xworm | hxxps://mega[.]nz/folder/blYnzALD#_56pA06zNhwSlK_Q9perNg

Analysis

user interaction
yes
max time kernel
109s
max time network
96s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/folder/blYnzALD#_56pA06zNhwSlK_Q9perNg
Sample261024-2hapkasv6p

Score

10^/10

discovery execution xworm persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

Mutex

3RhtQHzgVn5g0JFd

Attributes

Install_directory
%AppData%
install_file
Worsetest.exe
localhost
127.0.0.1

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2220-1547-0x0000000000A90000-0x0000000000AA4000-memory.dmp	family_xworm

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
50	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfTMP.dat	lodctr.exe
File created	C:\Windows\system32\perfTMP.dat	lodctr.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2180	cmd.exe
5368	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4588	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
4888	chrome.exe
4888	chrome.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe
Token: SeShutdownPrivilege	4888	chrome.exe
Token: SeCreatePagefilePrivilege	4888	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2428	taskmgr.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4864	4888	chrome.exe	89
PID 4888 wrote to memory of 3352	4888	chrome.exe	90
PID 4888 wrote to memory of 3352	4888	chrome.exe	90
PID 4888 wrote to memory of 4588	4888	chrome.exe	91
PID 4888 wrote to memory of 5132	4888	chrome.exe	92
PID 4888 wrote to memory of 5132	4888	chrome.exe	92
PID 4888 wrote to memory of 2060	4888	chrome.exe	94
PID 4888 wrote to memory of 2060	4888	chrome.exe	94
PID 4888 wrote to memory of 2332	4888	chrome.exe	95
PID 4888 wrote to memory of 2332	4888	chrome.exe	95
PID 4888 wrote to memory of 3076	4888	chrome.exe	96
PID 4888 wrote to memory of 5772	4888	chrome.exe	98
PID 4888 wrote to memory of 2440	4888	chrome.exe	99
PID 4888 wrote to memory of 5772	4888	chrome.exe	98
PID 4888 wrote to memory of 2440	4888	chrome.exe	99
PID 4888 wrote to memory of 1992	4888	chrome.exe	102
PID 4888 wrote to memory of 1992	4888	chrome.exe	102
PID 4888 wrote to memory of 2124	4888	chrome.exe	103
PID 4888 wrote to memory of 2124	4888	chrome.exe	103
PID 4888 wrote to memory of 4232	4888	chrome.exe	104
PID 4888 wrote to memory of 2384	4888	chrome.exe	105
PID 4888 wrote to memory of 4232	4888	chrome.exe	104
PID 4888 wrote to memory of 2384	4888	chrome.exe	105
PID 4888 wrote to memory of 2808	4888	chrome.exe	106
PID 4888 wrote to memory of 3432	4888	chrome.exe	107
PID 4888 wrote to memory of 2808	4888	chrome.exe	106
PID 4888 wrote to memory of 3432	4888	chrome.exe	107
PID 4888 wrote to memory of 1536	4888	chrome.exe	108
PID 4888 wrote to memory of 1536	4888	chrome.exe	108
PID 4888 wrote to memory of 1544	4888	chrome.exe	110
PID 4888 wrote to memory of 3440	4888	chrome.exe	111
PID 4888 wrote to memory of 2684	4888	chrome.exe	112
PID 4888 wrote to memory of 4824	4888	chrome.exe	113
PID 4888 wrote to memory of 4824	4888	chrome.exe	113
PID 4888 wrote to memory of 1280	4888	chrome.exe	114
PID 4888 wrote to memory of 1280	4888	chrome.exe	114
PID 4888 wrote to memory of 5420	4888	chrome.exe	115
PID 2180 wrote to memory of 2028	2180	cmd.exe	120
PID 5368 wrote to memory of 3460	5368	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/folder/blYnzALD#_56pA06zNhwSlK_Q9perNg
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa3239c728,0x7ffa3239c734,0x7ffa3239c740
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,6341792728942889507,11763720952070346960,262144 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,4366539364906880661,13937075981070722627,524288 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,11192841418117970399,16409481164154641476,524288 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,10233820766335029699,7716910031698354786,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,503114486956879999,12901912038962392331,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,15108317153949610371,14938651152808497520,524288 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5732,i,13570687503443156687,538000033145011292,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5772,i,15741343101545882736,16304078239638650130,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6080,i,17081164696238136119,15009157769424966102,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5080,i,5723294976252132274,8308740503221849337,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5816,i,13140865125220055525,15703566730111916819,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5008,i,1209001247628609695,1688226625268399069,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5020,i,13349173469317157028,12831817407176725077,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6008,i,4064936261348461932,15019711581298680146,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3200,i,11291782173904274744,11600266751928541737,524288 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:12
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,2642760478786706521,12478554094351056551,524288 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,7117594232861212118,183766023436477006,524288 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,15486483815304390565,10947681493108868394,524288 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=1276,i,13880897858205669448,1789694069721885759,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3380,i,5053413513790223780,8137342760548962398,2097152 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,11202384499951946694,12562881943261142419,524288 --field-trial-handle=1904,i,129110028413978303,7242164733355468451,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:5420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2404

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Worse\Fixer V7.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\lodctr.exe
  lodctr /r
  2⤵
  - Drops file in System32 directory
  PID:2028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\Worse\Fixer V7.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Windows\system32\lodctr.exe
  lodctr /r
  2⤵
  - Drops file in System32 directory
  PID:3460

