,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6024,i,6642873514537434319,15080200210441342330,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1176 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5644,i,1044275882332869493,17188633526561697262,2097152 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,6879396811990930930,3373586241483115943,524288 --field-trial-handle=1968,i,12330092893986362042,17165913280859250877,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:3568
- C:\Users\Admin\Downloads\7z2604-x64.exe
  "C:\Users\Admin\Downloads\7z2604-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1396

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4032

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\yubx-ui.rar"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1724
- C:\Users\Admin\AppData\Local\Temp\7zOCB6B8CBC\yubx-ui.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCB6B8CBC\yubx-ui.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:1800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=yubx-ui.exe --webview-exe-version=2.0.6 --user-data-dir="C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1800.1556.18309440513944945215
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1776
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a0,0x1a4,0x1a8,0x17c,0x1b0,0x7ffa36e9b078,0x7ffa36e9b084,0x7ffa36e9b090
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView" --webview-exe-name=yubx-ui.exe --webview-exe-version=2.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1848,i,7613224989139294351,276156043153773008,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
      4⤵
      PID:684
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView" --webview-exe-name=yubx-ui.exe --webview-exe-version=2.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2124,i,7613224989139294351,276156043153773008,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:3
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView" --webview-exe-name=yubx-ui.exe --webview-exe-version=2.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2396,i,7613224989139294351,276156043153773008,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView" --webview-exe-name=yubx-ui.exe --webview-exe-version=2.0.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3804,i,7613224989139294351,276156043153773008,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
      4⤵
      PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.dll

Path C:\Program Files\7-Zip\7-zip.dll
Size 99KB
SHA256 f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902
MD5 d346530e648e15887ae88ea34c82efc9
SHA1 5644d95910852e50a4b42375bddfef05f6b3490f
SHA512 62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673
SSDEEP 1536:mCkXPxYbAVFYytdtXD571K8XQui+aFBZxH3OwenyrKm5GDES575Y+NPyFG:dmxDF5tGVFBZxHeB46VYdG
TLSH
T1F6A3C625B664C335D073D0BAC9C2AA99EA7178419F304BCF6246A74D1E36BDACC35732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Program Files\7-Zip\7z.dll
Size 1.8MB
SHA256 899cd73d7fc60e1c1c35c7de0f5bed3dc69bfe2cecbd48014d868a347970a0b1
MD5 b6c57cc0c08141d9c55971e047ed2e00
SHA1 c26c6d0f01d317770948c7193cf6544eb7e2562f
SHA512 25bb19470590eddc5042571d1b1eb424055133fdf2695f0424efb1e6ac919791bebd8ca33f40f896c98d87c5e50b80b3563b2d67c6a374b69c1404a0d8469cd1
SSDEEP 24576:5NBVrus9D94VsSEi9Z3P/nj/A+xfRIpNDiczbB9h:5bVrrBesSEi9hT/A+x5IpvDh
TLSH
T198953B5BF6748270D0B6C075C5E2AB9AFE7134868B30A6C712859B3D2F17BF58639720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 980KB
SHA256 58e8d5c2e6cea7589d13790baa5d48a926ac5cbb2858afd19bd309991114a132
MD5 046a6e5f899df468950a3c22f3c182ca
SHA1 d281a918fdd8e3a298d4a503251e19470e31ebac
SHA512 87e4d260e7dcbb40238dd0428b9dfb6349e49d3cd0109f087f757056eaac1109e15e4f08105a85e243a8c99382d8104e044d2d8d59fa948b10f95a3a35a6e2ff
SSDEEP 12288:w0m30C8oz+2OaW5gRUe3+cu1XEhr/YCRzBSl4EgMwFdqpPSayp7NgDlGA6W/:s0E5XRUe3+cGmrwCRFSXgbrqGCGO
TLSH
T19425E815F5788323D0B3D0BAC5D6AA9AFE3230465B3089DB024A976C3E277D6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11c115d4-fffe-494d-aedc-56af8f7ee57b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\11c115d4-fffe-494d-aedc-56af8f7ee57b.tmp
Size 132KB
SHA256 9ede6116949630515041b28f3c708f9339a35a898c5cfa51db01b54e5ef9bf7b
MD5 b8396965f79e05cc3b34e530fe44e343
SHA1 d7826f8d3f11cd88d0c65142e89f0cc165523645
SHA512 6df1b0abed71ccb4b96880f2f9f2eb40b2531585eefd9f027af014d973a84b0df1f686a7ae94ce3b9bd27906d7d752c5b4b45ca0dd7d858ffb20f65790783014
SSDEEP 3072:DKIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:DqPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T10FD312217D05BCB4A9EEDB21A1901A16EAB8D90F953D7BE65CDE3F4806E36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

