Description	Indicator	Process	Target
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\Documents\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Music\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Searches\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-891789021-684472942-1795878712-1000\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Documents\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Links\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Videos\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Videos\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Desktop\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
File opened for modification	C:\Users\Public\Music\desktop.ini	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\SystemTemp	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	C:\Windows\System32\vds.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	C:\Windows\System32\vds.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	C:\Windows\System32\vds.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	C:\Windows\System32\vds.exe	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133588523372626988"	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-891789021-684472942-1795878712-1000_Classes\Local Settings	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Opens file in notepad (likely ransom note)

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\NOTEPAD.EXE	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\svchost.exe	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\cho2.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\cho2.exe

"C:\Users\Admin\AppData\Local\Temp\cho2.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x104,0x108,0x10c,0xe4,0x110,0x7ffe6c7ccc40,0x7ffe6c7ccc4c,0x7ffe6c7ccc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1852 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2100,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2172 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2228 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3252 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3296 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4460,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4484 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4692,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4700 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3680,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4848 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3788,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4548 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5036,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5112 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3264,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3296 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5028,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5156 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3188,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4688 /prefetch:1

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4828,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5216 /prefetch:8

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4860,i,6522179436336072304,6872743323295550723,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5216 /prefetch:1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	www.google.com	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	clients2.google.com	udp
N/A	224.0.0.251:5353		udp
US	8.8.8.8:53	notepad.pw	udp
US	8.8.8.8:53	www.google.com	udp
US	8.8.8.8:53	clients2.google.com	udp
US	8.8.8.8:53	google.com	udp
US	8.8.8.8:53	google.com	udp
US	8.8.8.8:53	notepad.pw	udp
US	8.8.4.4:53	google.com	udp
US	8.8.8.8:53	4.4.8.8.in-addr.arpa	udp
US	8.8.8.8:53	clients2.google.com	udp
US	8.8.8.8:53	clients2.google.com	udp
US	8.8.8.8:53	notepad.pw	udp
US	8.8.8.8:53	clients2.google.com	udp
US	8.8.8.8:53	clients2.google.com	udp
US	8.8.8.8:53	clients2.google.com	udp
US	8.8.8.8:53	notepad.pw	udp

Files

memory/4588-0-0x0000000000AB0000-0x0000000000ABC000-memory.dmp

memory/4588-1-0x00007FFE5F7E0000-0x00007FFE602A2000-memory.dmp

\??\pipe\crashpad_2204_YUXRNYZWOSJLBJOW

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5	d751713988987e9331980363e24189ce
SHA1	97d170e1550eee4afc0af065b78cda302a97674c
SHA256	4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512	b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5	af4ab4b63348165d376929bcff5fa232
SHA1	3e6612f85f10076585c1bc934628c3f801ea381f
SHA256	2a035c7ed14c9e4e087cd3d8807be76f809209f868e719b1d729ed330457da58
SHA512	306bf3347bc3541fd8d1facc2264a0d71278b5d7213b0d3f307ecbd63cc5e29731b652e70cb0bde0b2087c279b1534c3031e3bc9ac72096e2478ee35d281158e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	451cda4ef68d116ed622c6ef3a3beac8
SHA1	aac90bb8192275dac0be4acf7ed3d4bcdba90949
SHA256	2a834742350b111be1b00b9a8c4b442c66c5aa67da0db0927b397772c61b13e2
SHA512	7c99b1973bae63e8102e002e48faa7467a23f6bf85f28a8956d5e2222cd0eaedfbb8ef6d64dd13865a8050d13608d6eb16700866c0094f05750f42eb855d5afe

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	92b5c8a134d7823ffd31bc03805db185
SHA1	5ef8438c9e7c6e1713b7302889bd0e4bf9a582ed
SHA256	43273f16a534184b72f3b656b5feedba746448355a95b40d5be610bb6b14d3a1
SHA512	a95e7d6c2bb39bfbfc9425f51f6d21583b8e3ac0ee9e8f60edcd5043d0267109ec21b52367a603faf73b89d2da1fed8e72f3e07aa460c38cecb1153de4431ba7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	b221dece7fa1c1caa70cbcc5914dca70
SHA1	5aad1c08fec69161d9bcfa6e54dd889b4b5b587d
SHA256	d0416daa305d1c068d54801b718a560113b4eb8a78ef6660578c01b8280fed8d
SHA512	3f59e67a57409cc29e440350cc6612b9f33ba7d19f8fc8b2d2b2195fa4460bcc61acc5fb8dc49a6f9bde697ee5fee74414dd0a2bfc7fd32b794eaea63b001df5

