7bdc537bbdc16ef4688f0cb9133e1a35a7bc5ec4b39612ba92174a5ab573bd77

Resubmissions

25/08/2024, 07:43

240825-jkh5lstaje8

25/08/2024, 07:28

240825-jathlasemf7

Analysis

max time kernel
806s
max time network
844s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25/08/2024, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nuggets.txt
Size 360B
Sample240825-jathlasemf
SHA256 7bdc537bbdc16ef4688f0cb9133e1a35a7bc5ec4b39612ba92174a5ab573bd77
MD5 be24598b3abf89d6ada8e9a4fb808af0
SHA1 eddd5f700ac6e7fd69d458c47ad6c3b4cbf8f5d8
SHA512 ec71feda3182959af057251a8c9e2e66d3230da5901e0b3b32227de218e52e207c932ebc2a18cdb8fe660856da1e6ee82d49001d2b4f2fe161d6bb20c5975ab8
MD5 SHA1 SHA512

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4504	AiVDsDOsA.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
157	discord.com
158	discord.com
69	raw.githubusercontent.com
71	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	AiVDsDOsA.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133690445771397243"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2612	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
1396	chrome.exe
1396	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe
Token: SeShutdownPrivilege	4740	chrome.exe
Token: SeCreatePagefilePrivilege	4740	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2612	NOTEPAD.EXE
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
2204	7zG.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3780	4740	chrome.exe	77
PID 4740 wrote to memory of 3780	4740	chrome.exe	77
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 2420	4740	chrome.exe	79
PID 4740 wrote to memory of 3856	4740	chrome.exe	80
PID 4740 wrote to memory of 3856	4740	chrome.exe	80
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81
PID 4740 wrote to memory of 784	4740	chrome.exe	81

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\nuggets.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:2612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc39869758,0x7ffc39869768,0x7ffc39869778
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=480 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:2
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3552 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:1
  2⤵
  PID:588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5024 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1684 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3148 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3724 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5820 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6124 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4508 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3808 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6076 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5800 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:1
  2⤵
  PID:644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=2968 --field-trial-handle=1604,i,11959842273817421836,14001372149164797747,131072 /prefetch:1
  2⤵
  PID:312

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:512

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4176

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap21441:80:7zEvent1632
1⤵
- Suspicious use of FindShellTrayWindow
PID:2204

