chaos | f9197ec99fb6cfccca9b5ad6af20c455f7e0b5cf15c9baf197164b2e6f7bfe78

Analysis

max time kernel
169s
max time network
304s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

media_images_grubyptok.jpg
Size

149KB
MD5

26a2c7b4bddada15f52a82e4b8a1a4a1
SHA1

12d0ffae14529df8e771db4fff4e13b6ba56008d
SHA256

f9197ec99fb6cfccca9b5ad6af20c455f7e0b5cf15c9baf197164b2e6f7bfe78
SHA512

b99c657f18d79b8154752d4c995d8c768bffd6a0358eb5be7c2cff9d26dd2946c59c64fd91d70fe8cb3417dd129d288c474626bebceb6b54d8566cb0c5d469c5
SSDEEP

3072:C2GgAUugk4mxDZnm1u6PMJW+vvRo/tx5vKqR/V+UyTA05ydd:CzLJxDZn2u94+vG/tx5yqZV+UyTA05e

Score

10^/10

chaos bootkit defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan upx

Malware Config

Signatures

Chaos
Ransomware family first seen in June 2021.
ransomware chaos

Chaos Ransomware 5 IoCs

resource	yara_rule
behavioral1/files/0x000400000001d67f-262.dat	family_chaos
behavioral1/memory/1836-267-0x0000000000FF0000-0x0000000001010000-memory.dmp	family_chaos
behavioral1/memory/2456-273-0x0000000000B70000-0x0000000000B90000-memory.dmp	family_chaos
behavioral1/memory/1736-340-0x0000000000400000-0x00000000005D5000-memory.dmp	family_chaos
behavioral1/memory/1736-346-0x0000000000400000-0x00000000005D5000-memory.dmp	family_chaos

Chaos family
chaos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2064	bcdedit.exe
2684	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
560	wbadmin.exe

Disables Task Manager via registry modification
evasion

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\covid29-is-here.txt	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2768	mbr.exe
1836	Cov29Cry.exe
2456	svchost.exe
1720	Cov29LockScreen.exe

Loads dropped DLL 5 IoCs

pid	Process
2144	cmd.exe
2144	cmd.exe
2144	cmd.exe
2144	cmd.exe
2144	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs

Web Service

T1102

flow	ioc
105	raw.githubusercontent.com
118	raw.githubusercontent.com
130	raw.githubusercontent.com
131	raw.githubusercontent.com
103	raw.githubusercontent.com
119	raw.githubusercontent.com
121	raw.githubusercontent.com
124	raw.githubusercontent.com
125	raw.githubusercontent.com
101	raw.githubusercontent.com
122	raw.githubusercontent.com
123	raw.githubusercontent.com
129	raw.githubusercontent.com
102	raw.githubusercontent.com
106	raw.githubusercontent.com
107	raw.githubusercontent.com
120	raw.githubusercontent.com
126	raw.githubusercontent.com
127	raw.githubusercontent.com
132	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	mbr.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvd6ngqq4.jpg"	svchost.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-187-0x0000000000400000-0x00000000005D5000-memory.dmp	upx
behavioral1/memory/1736-340-0x0000000000400000-0x00000000005D5000-memory.dmp	upx
behavioral1/memory/1736-346-0x0000000000400000-0x00000000005D5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrojanRansomCovid29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cov29LockScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2544	PING.EXE
3064	PING.EXE