233456f9-6758-43d7-b4d2-a6d5d2aa78ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\233456f9-6758-43d7-b4d2-a6d5d2aa78ce.tmp
Size 132KB
SHA256 b2f7b397809d23e3549ea8e3017fe51700d196a563a414aba323e6d374ea4125
MD5 d67d949a661eb8f01293f379cbf920a2
SHA1 f99cc59a82f936a091941a079fa2c2fe1573f8a1
SHA512 0d63e0c6db61a934b282d358eb92cc0f9246a75008a55a23b6bc990c24e8be342faec860718a3080655c0c0fb8b8d5058a2fc66c221dadb05f6f9d19602e5363
SSDEEP 3072:I5IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:IlPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T1ABD312217D05BCB4A9EEDB21A1901A16EAB8D90F953D7BE65CDE3F4806E36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3204e489-e4de-45ac-96e4-3fb43a7947f7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3204e489-e4de-45ac-96e4-3fb43a7947f7.tmp
Size 132KB
SHA256 1aa0610e132aaa1f77218caad5364606e46e1d895c7ec505ceedb18f0c6a464b
MD5 9515cad85453cd2b00cd539d850d7353
SHA1 952506d567d920f2e9a7a5af0f22e9f75c3a19b3
SHA512 c90de61454ecb1116c7f5811fc5fc4e3fbd55e87876f3004a138b20c8e671384f3c8d2356219ad4f971def6d9881e25179c09e68663d71c592b2e0bed80cdc7c
SSDEEP 3072:IMIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:IoPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T136D312217D05BCB4A9EEDB21A1901A16EAB4D90F953D7BE55CDE3F4806E36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b869c0f-c447-4e8c-8afd-498b4628c22b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3b869c0f-c447-4e8c-8afd-498b4628c22b.tmp
Size 132KB
SHA256 5fe580b764c859e68059013d7aaa15857762e62b8e186a5bda020386e5855807
MD5 66ad5628604758fc1dee697a578b6de2
SHA1 86e7b4943046f0b056b16769a576776f455793b2
SHA512 16de96924e05c16b8c02a7ccda715b8e532be49821bccf068b6fe22ea8ef676da34aa7044894575c98d5cbf741e0b67aab07d1d032633287c459d7e22045b249
SSDEEP 3072:DGIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:DGPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T104D312217D05BCB4A9EEDB21A1901A16EAB8D90B953D7BE65CDE3F4806E36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63cc9040-5a30-4b02-83da-4704b27216fc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\63cc9040-5a30-4b02-83da-4704b27216fc.tmp
Size 131KB
SHA256 adbc61811657c05cf115b3c6367320bf81b1fbb63240e92125b4994e6c57c74d
MD5 2c4a28124a370c1ee443e48d679e7fc2
SHA1 0e8e078594bf82202427ded82ea938f0012cab4f
SHA512 910a79892793e5f0419e6cfbc2500fccf9da6a5712ce4e96b5b8dbc67dd8785b9b48a7ac0dd3d496a3d794f3385ae9a81f6d6883d82119ad4bce75c8d6d9b55a
SSDEEP 3072:JIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:1Ptbmf1K49XLWbEPi4NTKlLzh
TLSH
T1ABD312217D01BCB8A9AEDB21B1901A15EAB4D94BD5397BE61CDE3F4806A36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80ff0a98-b0e8-462b-982c-40a66b16934d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\80ff0a98-b0e8-462b-982c-40a66b16934d.tmp
Size 132KB
SHA256 ea2694e5fb8df6fa613dcd76e98e7b76fbf413a6c0b95f67357bc594cb827163
MD5 caf68d29eb35b2d601fb63bffb442a88
SHA1 583a19855360b2d26127b4ceb7875a8ff8a8d624
SHA512 75ffae074ba33017e5ec84eb91ae438c39ec98b29fe879be2dfeed07ff9133d25cd75c9a1aa1501e187843045af0926ddc750a0facd58309b38099483434af89
SSDEEP 3072:IGIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:IGPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T141D312217D05BCB4A9EEDB21A1901A16EAB8D90F953D7BE65CDE3F4806E36D9C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e43367a-f06d-4055-b5cd-c18e484b6bf6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8e43367a-f06d-4055-b5cd-c18e484b6bf6.tmp
Size 172KB
SHA256 82afa9696fda6b6328a367287981a18c780286394526236062692129883736dc
MD5 b31da54d77cee8dbbfdbc00ae19e8005
SHA1 356bb6df27599adbbf17af764c1ca1985cbf882f
SHA512 df50f4245a8fd6ae7edf46a09c2f8f2b8641acc9d484322b6844d92adab7416e2682b0833fbb19523e6c3120dc3bb2381e980bb5bdb25aad388aede97d6c8165
SSDEEP 3072:IcymTcnt1IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:IcjcntRPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T19E0412507E1578B899EEB77261905D46A2F4D96BA9393BE64CCE3FCC05972DCC204C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 08a797dd771d0be81e46ca4a71e9835926d637cc88055d6677444211e9c1f7ba
MD5 980133cb8334424f928677e5b86dfaaf
SHA1 62f4f41deba1ce90fc175d09339de1d6feea3f04
SHA512 f7e6d8916bf610bba01b7ac3c95dab97926bd068420b8d48ae83c383140870e2898d4750e59bd5312cf0d4801d47cb99f9a65bf6dcc5d711a1847a63008e9c1f
MD5 SHA1 SHA512