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x378
1⤵
PID:2924

C:\Users\Admin\Desktop\AiVDsDOsA.exe
"C:\Users\Admin\Desktop\AiVDsDOsA.exe"
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f_00001f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
Size 384KB
SHA256 19b599c2ae4e4846f8ccaa6c6486f8bb9f6d40a1567c2beecdfb4d7f89cb1fa5
MD5 f52310cf57f048cfcbeb413ec5ef6c38
SHA1 2e71387e7ce8ee807419349f59394ec20017c5a1
SHA512 9daf8d65649f17df31f4b107e08f4e8523f30cde55ecbf55daf0056bdac9e8d4fbdfea347e7b80e1f88c1404fbf84ab98a725e95ecd2dd0ee1eb9725d7cf9e4a
SSDEEP 1536:waAw5MY6irD1YaX/u9mNycneg+Szn/1OFPw10s8SxEyfrulW9lMtOUb8ho8feAFD:qwuRir5YaX/gmgUn/1OFIGshHu+l+wAC
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 237KB
SHA256 fad500c0e129ef0ec3a82e838c0970cbe4cccd47f81ac2ab62a840ebcbac9cd1
MD5 70a923bb77865e78adf86db93d69d9c4
SHA1 1cbf34d5a2928f1f274cdb0ea40e8d9f7e5f05dd
SHA512 18833a199b0c8b2a8bf8d16a94c879d9b44733fbefc3483894356268781856de194a47695780f40beae7bd5daaa83943df24ada67d462a64a2b1536f3571d4bf
SSDEEP 6144:kjOzhIA2RHktNhizhS6HbY6U/1bBncuZW4ndJv:DzSAI2a7xAbBnLnv
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ed68c05c486a2e32758253f10b0ee39b6b09113885ca13d7337c575019fd68df
MD5 6b37502d4155a4a3627a19430163e287
SHA1 5891db48d3f41f497e7757a11cb16e6755752aaa
SHA512 1b8de9a788a899d5f56ef8420a01c53f76192a76ea8e9ca65bbc903db07a7a62b83053ba57d078f9ba93bc6295d9f36975efb3c75b88e9dadbbcc070c3556639
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5bb5157008f1981cf5004185f04664e4d659408af2424c7bb06a5a44d7af3867
MD5 bf2fac10d981f67503a912d7f46e3dd4
SHA1 99565c5b21d3352f1b5319a8fb732ab731c5a0ef
SHA512 f10c8c77bdba33a2a9aafdffa00d7569838b4d8977d576a5011078dd92d92795cdca1cb84a043a87ee8fa6331930d87977ba54a2cd4fa04e7a5d8758fb31e5cb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f14442226dce878ce74248234cabfad949dc6c23e2d15d761196d9aba70ad24c
MD5 acd5dd8dcf69568268f747379cb5903d
SHA1 6224e534c4c647805e24f15385883e2b7fee6c02
SHA512 91f77b896e2e2dfef83f63fb2dd6943527e09c8d1174dfa5f81cf4edc0322b8de2ed4e31fdb8f4cb782701e5a0d3a3b7a266e9228be3621835d100dafbc4de92
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.fandom.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.fandom.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 751B
SHA256 02ae8217a2a8f3aae48468bafd96e505577afcd146a6d0d8f0a59554cfaf4807
MD5 f88f7b978506e45d5429aee51d2b8d5f
SHA1 8a2031de962a8ec2e92fdc812d7255d1321977e9
SHA512 c058bb1c5e28b81f36d7295d157034a8b5ac017b9caae3f26ae8519fb65a85d74847694929749a5b9c2331101e6528a7a8779d93cf8224dc0b8ededd0476bb17
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4b03cd93ac6a2a56a38b6a4fac5aa31a3697b1a05dc174eefb1f03a2bd3cd680
MD5 2b3801ec3f83e98d17acb752d2f21a23
SHA1 7df8acf6dbb73d7ad30a9ad8f393975994266d3c
SHA512 ee9cb1ac47a669944aac4d5767a83f4a6bd44503289fdcec88fa4bc07ba759c1ff196217faf0021b0dc3bbce130f7af398b630c4799001f2c6ff1c85babcfd96
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4284423c82ba964b1c381ecb76428b97fad123224ff0c8d5239d4aed5cb0c54b
MD5 de1bc236743ce07b6f93461cca2c703d
SHA1 78435d6c1c9a7308bbcbb05c97c18ecf1a8e5895
SHA512 004d580687eec3c78883cb2759e1a9c0d24c2257913b37bc502f60fa839a9462ddf4e4bb550fa99d6258b1aeee81f9d44316479815ab1685aa45544d1f4b9723
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b2016dc1c4438d26a9b22b3853d6d9e0e26015ccf0c9dbc011a67353cee8be19
MD5 0df8289d4d2aa1ee1693a9580d07a567
SHA1 53da501b75dcd43b059594e18ce4003c712013bd