C:\Users\Admin\Desktop\Worse\Start.exe
"C:\Users\Admin\Desktop\Worse\Start.exe"
1⤵
PID:2220

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

635d6606-f4d0-447e-ba04-19c4a16609dc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\635d6606-f4d0-447e-ba04-19c4a16609dc.tmp
Size 5KB
SHA256 66f9c7bc7e719f438017f425c1d189b80d479ffa39182b72771c76d6dfe17f8a
MD5 3357a7aff3178af832feb18eb3402246
SHA1 3934bc24804e6380761454b6afcef85ce01c08ff
SHA512 f07d6c80c0c653e2a0a6f46e68d94d10ea58b7fb08e0503f115b20d5d2e7e3c33713bbc8df3ba55df6c542aa2bb1a7296620c9610bcafe4f20dfed7a3ff575bf
SSDEEP 96:WbJ0d+DYOC49mjc0XQKgfaHtpZV5RSl8h4otop5h+DDB6SGGfvY7BUsn11Qzb5M7:Wt0wR0jhgKR3ZPiU2+dnvKBdnQE3wbHc
TLSH
T1B9C1F8B5A46C7C3359A7E552B1033A07CEB831AB65419F50EBE90F1D11DB5BC238A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 884cf901ec2285b18715c18aa0902c8549f15ea2069e5282603241810047d84b
MD5 bacefccc3551eea0a68e3fc75b12f597
SHA1 e6c33e011be6731c2b0f72744829b6e837cc059c
SHA512 70dcd1c82ce2ba5d5718677722552789b3093a2f682e160d63433c31f4c6696cf2198da4dbb3a88edcc277b72c60721d0a2a92ae9ee1e55e2ba940eecd558924
MD5 SHA1 SHA512

Submit Download

09361920-ba27-4db0-8755-833e0ae679a6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\09361920-ba27-4db0-8755-833e0ae679a6.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