Submit Download

1f7107d3-bbfd-46f6-98d7-4afbce613ccd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1f7107d3-bbfd-46f6-98d7-4afbce613ccd.tmp
Size 14KB
SHA256 f3d5a72633f1ffcef4acfb190791bf00b5ae0bdcd0888427132672b1869380a3
MD5 33862d8d7094246fb48fabe0155ca1a5
SHA1 d4e1b711258d680366b09d31f355d0b76dde830f
SHA512 e187f6514b4c6d9d5882b91d6ab536110ea9918ebad6130bc2c6908950410dcaf754ededb27d944d3011b61af158fc6530a47195fc127f1cfd4434c3c77ab329
SSDEEP 192:/RENZYHcUtv7MpAPRp2G3LzSr0yS7CI19tHsb+WNsEf8FdHvMwO9e/G2gFVyVyI4:/RENq7NwUXlvwbbeO2gaE
TLSH
T11962A35EAA602A7B9CE6D729F895B757E3F5202170C41E80EBF8C92C25DB6CD3117407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2821eea3-0646-4196-abbb-0d23be021d10.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2821eea3-0646-4196-abbb-0d23be021d10.tmp
Size 16KB
SHA256 266676ef7bfd8ada9daa941f326e287932bce4a2f08084d42c3ae208615d898a
MD5 f88e1a43d0174882dc56182953121f30
SHA1 9b4a0e4324baf266cf8af8b79e19efe7b74778de
SHA512 8cce4f8b9a0fa035edf4f846e732eb6236f3673334c6c02fba1af5f7a53b90014b8a1c29c6edd85a9f4c222d9c82c717f72d3eddfb124bc8be386b8b66f3f9d0
SSDEEP 192:/RUcBhI8YHcPtv7MpWPRpyG3LzX6EcG0yS7RlI19tHsb+WNsE9U8FdHvM4Q3ptSE:/RUmhIL4NwmXZvwYjuFe92gIE
TLSH
T15D72A65EA9602A7B9CE6C729F895B757E3F52021B4D41D80ABFCCD2C29D7ACD3113406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60186855-1141-4809-912d-a117eeb647a4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60186855-1141-4809-912d-a117eeb647a4.tmp
Size 17KB
SHA256 bc874b5dfd433743339ca27fbc016d54b007fab3e56af9f017a931025cb0f537
MD5 8d3394a14b12f06ecbe650f06b4881fa
SHA1 d4c8ccc659c5c983f73adedfc2f5491607ac031e
SHA512 5052397393a9e12e611402bc4ac104433e8a02a13f8c7f9236e7f653a48cb0a7aaac61660c212ab456241d0ca72e689c0cbd6c0186b51f3570b8c09ec3b374b4
SSDEEP 384:K0juV7KxkXqKf/pUZNCgVLH2HfgslRU7pLuLceScdXODu1+ErU3pfHGeXTuxL:KYuV7KxkXqKf/pUZNCgVLH2HfgsDU7p0
TLSH
T15972E967AC4CAA3B0FD4CACCD8277F4FEDB5025A65D9886443FA982503D5ACB11061E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bd89679-32f3-491a-bd80-fdcd3da06db0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8bd89679-32f3-491a-bd80-fdcd3da06db0.tmp
Size 12KB
SHA256 b399bf39d198b87624fcea69edcf39286142d17ebeeda1cd4d44556cbcdda747
MD5 166a0e41b2003116ca35ca02fc942a75
SHA1 76bf8bf00511595214a634bcbb49a06e21ac5b94
SHA512 5beae6221db25a9dc841fe5ce67f64dc5115a338b29f744b2db37952e0fff08fe0905bc2c30130233885be5ccf41163e6bf9f0db70d405a362130266c4f133ad
SSDEEP 192:VRE9ZYHc15v7MpAPRp2PIT9tHsb+WNnuXdvs21G2gFVqVyIsnAUge:VRE9qwZwUX3vwmq242gye
TLSH
T17742A22DAD60793B5CDAC32AE9A57B93D7F5102170942E84E7FC892C29E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 36KB
SHA256 a931e259101cd858117abd851fa2f6d85b848324e71ed326d9588d22daf84d89
MD5 5938c2e8647f4e3a8f3ce1fc4264ff30
SHA1 6b07c95fe2460eab2a02d33e56e2c72ab7a5c9de
SHA512 7de4a8d7101a4bc6116730ac85a2a165f2e3c389b908547449e15fcdb0285f82a430da6001b2f7aca9fbe82ab9f301788ec1bf530c7e4f686ef6a4a34395ad63
SSDEEP 768:AGUaTfXsozUOHK+o7dmiQ5IVuXZC3J6C/F0LxKdjtoBgBFH8lgZ:AGUaT7Uqe7dAOVuZmVOxGjtoGBFZ
TLSH
T1D1F2F217E4442AC25C189B29D9B4FBABB695A37A198B7B0D505D383D5CCF08E08C93E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 37KB
SHA256 06b16db7a969135d48d38c49183be7fb88d4452e2a3011957c7851941f4e4879
MD5 311d352d93230ece04b34eaa8ad10d08
SHA1 a5ec54920b589ebe2af3bc3bb7754a476db68abf
SHA512 c6958d434bd827914bdd132b294209f48d84c4f91aa09ac6476fcaf9ab1cb5e70da6721c9ae2cfe350fa8288fab2ac10208e4a7d2c385a746768048bac0a631a
SSDEEP 768:J1K3v4RM1yf6cH/Ca4EOAFVnQZ1haUKUKAJmosEc6wcTwL/bjf:m3gq1yf6XOQZP1GEcaTwjbT
TLSH
T11B03F1B385431CA543842F3397CF967CC978FA55AB843B885823ECCC14AA6ADCDC0764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 175KB
SHA256 17cfa8de5746d2ef6df83641942d3d8b25614ede495c0690c88c1efaaa676317
MD5 3ce845f8b6dbaf22fc5ac1b67cd2cd6b
SHA1 d2c21daa9281ea6d6ff289d70ed1d83330b746a5
SHA512 3c5bb69cc8b6289d0268352e82837ed05010e86095d80fdd7085c9a95dd84141030fc10b6f819de59500ff49c1049f4c6302164e07593661cda025874cb6735a
SSDEEP 3072:+GnFSOEfDhBV4UP7cd7u/MGVP5hQRTNmlNvZXlUqur7AjSOuNe2e:1FS5fHpPM7lshqTqvxlUQjwe2e
TLSH
T14E0422640C6605038EBA03353FC9C7995A552AF24B78C7B2518FD7EA76F7EE0B0A8512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 1.4MB
SHA256 13a04eec77d528b864d812c4ed28ab71d4e55e800edf5fc03b20986457543433
MD5 e778c03c81ef31768bccff2888632ab0
SHA1 b6b03abc094b2739e907f393e558865f5ee7c566
SHA512 9e8612cc9e2be7847b4c87579ad33701fc7430668954e24c6d96aa967ecd77c6e9033a6cfcad331b2b270df23593da6a9981d053e272f512a0de5bc2194b0e3f
SSDEEP 24576:zhBybqPMFihNVLWkIhXooGHfzr5iKB15GzueBbWo1xMBbamvDzJVykJyb4l/ms2g:zvfhNVlIhmH/5PB7erBbWQe8m/ucR9
TLSH
T1626533F32F6E17E5CB1F8E75A682C50D4872A592F94E0C2AE6E233754F56E015CB1E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000042
Size 124KB
SHA256 2fb723932c4794ef42529c8e0554c5a454b7319dfb70bc677ee77eee4f04ff92
MD5 871c48cb15926945f2094f782cd17f94
SHA1 3b08610c5c0045e412903f8469f6b68c29badd75
SHA512 46280127e2b1693f9e60b531d138beb339a5cbfe9da316e82cdd45eee77e147da68e2dc8a9a79c97bde292af2d4330c6df27b3aba2c36eb3f2bb45119b3bb545
SSDEEP 3072:AUKwQuCpG+kEKuQZD8jl85UfnhDwXU/ZhmaUIfmPS1eWz:ADtM+kEIuAUwaUIO6cI
TLSH
T13BC312366E583B6463DC27DB35B210C7F56F2E399E888483D571049D07EC6EEE460167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000047