SHA512 638d0cea86e9c6dd44b5e1a01ddd254e29c0200ee231b39e4ee83cf78ebb98ec27868767146e0d34c10a72367420f29bcdcfcd9af049d2bf1578bc1c0f0b3411
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f99f48807f90a5ddb9a4b6ed47145093eb18764e77d1beba984031ba2a899144
MD5 c033eee4e46c0dbb5f50c06595969fe6
SHA1 b4ef832dc7a10bb19d84c7b020305b19f32c2373
SHA512 7962712ca7d4729edbfd0f7a0f0c3459e48fb1bebb0e0705e62da365c5409970127433ca55a35e01176d8ae96f89149a6756c096b2e9bdf0767b63829b2589f2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 81b2c82526c3cd0ef4c55d91322ce4441d5d039245aac7e38af41580cd848262
MD5 6bbcce59dd841590b8623e9ae7971bb6
SHA1 0d34e2199d783697572605166620b66b25dc6db0
SHA512 045f1d70724120b066edd8a0baa5e886ea6019d0196e7d4c3d021466d2b8073f9c787e4d4041d1476641893b88e36d31a7ddb293701dbbacccd993741bc00b70
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 2e09b4f1a330ae1bcd913554f17acfd9776d9f9463e833cdbafaf04af53796cf
MD5 3925f654953e61c815f096979e570db6
SHA1 bb5faab6869cdb0e0fc86e1048782535eb97de4a
SHA512 7617312d83072b41ebb7a7f4297a22ddbbd4789583877e041fcf7ac3d6553abe9711469421d948a11b0bc87f23d4e7e93a102c9fc21a0d892b4bcd27e3e355eb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 89da29c9f0a3c289f115e735a3d9171e289a17e59241f0dd5d923ffd6930a100
MD5 87e93ae48039b2dc1cdf3efb8ffc6ffb
SHA1 44b99dd18a34d805571ff43c0b02884ae0c6ac24
SHA512 b54382b43f722bdae0e4ce2e1f9b4dd799f59e98d032f14b47500f50a0617aea91a0b7d509e6d3f203277929384e6bc5af97a37489b8486a6c415d78217bf10c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 bc18725e4018ed182af676711619f7d5a8c91192fdf3936484a9c371e04db7e6
MD5 d2b1744c846e383ea125eeff07b4cf42
SHA1 4bc9392f041d5aa2227cb0cba4c2bc81b44dd048
SHA512 2967526d811f1a16297a20efd6b30659df86497e241ca7389987fa42ecfd337c6c667f8d8ebaae16adac66031f88c008e4707c3eea41bae1c8c7615be5dca357
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 07c7646cd2b97d03e271a6cae5a5a61be19ce29efd713b674c7170181a46bf93
MD5 4f39c1ace766904d3c218438f3758890
SHA1 7afb0b88e927cabe484ed224f936a64b8b92e8c8
SHA512 feba5135ae325ada0e47a2d40304046223b9c2314628084887345c922a155cf8fc578d139d1633bd9508778d242e415957032371bfc529383d684bfedbbd61c1
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 364e15cf78960478b31ce60fb40b934fabe613f117a5acc16576351baeaa59f0
MD5 ca8236a97dfba1a4f04e1b8ea0e79f9a
SHA1 18e44f815210fd8ac8a175e8c81a2586ceffdab6
SHA512 98f7a5a9999005ec3afdde7a12e05047bb3c04e883b477a527123b58e0273b2bbac679000ce1147f80af4a0bcf9bf152c9a53aa548d4af7fffca5b00c524a26e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 238acf40c9db52cc8abe8f4b8664e9720891c28a61c4c824f434cf4b595148d1
MD5 8ac3e7f611e68a1f013384d095150289
SHA1 1a3e858a2ecca52ea2aa0af780644313e702458e
SHA512 7efe5df453a0feb2b289a94903b1fb57d0a7b9d4c4563d8152fdbd1bd02deab566145433736ca7bf20d49f8b68a96e783ece9976add065df4408a232eaafb992
SSDEEP 96:qgnfKIqZA8iZRy7Di+6Msmde9OHb06VjVhYtjEsXt0/cg2Vup:q4fF8syy+FyWotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 818810843cd64b3bc045115578d30be8b6067fa6b5469488937908a34eb8eb60
MD5 6c433d962e2d29e4a062610e241f2ea0
SHA1 2bdfcc156e3f0ec8500016745efb0ebe92304dba
SHA512 6e882b2a59f2816884aeb4c82a7c09f754647bdf495574cf89cdf8097d17aaf2b49707e3fcb55e65ecfbd593b863944752385e3080a26ded44dfdd1997551efd
SSDEEP 96:qDhfKIqZA8iZRy7Di+6MlRgmdeDxkoLdikcMFGOHb06VjVhYtjEsXt0/cg2Vup:qNfF8syy+FlSxkoLQkctWotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 3b8da78977605766b0d9eb2a3ecf4285d527e9c10cde40c3facf0ba0d8f50474