22326eaa-9eb1-4983-aac5-f7e810ee85c6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\22326eaa-9eb1-4983-aac5-f7e810ee85c6.tmp
Size 12KB
SHA256 8d6a886267f6d6411c056e5af60aa8d9114bb55742f68d62d61a7170e250547b
MD5 6712691908521e97da926b10e6d74eab
SHA1 824a1ee0f84b8f1575cf5a82098ad9d477e9d4bb
SHA512 0199a705d020c5534ba2006d1cb2f1ea84f87d057721e2a07025d7333d913a803fd4c22c49db38d913334521ed78199b6f08f06cbaf4c3ed2b4f14dbbd01c112
SSDEEP 192:SRv4SDHmv7vAPRp2649jHsb+WNn2a4tGi4YKScDkwIiTITgVyIsnAUgE:SRv4STSmXAdwv4p4YlcDoO6kE
TLSH
T12042952EFA10797B5CEAD22AFA257713E6F5203271912E84E6FC8A3C15D75CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24774818-c828-4812-a51b-7ee891d684b2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\24774818-c828-4812-a51b-7ee891d684b2.tmp
Size 11KB
SHA256 6984030dfbb70df9661c9ae60de4ae520f352065722c9b54621ca06328a69c83
MD5 dd54727fa8b66368cef75c807099eee7
SHA1 bf151505cd2700ad4f1bea5fe928d7bcc5d5c52a
SHA512 7e7cc7cf4f41384c3e329bfedf4f4faf4c7a7119f27f01370cdb73f7a1559b16ac05dd65ec086b08f0a21b3163daee08082e669846253fae44dbaf6d3d759791
SSDEEP 192:76Rv4SDHYv72vAPRp2649jHsb+WNnrpGmS4e4ScDkwIiTITgVyIsnAUge:ORv4STEi6XAdw9a4eXcDoO+ke
TLSH
T17E42842EAE10793B5CEAD22AFA257753D6F5203271D12E84E6FC8A3C14D75DC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f1a515b-5c81-4489-a78b-8bf46fccacc8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3f1a515b-5c81-4489-a78b-8bf46fccacc8.tmp
Size 12KB
SHA256 dae2667de2d53f979db231e4eb7bb930e543ec1975e9a85fe4cf3aa790f586cd
MD5 3f076009fde37f1f04735e9b51ba73aa
SHA1 c86f88177d5f0a2b49a9179f1a1b5401916a9bc7
SHA512 a216c2fcb3c6456cb103477de30baebdf47bc33f2a9c669012fc6388d3f5b0d17a2c4f48904338d11c700038841a045b4c53cc5adc84f0c46d7106efaefe27e0
SSDEEP 192:SRvISDH1v7vAPRp2649jHsb+WNEq2a4tGi4YJScDkwIiTITDPyIsnAUgE:SRvISTFmXAdwz4p4Y4cDoO63E
TLSH
T1B442962EFA50797B9CEAD22AFA157753D6F5202270D12E84E6FC893C15D76CC221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b2a106b-fc9d-4430-b0bd-84ab3a560250.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4b2a106b-fc9d-4430-b0bd-84ab3a560250.tmp
Size 11KB
SHA256 bc815663c0de44dff01d3c27875e8a695548429f2c45ef0efabb0b835adc8f72
MD5 5850ccc85b781bd9141a4468d806821a
SHA1 9212053dd50a8bcf0e547a3627beeb373c9b9ea3
SHA512 90d08a937466268d36ef63b0bb96b677eaf2e107d95eeb476904cffe425f236718f72f80c477156f1ffeb4ec355b7da6acba263e147f8d6f08d9935323767617
SSDEEP 192:76Rv4SDHhv72vAPRp2649jHsb+WNnrpGFB42FScDkwIiTITgVyIsnAUgR:ORv4STxi6XAdw9a420cDoO+kR
TLSH
T1D632852EAE10753B5DEAD22AFA257713E6F5203270D12E84E6FC8A3C14D79DC221B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60a17012-57ee-4da8-9533-c393af5b2496.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60a17012-57ee-4da8-9533-c393af5b2496.tmp
Size 11KB
SHA256 b4367c5bb6d809a5751f6576c4db496700d9191a19f810ac0f78ba0436d73909
MD5 d560e15f8d9eaf7a9ed75f964352c88c
SHA1 5b3e325ec45242ce6c5c4afbe5a20f378e339f8b
SHA512 8b69f4f04f8e7d3d81beb8b627dec6afc9505f7f8eac1174fe10069c03b1ae8752e0cfea4faa9723256b7ceb4e70acdab8d2655ee8b47c5796aa5fc839985c5e
SSDEEP 192:eCB4K6Kc7KxkXqK4I40pUZNCgVLHrKHfFKslEQ0+XzKD/RE+ErUkKN9y8NKodgPG:LBjZc7KxkXqKf/pUZNCgVLH2Hfgslm+Y
TLSH
T1F732D827A48DAE7F0FD8D91DCC166F4B6DB5029632680C24A6FF9D0803A578E114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 18KB
SHA256 fb0837794da04c48e665d6008ed74e28b20f726d8a01f713c593be67c10c9f69
MD5 04368eb3a59b483ada978b8377d54151
SHA1 fc6d5bc5e6179910620acdfd71aeb69b6d6405bb
SHA512 1bd68202a7418768ed733c4ea39ffaf28a5cb7c8bc25b340fb2581bebfbf039026db4f8c4c509c1dc7b9b7ce64d3e94ac46eaad50a35e4f2e894ccb550fe28f6
SSDEEP 384:j1amOpwlBNwuI/w56aKaFugQpWQLtH8IraCu1shp4xsPiLxOAc:j1amywmuIKiaMgOWQtrFB4xsP7
TLSH
T17C82E08106070A7A119F157241E931909EE6A18D2F6DF66E2478CD91C5B72FCCF84ED7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 28KB
SHA256 f14e05f2058f5d657c6b1fe42d912797c0b65454e9982fdb6b3468b23dfa5445
MD5 ee632162ee75733850e7c6ae3624338e
SHA1 bbe5fab4cfadb6d24854abe5b3ef3531d1f3e549
SHA512 90978a9d8167bb19b6b495c69cc17468714621f132c5bd3f1e361247682d51b75e0f06b7ac08b8b207398e9ab048d931553007c50caa97fb202cd8202f991ec0
SSDEEP 384:cXP1IKfWEL79T9BmaMk08wDqjXaC+bwY6I8IS5iB818/famekTQNykgnJvTD7mWA:cXeK11ZBmaz0iajb8Ir2wAskCnJvTOGu
TLSH
T119D2F1035162CB6A63EADAF5BE189D12F856236D029C57F8CDD1284392214E2BDBE631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 fa495e501e5404c9c3b0c11654a266b9bc14adfe71eab9382132ef85b6018022
MD5 fb6a5a6998038a0c6be5ba826d1fb6bf
SHA1 844bc4f8db3921ff5735bf8e8d1d9de6df0bec27
SHA512 cf9a6346303cb886fb2aa71ec82d71066cb8cbed95e241afc9ed4bc8b8484f76242e10118e4038edc9f84036fe3274638697106d8b89e569e82165debfde5c12
TLSH
T132B0125083C04122DE41437024A1464234210D240213226286E150B940433E0A103040
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

15ca8023-d85f-4801-82b3-919ad27f6dbf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\15ca8023-d85f-4801-82b3-919ad27f6dbf.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

3e47477d-aa51-4130-b2a9-cb64c6dce8a6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3e47477d-aa51-4130-b2a9-cb64c6dce8a6.tmp
Size 2KB
SHA256 dfb4c595e211413e107edca068bf3e2bac8d6767b0e2f3be5ef7f1c536a1348b
MD5 8117ebf88f4973f3bfd9e02b4c052b9e
SHA1 1d05194bb4a3b5e348c3b469016daab58cb94d34
SHA512 47cf599f5c59fbae4e05067b9855f687898c935845172ef0b6c4a13a2c0a1ccb4ef7fee9cfca54cd17f44e7466627c3732112d5541026607d5a5448d5aee83e8
TLSH
T14451CBF7C7E4862DC911A6F49B107E2FCE290A19031D3C6688D8AE5B43E2872D21078E
MD5 SHA1 SHA512 TLSH