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2268	vssadmin.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
108	taskkill.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
1356	reg.exe
2548	reg.exe
2312	reg.exe
696	reg.exe
2792	reg.exe
2984	reg.exe
2892	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2544	PING.EXE
3064	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2456	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1836	Cov29Cry.exe
2456	svchost.exe
2456	svchost.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1504	shutdown.exe
Token: SeRemoteShutdownPrivilege	1504	shutdown.exe
Token: SeDebugPrivilege	1836	Cov29Cry.exe
Token: SeDebugPrivilege	2456	svchost.exe
Token: SeBackupPrivilege	2152	vssvc.exe
Token: SeRestorePrivilege	2152	vssvc.exe
Token: SeAuditPrivilege	2152	vssvc.exe
Token: SeDebugPrivilege	108	taskkill.exe
Token: SeIncreaseQuotaPrivilege	548	WMIC.exe
Token: SeSecurityPrivilege	548	WMIC.exe
Token: SeTakeOwnershipPrivilege	548	WMIC.exe
Token: SeLoadDriverPrivilege	548	WMIC.exe
Token: SeSystemProfilePrivilege	548	WMIC.exe
Token: SeSystemtimePrivilege	548	WMIC.exe
Token: SeProfSingleProcessPrivilege	548	WMIC.exe
Token: SeIncBasePriorityPrivilege	548	WMIC.exe
Token: SeCreatePagefilePrivilege	548	WMIC.exe
Token: SeBackupPrivilege	548	WMIC.exe
Token: SeRestorePrivilege	548	WMIC.exe
Token: SeShutdownPrivilege	548	WMIC.exe
Token: SeDebugPrivilege	548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	548	WMIC.exe
Token: SeRemoteShutdownPrivilege	548	WMIC.exe
Token: SeUndockPrivilege	548	WMIC.exe
Token: SeManageVolumePrivilege	548	WMIC.exe
Token: 33	548	WMIC.exe
Token: 34	548	WMIC.exe
Token: 35	548	WMIC.exe
Token: SeIncreaseQuotaPrivilege	548	WMIC.exe
Token: SeSecurityPrivilege	548	WMIC.exe
Token: SeTakeOwnershipPrivilege	548	WMIC.exe
Token: SeLoadDriverPrivilege	548	WMIC.exe
Token: SeSystemProfilePrivilege	548	WMIC.exe
Token: SeSystemtimePrivilege	548	WMIC.exe
Token: SeProfSingleProcessPrivilege	548	WMIC.exe
Token: SeIncBasePriorityPrivilege	548	WMIC.exe
Token: SeCreatePagefilePrivilege	548	WMIC.exe
Token: SeBackupPrivilege	548	WMIC.exe
Token: SeRestorePrivilege	548	WMIC.exe
Token: SeShutdownPrivilege	548	WMIC.exe
Token: SeDebugPrivilege	548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	548	WMIC.exe
Token: SeRemoteShutdownPrivilege	548	WMIC.exe
Token: SeUndockPrivilege	548	WMIC.exe
Token: SeManageVolumePrivilege	548	WMIC.exe
Token: 33	548	WMIC.exe
Token: 34	548	WMIC.exe
Token: 35	548	WMIC.exe
Token: SeBackupPrivilege	1740	wbengine.exe
Token: SeRestorePrivilege	1740	wbengine.exe
Token: SeSecurityPrivilege	1740	wbengine.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2804	rundll32.exe
2804	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1720	Cov29LockScreen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2144	1736	TrojanRansomCovid29.exe	61
PID 1736 wrote to memory of 2144	1736	TrojanRansomCovid29.exe	61
PID 1736 wrote to memory of 2144	1736	TrojanRansomCovid29.exe	61
PID 1736 wrote to memory of 2144	1736	TrojanRansomCovid29.exe	61
PID 2144 wrote to memory of 1636	2144	cmd.exe	63
PID 2144 wrote to memory of 1636	2144	cmd.exe	63
PID 2144 wrote to memory of 1636	2144	cmd.exe	63
PID 2144 wrote to memory of 1636	2144	cmd.exe	63
PID 2144 wrote to memory of 2544	2144	cmd.exe	64
PID 2144 wrote to memory of 2544	2144	cmd.exe	64
PID 2144 wrote to memory of 2544	2144	cmd.exe	64