MD5 ba917c2ba15cb9f07413f007b6191717
SHA1 b137a75459098e83312fcfc3615ed55c528ece9e
SHA512 4e90d8bbb98545340e15974f2773f8a4debda53550c5819357d8d80a5bb3b073cf3dacfb2b883cd0ef8b31348ecc780a194f2ccc1276044d81d49c3c29ca89a5
SSDEEP 192:qAfF8syy+FlSxkoLnkN46WotjEsXtScPS:qAryxc7LG46ptIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 1703800c17beb66a18d0dde5392359d2ea93c023af10d7ec1d37656b1970cf04
MD5 e3e8f3d62009a0bd7087eedf11b88e48
SHA1 84f63238256fe37116ec95a577ac2e32d3b4846c
SHA512 46e40c72335a7bca3b79f008e89fafbcee30d1b6c03a326b2a42e0b19ee9da44efec4f8b1e3dee78fa8cb35b6ba7d2c104d12450a7678b1af3c4235ddc73c165
SSDEEP 192:qtYXNIGF8qEfF8syy+FlSxkoLpkNeWotjEsXtScPS:qENFOryxc7LUeptIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 fe1090abfeb7e4da3fda30d7f13eeab150c43068813f45e6f19d86d0e01c142e
MD5 43fd44d8277e070630420f3ec449fde9
SHA1 3dfc01b94066a12e7bd8907cf5a9807b26589251
SHA512 9a03f8e82d4af04ec2d793440c39a99503d92b864d32f88e0ab05b14aeaa56cde6fcf668b894c0c56082010ec5e25cc8d581f621236b2ee489b4c09654235b4e
SSDEEP 192:qEYXNIGF8qEfF8syy+FlSxkoLFkJmWotjEsXtScPS:qJNFOryxc7LgmptIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 d40898b096a0d78b6dbc137f7df4e05c963493d3fc4096857c99d38f796df5e8
MD5 995c9ea976708cb6358d6530ffa1d042
SHA1 2c5c49228e81e3a3a18e0a2338effb45cac6b299
SHA512 6c4ec2aa3e81da147b80b02354d87f47517147bc6d113af2b54bcefd1f1a51bc6c76ae286aff661d6ee4e64b1bfcbc8e2338b7b4175089afd7c09d7aa6ac75e7
SSDEEP 96:qghfKIqZA8iZRy7Di+6MsmdeDxkoLdKEOHb06VjVhYtjEsXt0/cg2Vup:qmfF8syy+FYxkoLMCWotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 b259ce7b7fa38a04bcc04314e60a93aa4062161ec77eb3eb68e0d23b86b4b2ba
MD5 28cd906a90c0c2a23fb1f9c49bbd4728
SHA1 fb7da66352088045b31c413c8c1b08bd0d0cf296
SHA512 3ac142bd9f53a90dcf43c69bb56c40d1389c528b187de8a9552c005ef54ca9511bcfddb273116dbb171bfbecaeee07b135590e15e2324620b3a23950bcb0e40d
SSDEEP 96:qgnfKIqZA8iZRy7Di+6Msmde1OHb06VjVhYtjEsXt0/cg2Vup:q4fF8syy+F+WotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 6c7da0e1371873faad657f70a7fc6ee5fef01e68a2e46d254c396d7f33d32b3c
MD5 22929e56f5926292ccd2e448b7951c42
SHA1 cec2e20fa5fc8e46083dba69438db480d9a6ba7e
SHA512 bf54622e906791a614ea82279be45a8218f75308001d9ad76c99a63214ea919d3d49af30be83d6a99b820408a9cf86028c869c8cdeafb77ca12fff1d070aeefe
SSDEEP 96:qgnfKIqZA8iZRy7Di+6MsmdezIOHb06VjVhYtjEsXt0/cg2Vup:q4fF8syy+F6OWotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 9ab3828b826884b500df4f8298da9a294ee6c4d197da0717ebba960c8ead8404
MD5 728cfc707d97dd6af5619b7a9d2ff372
SHA1 36db90f15b226585c7419b7d344236c3094440da
SHA512 8a40b816b1bb2c70c7eb5afcf046e40ab45662db3e060d31ab5919cf1bc9a8f5cfd82a3225e7d4d0bcb729c09e843012a21793d94e399f390a94128dfff88a79
SSDEEP 96:qghfKIqZA8iZRy7Di+6MlRgmdeDxkoLdvkv1EOHb06VjVhYtjEsXt0/cg2Vup:qmfF8syy+FlSxkoLlkv4WotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 283e8151f6310262406ab982944796d6a70027d572273342d9a514bbb4f628c3
MD5 9a4330ce0521b92ac80c5d5e5a0d69a1
SHA1 3b42344e98b73ba72a1a739ea9e786d9d92839d8
SHA512 10a9c94bdce5c8d47fcb1ae3ea22b246b882575e813fb096be6fcc80281cc8003040968c60bedb6272ed1d62cda1d51719a8b9938308777e91ff5a4006a2cc0b
SSDEEP 96:q6hfKIqZA8iZRy7Di+6MlRgmdeDxkoLdJkwSMtrOHb06VjVhYtjEsXt0/cg2Vup:qAfF8syy+FlSxkoLHkPwWotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 12KB
SHA256 3a2cdf8d9fec4494abba7547c02ffed3a2ebd2f4dd6d6a08c61ff30271439ff1
MD5 f3a0681a4f66efe3f6727e2f524b6a12
SHA1 cd4b298ad3eb1b0bd102d7b80190f4c819614b5a