Submit Download

f720bb90-b204-49ec-93e6-d154cd980944.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f720bb90-b204-49ec-93e6-d154cd980944.tmp
Size 690B
SHA256 ea476ccefeb6f3709f9d858e5a256e09e79e32de2aa53f705a1a80a661bb22f9
MD5 824e37be7692c32f544d661991695aab
SHA1 52568221b9681fe12e790cce6fa339534ef9f7c7
SHA512 4ba89cf61b5467a23298e4252a89ce2d31b82f698da2d6fc2c4f939e389a03139e0c70b638283864ff5aa643d3f5721b38990fc3ce53ce6689d65b9d29f90260
TLSH
T1A4014EA7E6BD74AF507946AB1E44FC0919B7B831068164F1CF9B826CB08B5F71B06417
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 b40c9abfff9aef9b65a2f67aa37c7f3ec495f2f4d27ddc73c34469dbaa6167f7
MD5 f38c3415daa3e0c548d6faf10bb140a6
SHA1 1bf67de5a126c8d14dff1cef13179acc16ff8a76
SHA512 313b2456bcb9995906ecea6e9d32ca24574f9b53ad052228e87ad9b29a6e588067465248641a13b0e098734c20638e27a3a60e24513676d434dd67aae236bd8a
TLSH
T1CFB01200894E5622EC0041711609508532418E61E5051A42A6E0559588C30F01212625
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 dfe99693b7d327a9a14f709151e0c800513b7fce3ab7280eb1da83c9e3dbd2bb
MD5 7227c5ffe9fff08b355b3c2319941fa9
SHA1 84b049a7abc23ea7b08f86ea729d4fa2a41ab0a3
SHA512 911fc67032554ff9830611c4907c9a28863b1d89ca081559c53fdf8fe32aa6b702aefd5b3af5fd11fdf21e466a0ac970f6731c76fe460bef8d1f6fb7aed62017
SSDEEP 3:MsEllllkEthXllkl2zEkliW/:/M/xT02zn1
TLSH
T11D4404057FC00D0DCD0014304113C3500370D4304511D743345304775DC55400C31001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2ea7677-5394-4b20-8f8f-ebc21380ba09.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a2ea7677-5394-4b20-8f8f-ebc21380ba09.tmp
Size 4KB
SHA256 fc9ca12d9beae83bbb076836d411db77f6639845e81ac8916a74274d68eca935
MD5 1a551b585b4515720f8e3c069c651d76
SHA1 d36249af7f1276de64221105c7ea982854a9b45c
SHA512 6f3084bb5de8b97505c816ec735f6d62b42a7db566f23ebf0d276c1b1a8022e2b14b41096c19b1dc2bcbe6f2683e5722f9b288fc6d40007549568f4d6cd28d7b
SSDEEP 96:sC0d+DYOC49mjc0XQKgfaHtpZnm5gRDotok5hVDDB6MGyvY7CqH0bOZ5v4a:sC0wR0jhgKR3ZnzDUDTd8TCqH0bOz
TLSH
T1F5A107B1A86DAC7744B7D500B152BB07DEB831676451AF40EAEC1F1C10FB1EC1382567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf51cc53-a5c5-4b67-a21f-5dbcedf3ee88.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cf51cc53-a5c5-4b67-a21f-5dbcedf3ee88.tmp
Size 5KB
SHA256 ea0fbf492ce6449958b83e950676c0048bd01e11696fe758b7df54f87a56cf00
MD5 a3aca48df0a5296280615a01a8ff2298
SHA1 a98d113f2b7325fc671a60a500ee8725d5b1b1dd
SHA512 1d3d35f7bc963309b67dfff3569e7f23e097a7c75df94a3341e371870f2d96e9616d11aa0d729e95d0bc5c76af546d73fa6928268f5e5af2a0fe1d6ed614ad2e
SSDEEP 96:WC0d+DYOC49mjc0XQKgfaHtpZV5RSl8h4otop5hnDDB6QGyvY7BUsn11Qzb5MD3/:WC0wR0jhgKR3ZPiU2Rd4TBdnQE3wbHnc
TLSH
T19BC108B5A4ACBC3359B7D542B1032A07CEB831AB65419F90EBE90F1C11DB1B813CA827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f14a147f-5ab4-455a-b360-f11c94766049.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f14a147f-5ab4-455a-b360-f11c94766049.tmp
Size 5KB
SHA256 0847ced6bfcde24a4d4437d23fc5d1793e21a0913f084873555a9fd7e9310933
MD5 94dab8e3a879bffb81b55c02dcb9d628
SHA1 0bfe251121b72e883b9ea6eb6cd59723f81b7f03
SHA512 02560d8646bd240e85a470f18bfa58539906c211bc026150da95febea3a0eccb2758ff8848e9730284f39e2fde49dd839a2c870aac4162a1bab6acb317cd29af
SSDEEP 96:WbJ0d+DYOC49mjc0XQKgfaHtpZV5RSl8h4otok5hGDDB6SGGfvY7BUsn11Qzb5Mn:Wt0wR0jhgKR3ZPiUDSdnvKBdnQE3wbfc
TLSH
T141C1F7B5A4AC7C3358A7E552B0033A07CEB831AB65419B50EBE90F1D11DB5BC238A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc007.dat

Path C:\Windows\System32\perfc007.dat
Size 40KB
SHA256 e3bff436ffe5d0c6bcd7018279c3c3eb80173af85b1bf7f8c8f351cc021d8ebf
MD5 6ebdbff772ae7a2433fc9901355108ff
SHA1 76dcc4a6c1aab10e5bba307ff7b27585e96d4540
SHA512 7efd046f651c9bc0bad0b059aae2e0cbfe3cd4852e6d9e308f051f2419c40c315e6fc45d7e4d8870971ebe497234a1ef23814ddcb19f296869c22509cd8d8bb5
SSDEEP 384:5Kb+jONlkgBTFy1w2I8CIqrzJtHvSzB6hi9Dq:5Kb+j2tTFyuhttGBC
TLSH
T18803DE5407EA062DF2F3AF38AEB09145A966FDA7BD33E81D2250118D0472A51DD78B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00A.dat