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047
Size 72KB
SHA256 a74df225e0467ec4dae0cb7a58514bda07a1756a7ff0221371620e7d3b7871bd
MD5 d595da676a8917738e8ae3fe52764a11
SHA1 fececeb4789e010914628d195c26d681da25c2b5
SHA512 091690dbb2fb8b3dc0d638a75a6ce91d2efb769b3cbc2440e49bf0401fa314b1aae49e92403e1081322f58815f5c938ae82510f5a704e9d3c6007d2ca63b1c8e
SSDEEP 1536:EemmgIhLWa+gnWfc+CrPmf82G5GDft380obDxoVel04jLkWR:EemvUdHrrPmU2rF3SXlyWR
TLSH
T1B37312B2E3009F6EAE0DCF6D048D76A7A1E97F0171A142FD4847D39E9D03F50A641BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000048
Size 79KB
SHA256 731dd69375ab8948467eaca8b89d9de74bb0efdc17c226409a80e809fc524db9
MD5 cf32a29e8292bf82a7f7e76a15ad811a
SHA1 30ed0e9e94a475af658ad6b64381a55cd5fc64c4
SHA512 53b2385eba4a264ea615c77e299e311b11638439a09804145ad19140e161f30449c503af98bd6e5cddbfb6eb805a0a506db0d083a514c33064bde48b8215eb35
SSDEEP 1536:MMcbYZtblWiosC9cktr6RDrgubTWnIttWJUlOVuRaHcLOYtJHAjC57iNu:Q4ZWZhuVJi4WJH63ttAOFiA
TLSH
T14983026E07BED7AF75803BB7323BF16F9320D066947D664B14AEE121A3D4604E69DC20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000049
Size 426KB
SHA256 5093a8956cc918fbe1d907c9c95d1a0e72d185b00c5dc7ebd82ad6243289df86
MD5 37a902d6e2404356cf273c149fff7278
SHA1 897c001ded2757d68030f61514b87b602af49b26
SHA512 0f1035b049a5226e27532d9453c0fabc868f6edc43ea4430629ee4165271a176084ae14c3b37d6fbd87131368d573bbbf43055a65a0810967c6dcab2ebef04c5
SSDEEP 12288:3dkL88IGPgwy8INa/40WNuL5M98OfFDS3mhDg/fJB75bNF:3G7IG4QQWYcK98+lSs0fP/F
TLSH
T1049423E34360603B2D11D0379162AB0BA1BBB7C2727648CF25A9999EF59437C70AD4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 a2a1b1defac86818f0b2836cdc355c6a955dba52e7ad02f27d6a0173512e1d86
MD5 7c29f49a756e6515f001869fd879288c
SHA1 e0da643b9dc8d5c8828d27c7ead5ef42e6c66035
SHA512 5cd8c958fa9aadad52045c6343979edc58887eba421c5d4bad00672e47029c5515a85eeaa3c770c322fe92578b45b463920fca1c7a914f5024777512bd317b47
TLSH
T1DD410E04A6C26141CF18AE759B85CF746035B8F5B3F64FBA7E457860F883EE0E9A5432
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 737bc619bda6b95a04d7c5eb16b1314854e7ce760a8a5c158571e43d4e597e21
MD5 759774c41ff82cee6d1451e01ac490db
SHA1 c143b69973634584b1e8bcb0cde656b26e62746f
SHA512 eb51360957b0fc299dc1746fea8bbc2d37bef5cd617f7324dd55ff2b5049de89317b1ca5529c3c799877d4983b98e7099e41fb4444644f947ad11da61953a35d
TLSH
T17C51590475835241CF04AE759F86CB746035B9E5BBE24FBA7D44BD61F4C3AE0EA64432
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 7725d64794a207ecbd357ad09a09d22fee3e46d9b2172fa1a78ad30f6af2ebf4
MD5 f44d54bee52636dcffea1064f72d38a1
SHA1 b0a502eaff44320ea90779922d9e292e9c79bc26
SHA512 2c42466de19f9ee5c3098ea8f662871616b32c2e7b862056dec8b0d257ada0472749d35da2cee8c4621e87f5755ba06cc7812613abcfa1be9c697a3168174d04
TLSH
T16921271895C26252CF14AD399585CFB4643979E6F6E24BB7BD513C70F483ED08D35061
MD5 SHA1 SHA512 TLSH

Submit Download

151900e6-dabf-43f4-a971-55af3e257887.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\151900e6-dabf-43f4-a971-55af3e257887.tmp
Size 15KB
SHA256 cdc2d1195b71a0051b111252cd316c3f9574edaea538cea631410d741e2cb72b
MD5 6b10c7e0fba1a86e21c385e1871597d6
SHA1 f00ec295bf0d54e54983e26758fd84f788e78d1a
SHA512 9438b094c64de55c08a92753f3548fcf3fe964f8d076b4e8ed8a015a6479fae537b8086b276c93c148e90c877087f7a3aed2442845126310a39baa43db117053
SSDEEP 384:Dkx5jKwmgtnMLJaIPiq/Sp/y1i/50ofQoItqlcfoVqZAullLG6FH66SujnpEhVBj:pkxe0dMAMm
TLSH
T188628CFBC3E8862EC91166F89B156F1FCE5D1914831C3D2AC9D5AE0BA3E2471E24074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c31da05-f87e-4017-a5da-e7d0fa6d16dd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3c31da05-f87e-4017-a5da-e7d0fa6d16dd.tmp
Size 18KB
SHA256 9398876621f41600dec0443f7ae40d9a2a0c9ae460ad832462776671936b3cc1
MD5 c8c0aafc7a375e66c96563fe75698631
SHA1 a9425c9ad21bef5e879adc31c3cec7b38df61793
SHA512 5d27960616440455a8f7ee19ca43a9bf39bf1a6e4557e9d11329fc63bc53c1d3c374d4231b07c9607a666e0b7161068c0a419795deb696ff7fa838d3f1038849
SSDEEP 384:Dkx5jKwmgtnMLBkoFyJ4J0QvqFkaIPiq/Sp/y1i/50ofQoItqlcfoVqZAullLG6v:MatkWEir7o8TR
TLSH
T1DF828BFBC3E8862DC91166F49B156F1ECE5D1924832C3D2AC8D5AF1BA3E2471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

998e2c27-2620-4bf1-ab37-562e8314fa1a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\998e2c27-2620-4bf1-ab37-562e8314fa1a.tmp
Size 16KB
SHA256 d3f13b12769e3af03f1ce6dda8b56b053930d44ccf5d7b32fc763a15398695d7
MD5 84802d4fd4295ac938a3eedb6765aeda
SHA1 6a46c67f9086e21df170b176b2aba0085fb2466c
SHA512 6757e932b69c23cf874127d34a430c4e45c3c7366a2efd5c59c6d1d9519394e2152977c02af51e1ef83cf2111cefc988366960ced616c8abe42c53816237551e
SSDEEP 384:Dkx5jKwmgtnMLBkoFyJ4RaIPiq/Sp/y1i/50ofQoItqlcfoVqZAullLG6u66Sujh:MaLklr0d0Ekx
TLSH
T130728BFBC3E8862DC91166F89B156F1FCE5D1914831C3D2AC9D5AE0BA3E2471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf49e64f-4308-4ad6-962d-3473e70e0026.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bf49e64f-4308-4ad6-962d-3473e70e0026.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f1f6e726-85b7-4f0a-9bf3-3c1735475684.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f1f6e726-85b7-4f0a-9bf3-3c1735475684.tmp
Size 2KB
SHA256 7716675496c359496f5697c04951095672ed30c39d8617f9c367bec112aa6d3c
MD5 3b2c1d7f435157abdd454f80ee54671c
SHA1 a9c770f5abc5271aed255b688818fd98a58eaae5
SHA512 12e13aac6b30716b1ef3ccd72e810ac4fbb4d992af4c64a7573e173e843eaff4703af4e6452c4e71ddf8743efeb1e84cbaf42b014ef204c23a4ca73c3d33c509
TLSH
T13C4167A7C1BFB83B403A49BB0D09FD461A7AA83502817CF9DE97826CB1C44F34A53526
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 4d060054747872e48e00c93840e13fa9df88edd4fdf5beb1a883813355eeefd1
MD5 a24bc333f44f929c15a276ade4704a77
SHA1 058b03f5f0d31f6c0f4706c1d751921d9d93a246
SHA512 855023d593aa105dd3166a3f73e8748d86f0f31d3ee8b68c802825ecda8951731409187234b26162bc243a59995fd274fe9422ec16331ae29af6ed62f0351e4b
TLSH
T1FAB0121480C26B42C07302B01150149C35949F21A746134155F01E01C8363A1A01B295
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 ee1406c46e95890b4cd79f9581bc0fd08b6c5a85ebd76f7b24520666a295ed84
MD5 e9ea7bd228a519ed3bbcf4371c9ea0fc
SHA1 f54455712b1fe64fb60c1a2b8308fccf019e303a
SHA512 c3c614e632c453bb833b2fcb82fd5200a87b602fb553a91fa0cf0ad7c58bee11fc3e0025bc9871360b5662c3d8b3c62262c2e9d686d7cb1d1376bf6e05386817
TLSH
T1B4B02288C0022202C08203BA2280A3C83038CF30CA0323028EF00A22CC2223000A0230
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 959ff0384475cd45ce0f13f487e4da78cf4b193a8d0c644c198e372e1274e5fb
MD5 546d499f01f34e188f3801ee94c1f270
SHA1 e91a5f96b9e422941ab65b8e8adfa75e7e049e8a
SHA512 81a816e7689462e6cdf1399f5b86a2b898a8ff78ea42748a6ba081c40f99a76048babb547a91e16b23095921a521db9aff015c91fe51ebff53a08a763a97fabe
TLSH
T1BAB022A82000282BC300A3F033C830E033233FBC33838ABF08A000A0C823A82CB20B08
MD5 SHA1 SHA512 TLSH