SHA512 f888c11b7c0d350b493688388a8403771eb880bba5fcab232163c5cda580408ee4cab827193756ab9ba6d8944183b6e25c241fd8e011d4331900f135f03016e3
SSDEEP 384:7sXf1kXqKf/pUZNCgVLH2HfkWrUYUHGIfOttum:6f1kXqKf/pUZNCgVLH2HfprULG8O/um
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 295KB
SHA256 7c86a58840c9372863736045a1fcdedf0259cadba80d0f589c5af9c74e3e1aa1
MD5 bae66d81da15764fc44aa1344a873534
SHA1 c79afe544faff0a9eb078aa4a8fe9a3af0dcfb06
SHA512 8d0b69d10f4740bf8776909e6395c83eab661187f96fec1bb557102b113799bf23c98a4d7df9b5fdf7005324519e9b7b606270da9c0d4e155c48b6dc2bfd8ea4
SSDEEP 6144:xGEi1Vh4xeI53+iQPDYbhDIfzgQPHJ52My3klNli6nlL:Fi1gxKyDIbgQ1Lbi6lL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 110KB
SHA256 0ec8013a2ff4289827251704df4e82bd78f5f527a972c14d0c201d28e0c65de8
MD5 85315be4609aac0605c9d4c45f95497b
SHA1 af202c28fb624044e96069b747037a30671201e2
SHA512 cc3daa9d8d9c59848611ad016e470583d15343442c016a69d8d60f098766e27046db42dc4b4cea933c9310720d773755c1baae73f5a24389cbdba8a7f6ddef0f
SSDEEP 384:DINm/g+YPuMnmf9NNDBzE0S3+0VQhWFTvx+mATqeOXoZBE6B+28LiksM12sz6o9W:DIF+YPurBwwaWQvZ0wWaKL3kAMA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 109KB
SHA256 f57c4baf5e1b23b6f5a4acb93b26468c32a197da623cdf708b61ec03a8bf65c1
MD5 709f0470732282f0c0edde4d3099c498
SHA1 c84ec261d4371f39bda7a2ff4954db4b2e639186
SHA512 15a6665eba44363f7b8bf9150f7f1f71f675c78fcbf3ebe7c6f372b1da64c59555f9e2cc3076eff30d779dcd019d382d58e5bf563bc712c8c189b50961148cb8
SSDEEP 384:4Nm/g+YPuMnmf9NNDBzE0S3+0VQhWFTvx+mATqeOXoZBE6B+28LiksM12sz6o9c/:4F+YPurBwwaWxvZ0wWaKL3kAM9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 98KB
SHA256 66d2184a3732bce152ed744a8234b71eee7ff71713b9ab9dce4bdba11e39ca1e
MD5 8066668c7a7bbb3084328fb58642ad41
SHA1 3bdd1ecfd355c912e8b1dde8e4a76be4cce63666
SHA512 653ff2647693f28b6b40d0a0c4fcc18090bd0f03c284ad1127e7edd2dc4ca337cf86b5790e01f0eb6d5c0e08f2135837ad7ca64bb754fdfe470c1d0c36e96c36
SSDEEP 384:cNm/g+YPuMnmFNNDBzE0S3+0V1iK+EmOXoZBE6B+28LiksM12sWo9ccoBsLAYQb+:cF+YPuLBw3VWXky0JWaKL3kAMp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 105KB
SHA256 31634890715826b694b3fb1b619a0d728a0603dc8927cadc7f30745470147a80
MD5 4c2e3d2eeab059a1ae2a3630741b4ae6
SHA1 62c0fec692e49e3b345f52274384312883592d50
SHA512 4538adcf7c80261f26c3eb505b692eca0594c8b31d24b666179dfe4904c0d0e1138e2be4959dbc395a412e0384a9975a76a78ff27d129eb7e7a276e24b4ff1f7
SSDEEP 384:TNm/g+YPuMnmf9NNDBzE0S3+0VRWv9+mATmOXoZBE6B+28LiksM12sWo9cciBsLy:TF+YPurBwrBWFvZ0wWaKL3kAMB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 111KB
SHA256 18ac651c2f6477ecf018c835c6e439b49713c247466117d0e543924a1d8cc542
MD5 a2ac5405de61df4ba60638cd035eaf68
SHA1 c2225488356d0fa74a992424b67adbae7f454417
SHA512 24f3f913aa518dce783a913fd828e2cc90a197d430e9955fe74ac7292233d6e2f069c5ebacae8730a15280dabf8dd3232bd77430efba1d8625ef008ea0b1c9f2
SSDEEP 384:oNm/g+YPuMnmf9NNDBzE0S3+0VQhWFTvx+mATqeOXoZBnt6B+28LiksM12Z8ruzp:oF+YPurBww9xWx8CvZ0wWaKL3kAMd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe59c7bb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59c7bb.TMP
Size 93KB
SHA256 4d4749008c837694a27b809c8e0d8ee2db29208b7281d68850246fed6a799e1b
MD5 7461399b5f5d7d3dd167fd114ec761a1
SHA1 a094348db88aaa2595899fea839470f231bdf446
SHA512 6f2828c171cb9d915ef189460e2d798ebbfdbf9ec57394ce0935b7ed31329d92e5912fead45ac18509600710ad56f6d5239e92093327c4aef7764ba3e6818419
SSDEEP 384:PNm/g+YPuMnmj+NDBzE04+0V1iK+jmOToZBEIB+28LiksM12sWo9ccoBsLAYQbTZ:PF+YPukBS3QWXk80eWaKL3kAM5
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