Path C:\Windows\System32\perfc00A.dat
Size 43KB
SHA256 e9fa886e78dfa7ec3dc6ed05ad998574be33160684596b37c9034d11f246c31f
MD5 1e0e630d9c572f62ab07ae86c82b44ec
SHA1 7b9f5ee24ce9ce8b3423103d8862fd1274fb56d5
SHA512 ab0e482a81785eb2a3744fdac7e4feb3811a4c7969c841acdd265c08b59d070c8e0074883ba09fec98531e4c7ebaff41e017bf42ec8989342ba07ee548e83032
SSDEEP 384:W2w0gdgEbiGoLxGtGsoqXT8YwiwHGDlRrrrgkqhffYp7eYim9YB8jqTuYm6faACk:jLLxU1GSWnWRQH
TLSH
T17913521456F91706F2F3BF38A9F955169E3ABD52AD3AD42C0260024E0DB6F80DD7872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00C.dat

Path C:\Windows\System32\perfc00C.dat
Size 40KB
SHA256 99e5ccb2e7009a5ad0d1335a403463e754d63c7d0c9f4d78e84dffbb5533dc65
MD5 4e26019630eaddaf6b4642e7099ce5e6
SHA1 8772e24c9f76cc717f41878f7ba3f4d7f281ce88
SHA512 7168b034f2b29215c061d1c827f2916de413f6dcdc8bbda6f1c617851c5716057dba16336571110df2059ae4ea89a151f44b294334f137737e43a22b4b82ef07
SSDEEP 384:U7jDZ3S5w/cf6JaTnsfk76CJssfg6RqG6NOiMSJtNMLzpbyf6HLb7D7OY136plP1:/ISzZ6p19LRGwVZ
TLSH
T158135654A7E90206F2F3BF79A9FE15059E6ABC57AD32D41C0291018E5C72F90DDB832B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc010.dat

Path C:\Windows\System32\perfc010.dat
Size 38KB
SHA256 8ceaa2e1a9cc8b7f76e6a2551bb1dfbcc64896c8c3fd5901e417f41ddff35e6d
MD5 4f32511bd6124c1b65c8f7fcd244a82b
SHA1 6d840ddec80ee4f6ab99a1d0b55c50a568edd722
SHA512 ca8c8103a4ec3b8f1a070ee2a3301f8af64e08cfd40b21022e5d9f54e3decfc55b7571112d186aba9d7b4c7b5720f7eb0ff3847b39366dd04b912dde386a73e3
SSDEEP 384:nHpgS15tJ6N9/JC9QGYlLMsotnVTbuMzKl7NGk6ZqnrEXIXlJ1CEC9TQgFNCksUb:0hCx4l7JXlrCEEeANH
TLSH
T137038BA593FC0609F2F7AF3CA9B852265E3ABE666D35D02D0191045E0572E91ECB433F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc011.dat

Path C:\Windows\System32\perfc011.dat
Size 32KB
SHA256 33295c7ee1b56a41e809432bc25dd745ba55b2dc91bfa97aa1f55156880cd71a
MD5 50681b748a019d0096b5df4ebe1eab74
SHA1 0fa741b445f16f05a1984813c7b07cc66097e180
SHA512 568439b3547dcbcce28499d45663fdd0e2222f6c5c90053769ce2585f65721f679c071393328bde72c9a3f03da4c17abb84b8303897688b59598887ceb31438e
SSDEEP 384:Urm2HB084SY+2lmg/YFgfJhFeS9+7Gx9QVmNYDkHrJBQl6wmT:BwwR1fQRPl6f
TLSH
T179E2F2A44BF90005F2F7BF7CA9F59002AE6ABD266D71C41E01A1110F4972F61EDB972E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh007.dat

Path C:\Windows\System32\perfh007.dat
Size 281KB
SHA256 e29402194703260182047d87bc499f70ae87305b864c2d569337701b8537ed46
MD5 633cd3acad4f0ff18da161c2c652a40d
SHA1 6607b82cff500112326668a87e34e87d394f9b3c
SHA512 882dc6ae5afead479702a0ca8d8057d06e940c89f50ae43042e0109b6a0c14470372a7bd8bddbd7dc00ace4d5aa11b012c26f3e24f34622ec61934ee3012354e
SSDEEP 3072:MfpwBxTEsmVUwN8EBNjcbWhSILPDtzcSx2A8q1JuqaBYrSrSQYCxlFdj9J2hSF1n:X
TLSH
T188549B6153EA872CF2F77F646EB86254AE62BCE6BD79E94D1340209D0C71B40C974B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 271KB
SHA256 f1a8159ff1aab558f6b698fb15037271d9c382a55938c351faca9764a2bd95a7
MD5 d4b44612fd63c04b484abd7bc206eaab
SHA1 83f65909eed12eaffc8dbaf05fa39a7b6e3590b4
SHA512 7acee6f2508ff5a0ac20fb1658ae8c56105ba03c6a1e2e7d9890484f9dec9981280dd29fae659d2328070321fe52a8b565802ef486a67e2ea8db019c24856b2a
SSDEEP 1536:7vMX+/UnHKGVBcGYZuQGoqXohi4j0rWuIxN6l5pfKsddRRZn5nETMuH9wYDd8M6g:ZUqGrdowz4j0PrRZnpETMsZ8M6d0PHD
TLSH
T1D144165163FD4608F2F73F64A8B816A45E7ABCA6FD79D25C1250105E4AB2E90CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00A.dat

