b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3

Resubmissions

04/10/2024, 23:32

241004-3h9dkaxamd8

04/10/2024, 23:28

241004-3gg8pasdkm8

04/10/2024, 23:25

241004-3ejnqswgpd6

04/10/2024, 23:19

241004-3avkfasanm8

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
desktop.ini
Size 282B
Sample241004-3gg8pasdkm
SHA256 b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
MD5 3a37312509712d4e12d27240137ff377
SHA1 30ced927e23b584725cf16351394175a6d2a9577
SHA512 dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
MD5 SHA1 SHA512

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
179	raw.githubusercontent.com
180	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133725581599411653"	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
424	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5044	chrome.exe
5044	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe
4004	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe
Token: SeShutdownPrivilege	5044	chrome.exe
Token: SeCreatePagefilePrivilege	5044	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe
5044	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1188	5044	chrome.exe	85
PID 5044 wrote to memory of 1188	5044	chrome.exe	85
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 2972	5044	chrome.exe	86
PID 5044 wrote to memory of 3192	5044	chrome.exe	87
PID 5044 wrote to memory of 3192	5044	chrome.exe	87
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88
PID 5044 wrote to memory of 1668	5044	chrome.exe	88

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\desktop.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x120,0x124,0x128,0x100,0x12c,0x7ffd489bcc40,0x7ffd489bcc4c,0x7ffd489bcc58
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1992,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1884,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2300 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3264,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3728,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5084,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4740,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4752,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5076,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5356,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3360,i,17079387911762530799,13292213583721394338,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4004