memory/4588-60-0x00007FFE5F7E0000-0x00007FFE602A2000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	b527a5744d34369fb49cee7c68112f59
SHA1	613738f963d92be81b57abfe031cc0d7e119a987
SHA256	17d4edeedc374523899ab7505df7b7f302d0e0ace23d54c1994be9ccf9f01be5
SHA512	2392cb9935fee17c4448f7c4402e37e9753171a163841a177ad10ff8566dc454200ae21ccb34fc06c249975807f0750f864342e78bdff86c0582b95ec43309a2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	f542fe8b82340b36a58d955858ec60b2
SHA1	eaa6a6d407de1acb4c58ef030ea16a8ccdfd2312
SHA256	47bb92ab20cdd5430864c7b53cd5a49a8e19749f8230944e66a5703c2f8ac16d
SHA512	d82259dd32e121097a3805fc9e3f8052410196f4e401c611cb3c6d127e814be8a2f8998fa640a29b26c63b6e6c7facf1e2933b64622ff5fa5cf89f7d068fa30e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	896e9b8cec77af9e7efd8eb748ff1a92
SHA1	7dd3a04b07820d86de476d8fd398657560ad732c
SHA256	8e93ffa2763beab0637d85bb87031a3fb6c4567b7914eab186c691c5ac12d09c
SHA512	e29ce04ec221bbc773f31118a19cbc8787094e62f2ebb5224c3f7f90143071161cd6d48f9eef4c315425abe804e005a6eac9513fd3d3caebf60f8902d52b3187

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	22e061dc0b30b89dfff77283c17c8075
SHA1	2f2742dc5a7186ce8b55d9623599d710e44dda31
SHA256	64f50fdf24b32ec99ba7d276f5c8ab026f9aa6fba0bcff0be086a6cf42c5b855
SHA512	50424b67ea75c34ba81f7a684c445f392571808ad6d1b151fb23bf8c262c71c3143937a8870c329058156faeaaffd777006b3ed95c9b59df7de9b85deb2ebfbf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	8ac2966e31249e7f6df18b512bd3ec07
SHA1	482d0c08268253020393343ada113955461d669a
SHA256	d64a6ac0658afeae811c977508c448f5a88f24a786876d57a9472b606327b442
SHA512	36b68498c247806c0c3a02f2649e487d54e581fd49bd3781f9204f06166f7f386d140cded257ffde0b6b4fbaadd221d8f2ea6d4368b68db22d6b1ebce7513414

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	582a1cb261d923667483c9a91a804f44
SHA1	fae3e7c8ef5e3b812e1fb3a54f2a3ac11332403d
SHA256	17a9c1ca27a4564862c6c1d631c2cb5e75d8b547b90c27698776de3882583065
SHA512	67482fb6eda93933f219c92649618f2f473daf8414064bca70efc1818f2498cf0767a6043c625b88d8ddf3955a88ace85011214dae50418005561234e50054e6

C:\Users\Admin\AppData\Roaming\svchost.exe

MD5	29fa75458106f03a11560ca466363129
SHA1	89db6502c8170f260b48d80ee0ece3380ba77eb5
SHA256	3f5ade39f3658b6da93987f7ba7dba38d7d94096638ef9f3565790e6ab73eef7
SHA512	28a58b096f560ac4cd03b96f77f7e0cbe7e96c4fb56fb6758c3e4ff7304e3ae4e0db35570f69070c676e45143dedb7be50556bc80f38364400ea2d43bec99188

memory/4588-134-0x00007FFE5F7E0000-0x00007FFE602A2000-memory.dmp

C:\Users\Admin\Documents\read_it.txt

MD5	9ef56b0438e82e07aa14fb9481d10b18
SHA1	b4d069b4737d9f32d07618d83650f7c1ed3bf6eb
SHA256	ae7ff3ea3c8870144b97cde602f5e84f8a365939cf127fafa38a5309f29b69d3
SHA512	a7f14c7f8b01ef7c21e2350e9b9efdcbb8d533197b63d7bc50d4c75a2190a2fc5633698a532ed07a186333097dd08991852721051d255d1bf2cfc9356cdf523d

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

MD5	f49655f856acb8884cc0ace29216f511
SHA1	cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA256	7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512	599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

MD5	b5ad5caaaee00cb8cf445427975ae66c
SHA1	dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256	b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA512	92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

MD5	d222b77a61527f2c177b0869e7babc24
SHA1	3f23acb984307a4aeba41ebbb70439c97ad1f268
SHA256	80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512	d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	eeba6d9b437ca89ba4c1c27d69848aa1
SHA1	83bb934ed317db8a8d92720cfc5711882f47f4d2
SHA256	d1ac6fd685b740039ca9705b1b121dc94243dd991ef6ea3834f751c08361aa4a
SHA512	c016e92178dac877ef1a93b8b1a584e77e6578f94b2bb6f985698cdaaf44c89a929c8a7de85a2400a196114fa95386014c96dc2eaaea0aa978fcdef190395649

Malware Analysis Report

2024-08-06 16:04

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Sample ID	240429-j7nnlsee7y
Target	cho2.exe
SHA256	3f5ade39f3658b6da93987f7ba7dba38d7d94096638ef9f3565790e6ab73eef7
Tags	chaos evasion ransomware spyware stealer