Path C:\Windows\System32\perfh00A.dat
Size 317KB
SHA256 118e299241d5b6c2f955855c80bf9803e72540accf96034a5539e5f06550bb38
MD5 aa622e26002d6dc05eeee70accf1f6a8
SHA1 1a45f9392d33ffdf7cc87f1adc549d99b7493961
SHA512 8e13c3ebfaef89214c79f7257071f296c8db742fd277e31ed1b10e7ac8bad01e879ee08c5c904de84284c0601d720e08d1083f6658b129372125e358387fd41d
SSDEEP 1536:Fuaqal+aMs7F17Fetjvt5DYJe4SKa8QnRGegWBndcmrm8gzkdPi:F2Gx7F17Fetjvt2JYH8QncegunW
TLSH
T164640150A7FE5246F6F77F1AA9B91A654E7B7D92AC39C01C0210115E0EB1F84CE78B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00C.dat

Path C:\Windows\System32\perfh00C.dat
Size 319KB
SHA256 4723ed1a7507ef45d8fc95c9dccf8309ad75422e4ed413133675dcc26c7054a8
MD5 1d360a80bfb75bf9ce3645c564be5715
SHA1 cbebd3f18296185374d83b415c64229a708f64db
SHA512 cd5da6fd92fc57e96cbb17f269dd910ef16fa86005f99fff142b86a944abf2d9059c820c2ceb65db4d386bfc8046a9075b874fe1f48dd135ff756b3e58d08124
SSDEEP 3072:8eeo6JpGytgOiPIny4auTsQO2I70IeMsCnSRwERwpZR9DNtflhzO:meH0
TLSH
T164640C60A7EA5206F7F67FA1A8BD15268E6B3D97DC35C11C0610109E1DB2F94CDB8B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh010.dat

Path C:\Windows\System32\perfh010.dat
Size 310KB
SHA256 89d761c8336ce9ce8173446eb65bfb0b571416714cabe431e0255f50bb39a102
MD5 3e20087969d80b6bb8f8abf60c646139
SHA1 43e861016d363459d6aace074d85ef1db1700009
SHA512 aba815f6857a7952e603b97bd284630957d8691e77e64b5d11784a54e842120ef620b04e1898bd7ae8772d7eb2bbdc3e0ad3f73d0f3707024bc89eaab93726a3
SSDEEP 3072:g48gxoowjkUXxL8d8Zj/v9GLcr+c98ov+pmPxr:FCj/v9GLcL
TLSH
T150641062A3FD5608F2F77F54A93C26654E7BBE96AD39D11D025010AE0971FA48CB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh011.dat

Path C:\Windows\System32\perfh011.dat
Size 131KB
SHA256 78bc3c89ccf3d46485d6a7d6266bd46f23a8cc1b8570c6a5e6b86add6cae3bc7
MD5 f63dc76a70e4bd5df02dc455af78f0d0
SHA1 ffb846cfbcce2f0d8747ab4ba39371de4e3211f1
SHA512 4aa4ca141b4c9726d86a9882309a1c91e9691a3cf989796fdc304e8600f14e4633b3bcb07b32b54e7000942eb532c7613170acf3f5970a18c9aef52dac96074f
SSDEEP 1536:6ZnVQ3OTe+unkQGMIHOodBMSK2cVmRJeOyTIIrBtcPI:6ZS3MD1H7gVmRwNT0I
TLSH
T149D3968C7058455EE3F6D5B1A0A971F43B4EF9289AD74CA82E8190CB0150CDEA39E77F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc007.dat

Path C:\Windows\system32\perfc007.dat
Size 124KB
SHA256 03086dcc209a7d33ad0f6a238b6259315d869638b18cb021b1205ec62e74d3c9
MD5 3280caf2c5228f3509d241de7175ae9f
SHA1 34647bf1646cd9390b453bf008abfe8ae17f4b0f
SHA512 2c70baaa0aa74711b95dbfb88969a98752e3f65a846d2102deb8434acf81319c6301a916eefc497a37650cb8f3e13154f3189fd09fd17d51e2d49f2c2908e1cb
SSDEEP 3072:wb+j2tTPhtqVlB3ALvIsMdR4CY7532GaTJ9:z
TLSH
T110C313451BE9051CF2B7BF38AAF54045AE6AFDA7BE32D81D1190118E0532E11EC79B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc009.dat

Path C:\Windows\system32\perfc009.dat
Size 108KB
SHA256 bc5a4620fa399d50a57f2c6d39c9d698dac2e3d702afbccf5c03688a3cb871be
MD5 c89bbe1435759feb339afdb5f1fe0983
SHA1 fae086a52078ecdbcc97faaebe80fee7a7cd5886
SHA512 c4282da9e5574569f36c2f505aa368b6a704de1f33ffe14c66a3970e06578fd76abdc3effbbc5ce87a34dcb59f633d38ad31be74e8b1a5dd429276ec4a9e7891
SSDEEP 768:BwwR1fQRvl6kXcq1sizmDLvkqNpZRViynMNdQ90fbIq+zRHfeItQh2xvIpGpKe5N:X1i7HxoLvkkMSRHfeItQh2tajJ4
TLSH
T139B3C5955BF81008F2BBBF3CAAF940529F6ABE67AE31C81D41A0114F0572E11ED7573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00A.dat