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 fc1846b3b2eb50bc25b32d1577381cb38592bc4f696e01188b60d85807a984ec
MD5 53679cfb082ef31750ff22caa29fdf46
SHA1 a024828b534b0f7475a4c56a0e8313fbd784fbff
SHA512 4fa9b7fa60e664aad87a66df02d7e98e67e5623770e707653109de0c4ce5d8ae2c678c561169ec566dc6036df9350dc30005183a6030762038c103725a2704d7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c207bd177c454a993a400caa6df8d32b53d5ff173bee0278cbcd6f92fc9ce7dd
MD5 49b1c0bcb961115b4b0a91916a3a0605
SHA1 c74dedd5a823b636b7b883ff9e8d0065008cd6dc
SHA512 f501b4d2e5e5f0e18e433eb6a370a0cfd96e4067b9ac619c57a695a607acd7ecbfda7ed913878fc3d3111b709707a3c4779a50f040e7542f180ad5fd671e5f43
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 78064b9cab4e597387137ff80673adf96ea83b704356a02e3492de632f96089b
MD5 dd8dc1fa6702068bc5efc92247ddcd77
SHA1 37bbb598cefd992d2b454240146f0e766eb9906c
SHA512 5fb2f1fa41e7d5c336aded5495ba4ac26dd6b984107a68cf86a6ce80e215aba4f6f265c19a7e2bc2dce306dd47f3fad81085b139cb1fec9fd063611804cd83ed
SSDEEP 96:FccTl1Ev+xzQsmSmnm0mJm3mS+Pr4U4T4ZEX4+W4p/5:FccTl1Ev+xzQsmSmnm0mJm3mvzvccCko
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 12eac02ab09b565b6d6998da7dc80d3ad348b4adedc6743ce1f5a137882b87ee
MD5 54010caafa17e9cdba1cc34d5139de18
SHA1 4231a723085aa813f5ca9fa276cb4c0810da1ccc
SHA512 c18a9ef9691d03c80fe3586440e467f48116c1b0d002608899a2fbef5ca1e624bd4eca830d3ff6dadaf21d51f29013e5675bd553ef345dfe1fc515cee42bbf1c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 bf821105adea95fe86d40f81e5b6aea31e0263f5c0b98d7840a57d4b5df56ec5
MD5 061d1f31666f1dde4ad91da5895f6eac
SHA1 33d7740761f02efe15f66e7d00bf8455e01f8cb3
SHA512 d0f319605d8ac75f7d76c98b18e5290f8b1424cf22c032590a13e338188d8829b50bf5c25851b08e859aa2789de248547ebf1de3e6b07f0d14d106196af13f8b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 1b89ada55b145c65b73db3e44dba8cde6b3f3614a20373729db0310e2d9ce40d
MD5 9e45c6a0c505e239f338262e5ab56387
SHA1 0ec4622d94a5f60339f8e95036e52746ce548616
SHA512 85f2e145a5874a21b4544c3b9457a1caec2271d40cef31e3a3ba3cfb5bb2a87454fb51d75e27bd9417139b3e803434db30bc3f5b368e08b014b336dd28efec6e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 9baadce927db9276cff712dfdcb2d893f2c474a9cb229685e1a37f0a676c88af
MD5 c02068d6a0c1fd8f29abafbb7b578e68
SHA1 85a469508a833c9e17c21a1a7317e5b2b50cf9d5
SHA512 a0203e3ac62cd5f9d0928126d9919a79987a04356599af559ff993ced8563677df3d4b4585350f39441f27a326a197d925f2f9d870c11cddee336692ea256055
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 89c2d1192fb58cb63ba4d99522ed6665d1ccdbc172e3b09eef4e66aac7b518ed
MD5 029b2ca3183d17eec026cb1efa7e2685
SHA1 705934a17b7ff5212b2ce072bd2d8fa4cb06a169
SHA512 7cda10532dde72b17919a7d84c13d375b1a2fd5f60a58608ef107d28230cf856ed8b407465640c0c164bca54eecfe052163a5085987f6357962b7267ebd98887
SSDEEP 192:r7cBzBEKCDa/e2gHV+Fmp7NsXeqnPo6yIsnVdgL:r7mzB9NEGkpsDL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 729ab28296c4bd3a20a2d78f61c292df377b12d60a7f458eb1d2fda61b3838d3
MD5 635712da0bf23e250fca094b97018f56
SHA1 300189cb6f18ab2ae4e4a10ea15df7eb6e8e553e
SHA512 2a087a013a2073d3dd9190176b1f51823bb6ca44eda622045f6efeb4b786ea1fc4f496336f99a3670b455786434fb68976bba78cee4cc4e8a537eeb4c6358191
SSDEEP 192:r7cBzrEKCDa7e1gHV+FpNsHeqtPo6yIsnVdgL:r7mzr90EGvs9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 82b5457939d9d482747605a13f201798eeec73bf93b3706a374c8b760864bd8b
MD5 af3b79a9d65a2a864fb90c7cdb0d5fce
SHA1 aa95e9cd41d67309d787c34715422ad134c8c84b
SHA512 eb00bfc0aded2aa222d6254c82ee7e844fa61be8a453d9fadbe249f27964ffd9f225d86051d0b04876e38b1920e134c4bfa0e06756dd0cdc50d5558d2d84291e
SSDEEP 192:rnrEKCDaoejgHV+FR/QeqpPo6yIsnVdg4:rnr91EGRk4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 10dec73a3991635b07d0fc9ed601ba9a81ab40a198ac0a7dff9d5865c4d906e2