AiVDsDOsA.exe

Path C:\Users\Admin\Desktop\AiVDsDOsA.exe
Size 24KB
SHA256 88c90b565a20ef30865a70f8ff02dd39e5958cfb409bac81559ef2cd6b9aa900
MD5 2248fcda8954257069894700b0548195
SHA1 11b9e0e33d86d3d1777387f189176367a02696f5
SHA512 a1b60fc16722bc0d07fa21530d6756b09db935c9572b4fd5ce9c85f730f50dde4048e74fde4b737e7a2b9e0a2a0012d10b28caa59d35334bcfa8664993bdb794
SSDEEP 384:O49nzAQLeqCoHtVWS5v3wlaKIRLFSR75haB:O4yQLXVNQSp9K2LFSpa
MD5 SHA1 SHA512 SSDEEP

Submit Download

AiVDsDOsA.zip

Path C:\Users\Admin\Downloads\AiVDsDOsA.zip
Size 11KB
SHA256 cbc417be191ab85dc7fae87b03d5550daa710b97855e87451d52525f0443ee93
MD5 a78ff9ecbeb347651594a4b08018dce8
SHA1 7eee824f060c74ff2cce656a6cedd2004596f241
SHA512 2886e65a8565fc35e528bb86beb61bf9f74e233752aceb81faad831bac1241c1963b3bf3657ee9373f0ca38ce5edc1f6c52e67be3c62338b8d1662e2d5953181
SSDEEP 192:3/QcXIB9J5alzSMpk/HdI1gvufHAuJ/eH52V4ByyPif9je65bspJbDze2w:3/Qq0v5aFXCfAgvyHAQe5a3yPif5N5b7
MD5 SHA1 SHA512 SSDEEP

Submit Download