Path C:\Windows\system32\perfc00A.dat
Size 129KB
SHA256 2659fa9771c180f3573d5d9d714ad13fb8e5bc242376e1d216cdc090ceb07b88
MD5 dd76d1b07b82891c6a4954e8d8728b53
SHA1 3be71806c6d7f2b784b8c40f27982a2acd892c74
SHA512 8fa1bcb15ba09c411f988464efe6b13a58cfbc85d3b0e1fa1d8e8f127e53567be0e1920dbad6c470c5913b8a08887fbdf201b5ca65f3c952796377dfb1ca78bd
SSDEEP 768:jLLxU1GSWnWRQW411NGLvaqNpZRViyE49qo0ucnCn1p9x9MmUc8UXOM1xLENVu4x:jLLxUhWnKLvaPM/RWCD2nasJV
TLSH
T1B1D358545AF8120AF2F7BF38A9FD45554E7ABD56AE36C82D01A0124E0DB2F10DC78B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00C.dat

Path C:\Windows\system32\perfc00C.dat
Size 125KB
SHA256 9a00920f0a7a59be2bf2c148d980615a370c79898b4dfb1551466047fd051b4c
MD5 88429021899cae0a96fed651ab46241e
SHA1 0f893f848f54dc0bce6038a2de653f30c1751c5d
SHA512 4355cfaaa515aa442ef1adbb81038e6a805604c1a3b2affc450f3ead64e1c7d7d8a162b26ceacbbb4fe22f64d23ab44a678fac1a9ebefbb1f41ab6503bf41237
SSDEEP 768:/ISzZ6p19LRGwVPvLLvnqNpZRViy5fY9+Kb+3ApkBl9/1cxIiArpXMebh+D/vgfe:/kDBjLvnnyMYRGCVx2WaNJ3
TLSH
T1D7C37B956BE80109F2B7BF38A9FE11059E6ABD5BAD32C81D0191018E4DB2F51DCB8737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc010.dat

Path C:\Windows\system32\perfc010.dat
Size 119KB
SHA256 a53cf6bc4736d43d4b2eb2a0324f20cd836d58e8e3162bd1fb0878c6c936427c
MD5 b568b3be5f6e07f39ba57b227bd8f52b
SHA1 568bd33ae0acbc3e2d24deadaaf2f01ce4667909
SHA512 71a861e2e6a5f1de7baced84ec23f38a7ca59bf222c0f0d18a07be996dc9b5304b7a3e7d47303e0baf6e8dd490ad90f228ecf044ce2b7ba70b83922cfbff38f6
SSDEEP 768:0hCx4l7JXlrCEEeANBfyMNAaLvQqNpZRViySMfp90fbIq+DR0BRL2xvIpGpKeAa0:0Axo7JXqPB4aLvQJMLR0BRL20akJT
TLSH
T11DC3B1956BF81008F3F7BF3CA9B951564E2ABE66AD35C82D0191018F0972E51ECB473B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc011.dat

Path C:\Windows\system32\perfc011.dat
Size 106KB
SHA256 08c4de8febce21d3b672a0676a08ec6487f2a789d438794f4223642c3dab4ba6
MD5 69cca0145d4a4cb6a1bd6f678a608943
SHA1 d9180814300a8070b2dc14d7527b567632e070fc
SHA512 19e033fec755150de876ae00133fdb70fa57abf1e070ca809111ed839d09f3ddb8b57bb1f7c78dd3ae10f6433fc259438fa9ec76989ba11f685e6fd011687349
SSDEEP 768:BwwR1fQRPl6kXcq1sizmDLvkqNpZRViyoM82b90fbIq+ARLfeItQh2xvIpGpKeu7:X1ibHxoLvkHM8RLfeItQh2CajJq
TLSH
T1CBB3D5955BF81008F2B7BF7CAAF950529F6AFE66AE31C81E40A0114F0572E11EC7573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh007.dat

Path C:\Windows\system32\perfh007.dat
Size 632KB
SHA256 a11fa4e58dd6177764e9fc202a9a4291a16fa15a203e6f5294c0181f1e3c12da
MD5 24a282607bc2043d16f737f7c2362a1d
SHA1 a37cfdb2fea4ab1ddcebf333c74ca109b3d77e83
SHA512 720483660b52b074950ccbc9de051e0df33601b7a56554d24aba2dfc9935fe956322457643820e5cef831ef45d4b2b3430c0e92b57d2161f97ccf428d9ae543a
SSDEEP 3072:MfpwBxTEsmVUwN8EBNjcbWhSILPDtzcSx2A8q1JuqaBYrSrSQYCxlFdj9J2hSF13:Zoqzr
TLSH
T1F2D4A66153E98618F2F77F64AEB822A46E62BCE6BD79D64D1250109E0C71F40CDB4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh009.dat