MD5 2e9fb816c393d2079e7ba6f52c063db0
SHA1 936ab20f4e6b5e305e0e09a69d4abc7f99ce7174
SHA512 72f362d537c6ed4e6c8677f4718b01029b590a8dc72332573fab88253eee19f1e8f689099fd4cbdda528cd7946659ef78c09e9343e6cd1c932cad4ff96d8cd61
SSDEEP 192:r7cBzBEKCDare2gHV+Fmp7NsXeqnPo6yIsnVdgL:r7mzB9REGkpsDL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 5640b78d026ee5e3fd16e741cfdfd6c957f47b7f96e8d15b245f2c64350b78ba
MD5 0db332f88f5ecc61a1550b9282f51f49
SHA1 5e477d3e89b051d63b86115a0bd3b712b0600f1e
SHA512 687a05f2edb0e807cbdd3ad1629996813992ad8704b2affaba2f3fd09597fa7418b841d63abb389afec693be876fa4037ab71f56632d50134d7ff324c4df94f9
SSDEEP 192:r7cBzBEKCDawe2gHV+Fmp7NsXeqnPo6yIsnVdgL:r7mzB9IEGkpsDL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 1233e80db5c1bd7129bbfb5f4db79ff84d8597882b4c7cfac4fd1957f94e9cec
MD5 80f82b9c91176aaf6073acd19e55de60
SHA1 8e86d66e76623b0774341a8966dc8db070fcf1dd
SHA512 7c34a8cfc588dac590c79b1d2f05f8e9a4c2fd91dace2ede3ebb930f2aa2b62be20f51818f141608e533776b68e7fd9e7971a815da55872987ec8d6b60a41e31
SSDEEP 192:r7cBzBEKCDate2gHV+Fmp7NsXeqnPo6yIsnVdgL:r7mzB9nEGkpsDL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 f5f52591708e81eb5746acbfee3b75a6594c747edcc31bbc9b73e0d3fda7ddea
MD5 c5a45d8b2dac8b14cb305d51cdf74c2e
SHA1 6d84b2356f9e790e52ae55737622c598bcadc22c
SHA512 32c2550f212bd9ec0ef2bde5067588bc6eac575da8d3e9a4ed444827ef8b56ba969b44fa74e510eac060b998cd017a343bdb5eab153672c381ee3e7ead333ea9
SSDEEP 192:r7cBzrEKCDa3eIgHV+Fxck3eqpPo6yIsnVdg4:r7mzr93EGqkN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 dbc152b72f956ad3527f10d1dc21dfab6721dfbb875f1a9cd92bf34d60bca9db
MD5 af58f1ab478bec940e96cc6061535e03
SHA1 e64fa6ee52f2a0b9ad47e320082cb861d9fdb0c6
SHA512 ea8625b3e50fae6b77fcf36a602922337baf64f3e6c31994e84e6001ef082493cfed9ceadb99b407e902483aa8596c342b7a21ead3f69828cf708784bcb12904
SSDEEP 192:r7cBzrEKCDa5e1gHV+FpNsHeqtPo6yIsnVdgL:r7mzr9iEGvs9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 3b2209e585278d2058b5f7dd0d30ef1c5c43f45582076d4df566031f188140d0
MD5 07649de8303cc62d6bca750d7d92b5a2
SHA1 bf716f61f25883d852f38536c94a73555a57e54c
SHA512 11933899667f0ea258b7bbf46940790325fe27a94dc250a1d1f2c232d55e1ef63b0ab09c4f04e9c82e82cfff9d50e2c397fde4a03a1e8d00e3058ce0dfd5a0ec
SSDEEP 384:/bZV7pLhLc+e3qXEm1kXqKf/pUZNCgVLH2HfSX6rUe0HGwoXeZRd27:/FV7pLhLnw4Em1kXqKf/pUZNCgVLH2Hh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 212KB
SHA256 f83b6149af3f5081a9ac1a0f86ba6497be39e45f658dfcc1aa81cd40339a5843
MD5 4a7add75494e1c3e06c80e90e061330a
SHA1 487c7ae882bbe6f516214579697326d71a45da29
SHA512 432c176126929633ffdf7caf2198348e23ce1fc5667421ed50c7a629b713b7920076a0554836fb121b0777ffbaa1c7092241ed9ce0f30a52f06525bd8e3cc01d
SSDEEP 3072:CN+8nuHLBDdReAZirYDodNbRuHAQXJxfAGavCM306UOGEqGfL8mLJjs2BCF:CA2GL80isHAQXr4ZlTFqgImLhs6CF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 212KB
SHA256 3cff4a310dc01a39c9a83f717b00df2831b9ba9940f150d236f709dfe5d99659
MD5 7ea3e75e1a447c171016a310d33b799b
SHA1 8c65a2ce3147acf8e33927b22c79101dffac7712
SHA512 3355e1013ebdaa264669ad4f4cb3e954f56cde297fa3c01729201c33a81179f82b04bb9876075fd5c85d365c1ca5aa4127ef9e1a1e7ea2a0721d226a4744cad5
SSDEEP 3072:1N+8nuHLBDdReAZirYDodNbRuHAQXJxfAGavCM306UOGEqGfL8mLJjs2BCF:1A2GL80isHAQXr4ZlTFqgImLhs6CF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Monoxidex64.exe.vir

Path C:\Users\Admin\Downloads\Monoxidex64.exe.vir
Size 330KB
SHA256 ae9405b9556c24389ee359993f45926a895481c8d60d98b91a3065f5c026cffe
MD5 692361071bbbb3e9243d09dc190fedea
SHA1 04894c41500859ea3617b0780f1cc2ba82a40daf
SHA512 cfdd627d228c89a4cc2eac27dcdc45507f1e4265eff108958de0e26e0d1abe7598a5347be77d1a52256de70c77129f1cd0e9b31c023e1263f4cf04dbc689c87e
SSDEEP 3072:7/yvAAdLz9aha9RMXtdf+IBC2nQ4oUehONFlT7vJ333AlOi9E3AAqgm:z6dLzgiMXzBTJTDqlOi9E3AAqgm
MD5 SHA1 SHA512 SSDEEP

Submit Download