Submit Download

bd3671ec-15d2-427d-9109-692777637d88.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bd3671ec-15d2-427d-9109-692777637d88.tmp
Size 13KB
SHA256 f7dadbdc77080c6a6a50b3216133df6571da2b28477b3d2b49ab690d0274edae
MD5 b2fde5e6d4d7b99add3f8f2260942f82
SHA1 a4e4f57a168fd30417551aa8dc8d92b6835889a9
SHA512 032267c4b29edf2ede6483b2cf1871ecf354ab275c39855e79b96a0896b4021b5a84b4a90486e8269d038f1f01514e278fc6cd73425c3217bd738ecab04ae863
SSDEEP 192:VRE9ZYHc1tv7MpAPRp2EeMwIT9tHsb+WN74DuXdvs21G2gFVqVyIsnAUge:VRE9qwNwUX7vwrq242gye
TLSH
T1BC52B52EAD60397B9CDAC32AF9A57757D7F5202170942E84EBFC882C29E76CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cde9508a-7472-4edd-9317-8fa07333319b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cde9508a-7472-4edd-9317-8fa07333319b.tmp
Size 15KB
SHA256 99702066a942ac7100bfc1e6e32822a1ec704e026c8ed809a759f05d5c234d89
MD5 81420b3747e9dd10b8f21f71d4df9bc4
SHA1 259872ff40b549186ad49cf3d96a32be4a8fd4c5
SHA512 bce39a23cfab764225ac72017c4a22edbc8d9c9bf5b4e622814e23600f81d440e94a6fe7a56eae81cb0a6aa57e509ea7ae624243d48ff90812d3089898975da0
SSDEEP 192:/RUcBzNZYHcytv7MpWPRpyG3LzXF/R0yS7CI19tHsb+WNsEf8FdHvM45WSO9ejGt:/RUmzNq1NwmXgvwb/FeC2gIE
TLSH
T1F272A45EA9602A7B9CE6C329F895B757E3F52021B4D41D84ABFCC92C29DBACD3113407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2acba52-a257-415f-888e-ea84aa63aab8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d2acba52-a257-415f-888e-ea84aa63aab8.tmp
Size 14KB
SHA256 2b717c5c915ccb86a4fe05a829a08407f7ac38f423f897010f192302302322ea
MD5 d726413e9a70b737f35f6cff2460f0fa
SHA1 08dfd1de5056d0bdca4dfd0516958622c11a1128
SHA512 95aeb195f7453d19000fde43b86fbf9c009a9ef2265249f368559146777c8618d11c7f5f7e97557baad7a39c1383c34c7b0b1432e4693e9f0e35d159ecfd7754
SSDEEP 192:VRENZYHc1tv7MpAPRp2G3LzSr0yS7CI19tHsb+WNsEf8FUuXdO9eSG2gFVyVyIsv:VRENqwNwUXlvw0Cep2gaE
TLSH
T17062936EAD60297B9CE6D329F895B757E3F5202170D41E80ABFCC92C25DB6CD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3cf3a39-249b-4877-8498-ef3ae13d87ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d3cf3a39-249b-4877-8498-ef3ae13d87ce.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dd4d9abc-06f5-46ef-b789-40bc3c121ccf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dd4d9abc-06f5-46ef-b789-40bc3c121ccf.tmp
Size 414B
SHA256 37acb340cfc10257d8f704840e1dd743feb947c189e40261a95e45ebbb4ec781
MD5 12eac2fd49d02a7c42213390b288b715
SHA1 3aa6a5f9112e9192a39746f72cf58bbe8d7b5b8c
SHA512 0b5ddc1e2d5a7e984241380decf35e0fb11789ec3339509f4eb83fee452ad9eb82cf61047d6de571e03f62ac6f8093babf3c13a4ce8e5f36a553e5cbfac1eef9
TLSH
T156E09BFEC921EC3719FA07586054574BE75113576A41494F363CD10C8FB1A77459586C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 3054285293e7bf01351f9b95c48b8b4db9eb12b718254de2d1d789868d2d8d75
MD5 43fadd4530e9534998e01335670c6337
SHA1 87239f50fbf03fc00f5459e79237a6ee585b68c3
SHA512 863937e6baa0b0be30917540c0d426da95aa6f927035a1b6c93b3a354e494c5aae70b46ca28b8ca944f90feed790659869dc0a3c04f53620ef6358512cbab5c6
SSDEEP 3:MsEllllkEthXllkl2zEglt+t:/M/xT02zjwt
TLSH
T1EC440414FFC15505C5001030C531C3F01770D75D055557473C5555135CCF5D00C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc02a7df-67ea-42c1-b0ce-9bea309155b6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cc02a7df-67ea-42c1-b0ce-9bea309155b6.tmp
Size 132KB
SHA256 b0484bdd705a569410739d886e4e67d2be6eb13c926d21127d2377ef6e9d7ca2
MD5 840c619d5bae22f19222d9cb5f8ead24
SHA1 5163a7ec80ebe0754aa5ac6934fb03407181f170
SHA512 9760661e06ba0eab02bddd16833a26e1cc3d16688c734b88b2e881b6913cd9c5374a01d72dd5ea113df8e6e1339f764e6ead6b2835b93dec38e7b9d383efcc97
SSDEEP 3072:IvxIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:IvdPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T1EAD312217D05BCB8A9EEDB21A1801E16D6B8C90B953D7BE55CDE3F8805A36DDC304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf9eeeea-8928-4a7b-8a13-d1052ba73cea.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cf9eeeea-8928-4a7b-8a13-d1052ba73cea.tmp
Size 132KB
SHA256 50db050b27594af58ce322eb9e88ecbbf40c02808f018e0f25d5cd26d2eed0be
MD5 de07af6af829c72e954be669a7d7fc64
SHA1 5adc2e1fb9defc2d8f45882472b50fee1cf4abc6
SHA512 5147da69c400bd5fd3e3e9fa62bab082135712d55d5ebab11663408b4e8e84db32c5c088d46a755ec984589f980c94a0782628a121dc91953137bca89eafe9c4
SSDEEP 3072:IC9IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:IC5Ptbmf1K49XLWbEPi4NTKlLzh
TLSH
T1FAD312217D05BCB8A9EEDB21A1801E16D6B8C94B953D3BE55CDE3F8806A36DDC304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 180aa62d8fece3df7c693d2ddf2b6c0dffeff769602132e0a12eae3d9c1afede
MD5 b20d5e053b356e88143f72f5881f1981
SHA1 dfe190c55d8b8363fc8b3361c46a8a39e2ffbfcf
SHA512 d9ce3c23c9854857f13cd5886d6f8ce0a966c841f94ed7143e5cf7116cea43cb9031102208cb15dde60f623cd737fce5dd31adb027f541bdc5a3c2c3808fdd5d
SSDEEP 96:QijUpGx7gaPylvIpietMu/UGIOB+OwffdxrUBj29awJq8Pn+20vE3RoL:QnpGhBPylvIBMuDendxgBSpJq2V0vooL
TLSH
T1AED2C856B809E646DE092C329FEBE6EC62317D26DC6B030378C4B77F4ABB4C44D08595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yubx-ui.exe