Path C:\Windows\system32\perfh009.dat
Size 601KB
SHA256 59d08c8cfdef8b200509ed4c03fd2465f74f9a7821a27a2053560aaf5f48f4f8
MD5 f7607402349db39cba9b8841c509d4c0
SHA1 886df802870deb3d41e2b57e7a0d5b734ed502eb
SHA512 6f3dd9a439444df27d481d33b2f869254eb4d4d3abc7277767821b7a0d8990d3d1105a1d0e951884141b571f471bb9852eb6b2314816a1d70f03a656e3bb40d3
SSDEEP 3072:ZUqGrdowz4j0PrRZnpETMsZ8M6d0PH/9ePPtW2o37kNBu+BrknLYIerjNzJ6GXef:f8M6d0n9etu
TLSH
T1BFD47A9167FD5208F2FB3F64A9B816A45E7ABCA6FD79C25C1150005E4AB2E50CDB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00A.dat

Path C:\Windows\system32\perfh00A.dat
Size 679KB
SHA256 9e1cbabe526643b196de4155a51dbcaf1347a21b0f5d6ca72596d31fa447bef9
MD5 dd9637f8dd08974f6b252c18bd549827
SHA1 eb3838e9ca2d5a50249d845d9dad9d44a08615b1
SHA512 874ec9334a8b3244bff576dd7212e3c9bc6ba081586da9272f9468297dcfaccda520b6b94626b2d70abc690e32858e0da8e82d7b9ecaf0f6946e078956e3907f
SSDEEP 3072:F2Gx7F17Fetjvt2JYH8QncegunB6oCJ3yi2o3wvEBlFgZJkHcipdrj3UXfKkBgxe:otjvtuMnpnB6oCJPFgZZ0z4
TLSH
T196E40F9067F9520AF6F77F19A9B91A654E7ABD92EC39C51C0220019E0EB1F84CD74B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00C.dat

Path C:\Windows\system32\perfh00C.dat
Size 681KB
SHA256 d5f450d1ed601335b9a56714b5df0dc8e5e0d602b70d521dfd99e4fbe3c9c422
MD5 b3e8f3ce1bb53305e7262253be5bef02
SHA1 7353d63694679e83aada8b9fe07086c20460054e
SHA512 6fa5aa6b7a064c17c3b5bbe2f3f26c852ce10e77682c1e2ab984b684c933f14e9899b398d404ce0abbee8dab26442b62e2b05cf4832f6c87b6476246e478d0ef
SSDEEP 3072:8eeo6JpGytgOiPIny4auTsQO2I70IeMsCnSRwERwpZR9DNtflhz+jjZ1ObAEx2+Y:meH2Z1p089Egz
TLSH
T120E43F50A7EA520AF7F77F64A8B915654E6BBD96EC39C11C0250009E1DB2F84CDB8B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh010.dat

Path C:\Windows\system32\perfh010.dat
Size 668KB
SHA256 6eea2d6b7bda9701342d8e37939136b911fc3b3547c8f71c5623fa1e2d3aef61
MD5 7a53510ae1fb8aaa78349db3fb2264b4
SHA1 6fa75ed95377f1561c90919d767d017268e2c8a4
SHA512 63a37e69bd6600d09513edbefe5f4a0e86e075f32ca51c507e0d4bdafe9522c40bc30cd6e4edea53c1ae44a2f64453692153bec5ceb11ad473fafeeaf7d15517
SSDEEP 3072:g48gxoowjkUXxL8d8Zj/v9GLcr+c98ov+pmPxeaIpSIN2o3cBNq+xmek0WsJpXTb:FCj/v9GLc+aIjGq+xm1s3StI/
TLSH
T147E433A2A7FD5208F6F77F54A97826654E7ABE96AD39C11D0260009E0D72F54CCB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh011.dat

Path C:\Windows\system32\perfh011.dat
Size 402KB
SHA256 aa00c1d21706b8d895d03e2310e3d65e9ead4f1e55c8579281e89295e13469c7
MD5 08d0b3614cdc40039bb1640bd53e8a6a
SHA1 5efddd602b9a0670f7db51df76994176fbdf05ac
SHA512 8656913742b95ec837af5303b848ff3e773f25afe2eb23d7e54d7511355f638131acab4d4cb6151096acb94c0d994546e2127bb1c4ef97fb5551efc9c05aaafc
SSDEEP 3072:6ZS3MD1H7gVmRwNT07xEss2o34BzHnqQsYkrc1QKWlg+cNv/pyqnfFoByk328/YX:kS3jmRwu7xEssC
TLSH
T1DB94A98932E8450DF2FB7F64A5B820E02E6EFD65AD7AC96C1550408F0971E58CE74B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2220-1547-0x0000000000A90000-0x0000000000AA4000-memory.dmp

Download

memory/2428-1548-0x000001B5F1580000-0x000001B5F1581000-memory.dmp

Download

memory/2428-1550-0x000001B5F1580000-0x000001B5F1581000-memory.dmp

Download

memory/2428-1555-0x000001B5F1580000-0x000001B5F1581000-memory.dmp

Download

memory/2428-1556-0x000001B5F1580000-0x000001B5F1581000-memory.dmp

Download

memory/2428-1558-0x000001B5F1580000-0x000001B5F1581000-memory.dmp

Download

memory/2428-1557-0x000001B5F1580000-0x000001B5F1581000-memory.dmp

Download

memory/2428-1554-0x000001B5F1580000-0x000001B5F1581000-memory.dmp

Download

memory/2428-1559-0x000001B5F1580000-0x000001B5F1581000-memory.dmp

Download