Path C:\Users\Admin\AppData\Local\Temp\7zOCB6B8CBC\yubx-ui.exe
Size 27.1MB
SHA256 bd3b4922a790b58e01a0a7709f231167e4e30901e9bdc8494f1ad794390aa3f8
MD5 39493d2570baa47b94f0a53e3fc19d24
SHA1 cacc1df568920ac0d260cbd9590cb6326b3bc18f
SHA512 5f01ea2dcfc887e857135a7ebebd4d871be16d16be559f5f7142ccdac4eb8e8a95edb4ea0c13ee1bff7849193361eff1de1cbb9015bbe14ef27b47df4270dcf3
SSDEEP 393216:A97dyNBIFlzfWqxLq191pligO4BRdRzjyjhPTM6jP81GpVE2pX/rAw9c2Tuop:AlSB4VFxL+li6RPyjlxXjE2X/rAw9Fv
TLSH
T1D35723812AE5866EC4D1EA3AE58D10EAE4C938F9CCBE971FBF8644123974C58CCF5474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08babc70-2323-4309-88ab-6902d46bb334.tmp

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\08babc70-2323-4309-88ab-6902d46bb334.tmp
Size 4KB
SHA256 accbed34bc3806175b027e36d4ad1650ca18015dbf57189ffd61e23dcd2f57f1
MD5 b5cda7077b6a2b277f0cb95303083169
SHA1 28e3b65c8bb3fe8bf3bdc99176ff856c2857973c
SHA512 2ea7c55d69dd5fa42d4b4aa12c7c40b6495404e6c66b4912d163318803f9c5a29047933cd044767f97bf14b2742fc86dc5e509086723feec463133440fa5d6c3
SSDEEP 96:zud1NkCb1Mf6L4zc8Frh/cInURoDoto+5UGPDlBZZ+60cSZcRTNlqa:z21Nb1LyooDUhDrbZZVtt
TLSH
T1619174226570AA375EF2E945B9863F17B6A19027E4983F98D6EC0F0C06DB6CD2342D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14a7885f-273d-4efc-b144-75490ffe84fd.tmp

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\14a7885f-273d-4efc-b144-75490ffe84fd.tmp
Size 3KB
SHA256 470cbfaabbd16d75f0653907ef9a831b8f42deab639ae4bb94cc8e51ab610147
MD5 851da717eaeb141bf729e7f7146f5017
SHA1 c66f6f140a4e203d4e5001ca5536eb2cd9bab213
SHA512 979d908f9651f37cb3c3ae3f1de0c8fad79a8e4c8915a98d87513eb42298989bdaeaeec485f35c335ed95b16a7d0fbbd0278613b66c560016c89789b8cc93f3a
TLSH
T1207185736A64A6375EF29A41F9C62B17B6A18027E5943F98D5EC0F0C01DB7CC2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

34cdc7e4-ae27-42be-b667-be811df9120a.tmp

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\34cdc7e4-ae27-42be-b667-be811df9120a.tmp
Size 1KB
SHA256 15e351a8e5af3fa06abb27f609d36e15fb2831b1735034cd87a62392df03bd5d
MD5 bdf1e1f6570ccc2ba960ba2b668806b8
SHA1 1c485373f444294b2800800e32399c75e469b2c4
SHA512 f40afa74d96794b8957c2d0ab73e28d956131183678d19ddef45739f8be77efaf7c29a8c41ce730b02e44899e918687058b4eab071846e56227e2048bede6f17
TLSH
T11A3187B3A6917B337DA19581F292BE5B6E704026D1145E4CB1ED0B0906DB6CCA627C36
MD5 SHA1 SHA512 TLSH

Submit Download

3eddb636-3850-407b-acf7-5d68a6423de9.tmp

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\3eddb636-3850-407b-acf7-5d68a6423de9.tmp
Size 16KB
SHA256 c480cb33441c159f5d927f3fa265a35557a773c41a453081cc3cf2eff4f963b0
MD5 c0a703e968ef086b1a86cbf4b5f87d3d
SHA1 baaebc6dc321a3bd9eb3e29e598958b0e8d47da6
SHA512 47773d8ef050b41eb5fb882783077d467e031a5eae8b3ec37be24a04beceabb67607104cdebed325cdd7b65283fd06b7fa922b9172965120379c8e0f78c4b657
SSDEEP 384:zm+OBqImmJvGBLx3NaFMJFbNbikPJcHj/Tg6rt:fcvGtlNJPCHj/5J
TLSH
T152729C6B29652A333CF7C946BA896B47D6609153C0E97FD9E8EC8F0E056F1881342E01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f29dfe8-7e09-418a-a81c-c56ca56f7a96.tmp

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\9f29dfe8-7e09-418a-a81c-c56ca56f7a96.tmp
Size 2KB
SHA256 c308372425fb90d3d9580f9ef6cde8d17ef22fcc73063ebcd66f03347912da07
MD5 ab1380d632fd5c9ff3e2e7fb69615bb8
SHA1 8938d6219fc14bad3f89f8a10874e9f520d0b1be
SHA512 bb54011cb94270b3ad5d6e25f4ec7b84345dd02aea188d7a1edd6a90b305a6132f631c4209ee71b011ea9a35c7b7ab22b61c428629da3ab76a61b07c56f6ba3a
TLSH
T12051A7736940B7375AF29A44F99A7F23AA358065E6552F54A5ED0F0C01DB6DC2303C27
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7cde70cf823f19579cae91a3a52a4be99dcc7f826bb530ae4a491821ec1fea6a
MD5 a8eb6fe71bc8e82b7dcd3a8dafe49d8a
SHA1 759717870b11358ec9a3b2c3bb78a98e0e22c8ce
SHA512 f0e0bdbb6655d6c221258714e229d5a0f42bf33a05c1fedb2a49e8dc46fd5ccd97cfadac1e83836b9400a77d1d2b59bfd9a630697468c0716b0c11192dee726f
TLSH
T108D0121372238534C01034330103714C0440D50B81095002947DE52D5A041A50912441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 303816ea59a850401687a4c540a18ab09d993fc5712a2bd69d6887ce9c4211e0
MD5 1cf1e51868dc68d87fd2ebd089cf6db8
SHA1 5782036941e205dea487e95de88bc350b18b1c0d
SHA512 cc99c44e24d63dc15e0008653623eb9e8ab2849a2e4f6ee4d6daef1e9e66d84fe19a102b4c33fce951c9e3f2baf4049dcb28b8bc7fd4fa20494f18a79c9a3758
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0d66c674-9dda-4ee7-a9cf-081928bb4322.tmp

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Default\0d66c674-9dda-4ee7-a9cf-081928bb4322.tmp
Size 6KB
SHA256 6fd671c3fcf9535fda3039c451f781ea94382e0c329d7bd9f4a3d961ae4aff70
MD5 dac0ee728397c53c0f8f4b9feace930f
SHA1 ce7b42939b17ba76e51460395b87ad88c78caef8
SHA512 225b427c94c1a8328fbf5df0085fad86abbef65aa90da42710be234fea2e51ccd08abc2074e61352ff6e9756a4614dd2e7b3659c523898b699b882ceb145f1b2
SSDEEP 192:stw0XLefoyZ8pazio/S+WiTToodvutcjM8:stpXLeQV4x/VAoUeg8
TLSH
T173D198425F68797B4CC7E619BA75FB12E2FA502261D40D58FBFC861C08E66CD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 c119f1b3454c6e2ef2dbeb0d9c4627c118ce103a17bb6bd44ad480b5790aea92
MD5 bbcee239ad1bbb819bf96b121c49103b
SHA1 f740dbbea1f8c11cc481152028c152a267e73ec0
SHA512 b0d17c25cced241c3037f5627545cbcdac77590b458d980a61a9b5a09a1efb4735c3fedf54af4d3685de9854b5ce551d27f0453d5f17af04077f5f00362795ec
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Default\Preferences
Size 6KB
SHA256 5719244b42820482343a2916e7c835c14b31dbdbc91791489971660645261749
MD5 f3e576cc95906451ffd54ad2f67e41f4
SHA1 6a8c316b60fbc797c6d77604436ea91ed7eb1c9c
SHA512 f5e092c45b4d664bb85cdcff4cab18c9573f123c0d49fda95995eaea029afcb0b4b03cd7f30e8df3dd7de79498f9b8d0548da5eb017550ba28c222a5d10daf9d
SSDEEP 192:stw0XLefoSZ8pFzio/S+WiTQ3wdvRtcjM8:stpXLeQ11x/V0w3eg8
TLSH
T1A9D1B9425F68797B4CC7E20DB975BB12E2FA502261D40D58FBFC862C08E66CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.YUB-X.ui\EBWebView\Local State
Size 1KB
SHA256 a07e75735ec5205e73d60d38f60b655a1df0921a456d0a82bb58050bf27c47d8
MD5 efdb7b89b11fc0315de523f14b0413f3
SHA1 5d14b324dcf19d56b390cd3979484d5277ae63e9
SHA512 112b255a58d64a05a053c3dc8fe30aea4a621e010ddedd951c2e7b61b260f1c818fc04b235bfad9a253f4164e6e172fbe91fead6dfcf0ee17d8f36121d359323
TLSH
T1952165B3D6917B377EA19981F252BB4B2E60802AD1146F0CE1ED07090ADB5DCA227C32
MD5 SHA1 SHA512 TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 8fd8170ba104976d91c2d4b2267932b0c117faed5cdfed785f616efd896b64cd
MD5 765ef7b59afc12ca1bb7e52a28682d22
SHA1 5c29df40020d48689a0a4954a54ac3783650aafd
SHA512 e74cff8b817aecdbf538fb2b9bfff53c158998b47239a86619d648a19a8ea2b34676d4f218dc49bedd25d1e7f4ede27b91ff2b7bc2d43d27169b8dfe4030dc4d
SSDEEP 96:FgskOVONcFTwNTNlj3XQPiXFiiCNJ7NNngHNrC:FDnACeTNljHJ1CNJ7NlqNe
TLSH
T1D102CF0037FA6952F2F79E32A9F637425F7BF8125A048D1E51C042094D62E115EA9F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N83X0C1KG190MCXSFPRR.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N83X0C1KG190MCXSFPRR.temp
Size 10KB
SHA256 adf9881cf49290dfd70cb3c8ae0a791926b88aaccdebd269c0c64520c28d25ff
MD5 2d97bf6a7c20068b87a16ba944212718
SHA1 fd168e73a2f5e9081421ab469cc6f23b652fc36a
SHA512 8db011b94d1eac8aeeaa551388ef830e66bfbfaa5ae5bc86a998bccd51d6c160bd0d968e2dcd2e3422edb7d3f939ed75ab316e8882946c99bc96bb655262cfec
SSDEEP 96:WbtFFkNXf9F7UNU3XQOzCsFTZODN37NNdgHNrC:WiNXINUHbxQN37NrqNe
TLSH
T1462200002BFA6952F2F74E76A9F637415F7FF8129B048E1E52D082094D62E109DA8F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QVK6F7J7BYTLDVG59FQB.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QVK6F7J7BYTLDVG59FQB.temp
Size 10KB
SHA256 eb9a500853711f27dbdf75f33d7caa8ad6115ffaa60d1b57242d34cfacf81a24
MD5 8d3500160acb93082a8a98292d9f7a36
SHA1 fad2f1fb94024d71e89e3aac743fc85910882e2e
SHA512 f3ccfca0bec59ca466c765a10b0ea42135cd1fd9038b8ca2a1a1aaabd8fd40d395f5a215c32fc06d0b8590b9d4f4c07f8fe4c6a8f804e5ad6702e3e90e33f7a5
SSDEEP 96:H3XQOzCsFTZODNlgskOVONcFTwNTNls3XQPiXFiiCNq7NNcgHNrC:HHbxQNlDnACeTNlsHJ1CNq7NSqNe
TLSH
T12832EF0036FA7953F2F79E36A9F637415F7BB8125A048D4E52D042094D62F009EA9F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UBM2UJXHSWGGF0W0QWER.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UBM2UJXHSWGGF0W0QWER.temp
Size 10KB
SHA256 2baacc64e2ad831ea4dae8b9703c7026a76362f2fe7bbc5a51f5f8e834162c40
MD5 af7dc159dff3b1e07a66b862166c27db
SHA1 cfd4b940ee3d07ad7800ae4b0c5e28be556b6d18
SHA512 54e33efe81e517e9b67630be97f5007adace2fc0af22ed19065b695afc0b71a3f580c631b0d164d828ecc96eef403493d5ffc278313ac25a4235bb4d379b46ef
SSDEEP 96:Vf9F7UNr3XQOzCsFTZODNLgskOVONcFTwNTNld7NNugHNrC:VINrHbxQNLDnACeTNld7NsqNe
TLSH
T13432EE003BFA6952F2F75E36A9F637415F7FF8125A148D1E129082094E62E109EA9F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a609d87-3f2b-4b6f-8600-f477ea7dfd8e.tmp

Path C:\Users\Admin\Downloads\2a609d87-3f2b-4b6f-8600-f477ea7dfd8e.tmp
Size 15KB
SHA256 68305fc89df1ab39a4e23d66ea81fd218fa262fa1b6bf70563c4558157254019
MD5 637c95c730842853f8ef1d98ff9b963e
SHA1 88f2b03e169ad9685dc736498da13910795bd1f9
SHA512 c8af7f2d0de074ced3eedb8f9039275f2bc064366379bc09992406c10ab2a238dc7d75331360587849f38e6ae45e2496aa7fb98e557312cc8b0341a103812bd2
SSDEEP 384:5XUo7DVp1i8EWOCyd+nGN6QH5LcSXIhCv0:5XUoT1i8EQn7C5wS4hd
TLSH
T14262E626E7A591F9C826C2B5CBBA9313FBB2700C95B04E5F2C95CD626F573111A2DB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3040b9cf-9983-46c1-92a4-38bb83af0950.tmp

Path C:\Users\Admin\Downloads\3040b9cf-9983-46c1-92a4-38bb83af0950.tmp
Size 23.8MB
SHA256 5f0f921c63bbefd80e94cc071e7c2a7741df543c18216701b3028d71528283fc
MD5 e25600829467f2c7d4986b599e6fc0bd
SHA1 5ed267c3791e972de0e714ba719d53014d319870
SHA512 8f4728ea9841d2a06d67256d5c039c91b0ee771a4725001a7a0dfc4441b37fc4fe884c03376cf6c7889afe3401f4013f4ccd38298221c55a0a639d5ae4f28a5e
SSDEEP 393216:bVeAafVHIQwIMFkC8gyM2DhY+gOitAZXT4LsxA9ouYJdwO4091dNqItmbwQgR04:ZLafVHe8gyM2DCSnXELsG9NYo0ZQLEd
TLSH
T19447330941379D97E6B89CA189E7C70E2F168D356F1B30DD18B2EB153C28AB1DB79213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z2604-x64.exe

Path C:\Users\Admin\Downloads\7z2604-x64.exe
Size 1.6MB
SHA256 d54bf805f9f3704d1e8db2fa3498ae7ef2df0312b40b558e7c71c734430a665d
MD5 5c9e2859bda0197a07ec1cdbc80a894c
SHA1 3ff943f82e32047c57feb03fe8315c63a446e4a2
SHA512 ffcc354499e4121735cd4e1bb08725b01cfea758eef2d8681e4782abb53d27cd3f33bbb06de08d4f77f52e2516a9aeefe6c3d3605b8258a65a2405ea49f29b03
SSDEEP 24576:V0YvFzvSOK7k8aSRLSrFi5CUYWtuQF2wELpJBEm96Kt0Vfb/kNtKKNH+9Ny/efv:V0CFr5Ce9rY7YGuQENyhotlNH+9Ny/C
TLSH
T198753360EAB8CCB5E0B3D732CCB683B2CB7578A562654DD7A940A6553D823207FED710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-1172-0x000001FABB790000-0x000001FABB791000-memory.dmp

Download

memory/684-1184-0x000001FABD740000-0x000001FABD742000-memory.dmp

Download

memory/684-1182-0x000001FABBFE0000-0x000001FABBFE8000-memory.dmp

Download

memory/684-1181-0x000001FABBFF0000-0x000001FABBFF4000-memory.dmp

Download

memory/684-1179-0x000001FABB7A0000-0x000001FABB7A4000-memory.dmp

Download

memory/684-1178-0x000001FABBFE0000-0x000001FABBFE2000-memory.dmp

Download

memory/684-1176-0x000001FABB7B0000-0x000001FABB7B2000-memory.dmp

Download

memory/684-1174-0x000001FABB790000-0x000001FABB796000-memory.dmp

Download

memory/684-1173-0x000001FABB7A0000-0x000001FABB7A3000-memory.dmp

Download

memory/684-1013-0x00007FFA53640000-0x00007FFA53641000-memory.dmp

Download

memory/684-1187-0x000001FABBFF0000-0x000001FABBFF4000-memory.dmp

Download

memory/684-1186-0x000001FABD750000-0x000001FABD752000-memory.dmp

Download

memory/1800-991-0x00007FF651680000-0x00007FF655684000-memory.dmp

Download

memory/1800-990-0x00007FFA54490000-0x00007FFA54492000-memory.dmp

Download

memory/2368-1124-0x00007FFA54100000-0x00007FFA54101000-memory.dmp

Download

memory/2368-1125-0x00007FFA53790000-0x00007FFA53791000-memory.dmp

Download

memory/4032-1126-0x00007FFA53640000-0x00007FFA53641000-memory.dmp

Download