PID 2144 wrote to memory of 2544	2144	cmd.exe	64
PID 2144 wrote to memory of 2892	2144	cmd.exe	65
PID 2144 wrote to memory of 2892	2144	cmd.exe	65
PID 2144 wrote to memory of 2892	2144	cmd.exe	65
PID 2144 wrote to memory of 2892	2144	cmd.exe	65
PID 2144 wrote to memory of 1356	2144	cmd.exe	87
PID 2144 wrote to memory of 1356	2144	cmd.exe	87
PID 2144 wrote to memory of 1356	2144	cmd.exe	87
PID 2144 wrote to memory of 1356	2144	cmd.exe	87
PID 2144 wrote to memory of 2548	2144	cmd.exe	67
PID 2144 wrote to memory of 2548	2144	cmd.exe	67
PID 2144 wrote to memory of 2548	2144	cmd.exe	67
PID 2144 wrote to memory of 2548	2144	cmd.exe	67
PID 2144 wrote to memory of 2312	2144	cmd.exe	68
PID 2144 wrote to memory of 2312	2144	cmd.exe	68
PID 2144 wrote to memory of 2312	2144	cmd.exe	68
PID 2144 wrote to memory of 2312	2144	cmd.exe	68
PID 2144 wrote to memory of 696	2144	cmd.exe	69
PID 2144 wrote to memory of 696	2144	cmd.exe	69
PID 2144 wrote to memory of 696	2144	cmd.exe	69
PID 2144 wrote to memory of 696	2144	cmd.exe	69
PID 2144 wrote to memory of 2792	2144	cmd.exe	70
PID 2144 wrote to memory of 2792	2144	cmd.exe	70
PID 2144 wrote to memory of 2792	2144	cmd.exe	70
PID 2144 wrote to memory of 2792	2144	cmd.exe	70
PID 2144 wrote to memory of 2984	2144	cmd.exe	71
PID 2144 wrote to memory of 2984	2144	cmd.exe	71
PID 2144 wrote to memory of 2984	2144	cmd.exe	71
PID 2144 wrote to memory of 2984	2144	cmd.exe	71
PID 2144 wrote to memory of 2768	2144	cmd.exe	72
PID 2144 wrote to memory of 2768	2144	cmd.exe	72
PID 2144 wrote to memory of 2768	2144	cmd.exe	72
PID 2144 wrote to memory of 2768	2144	cmd.exe	72
PID 2144 wrote to memory of 1836	2144	cmd.exe	73
PID 2144 wrote to memory of 1836	2144	cmd.exe	73
PID 2144 wrote to memory of 1836	2144	cmd.exe	73
PID 2144 wrote to memory of 1836	2144	cmd.exe	73
PID 2144 wrote to memory of 1504	2144	cmd.exe	74
PID 2144 wrote to memory of 1504	2144	cmd.exe	74
PID 2144 wrote to memory of 1504	2144	cmd.exe	74
PID 2144 wrote to memory of 1504	2144	cmd.exe	74
PID 2144 wrote to memory of 3064	2144	cmd.exe	76
PID 2144 wrote to memory of 3064	2144	cmd.exe	76
PID 2144 wrote to memory of 3064	2144	cmd.exe	76
PID 2144 wrote to memory of 3064	2144	cmd.exe	76
PID 1836 wrote to memory of 2456	1836	Cov29Cry.exe	77
PID 1836 wrote to memory of 2456	1836	Cov29Cry.exe	77
PID 1836 wrote to memory of 2456	1836	Cov29Cry.exe	77
PID 2456 wrote to memory of 1152	2456	svchost.exe	79
PID 2456 wrote to memory of 1152	2456	svchost.exe	79
PID 2456 wrote to memory of 1152	2456	svchost.exe	79
PID 1152 wrote to memory of 2268	1152	cmd.exe	81
PID 1152 wrote to memory of 2268	1152	cmd.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\media_images_grubyptok.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:2
1⤵
PID:3044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2248 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2028 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2680

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=980 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:2
1⤵
PID:2072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --mojo-platform-channel-handle=1180 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3416 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3436 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3448 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3768 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --mojo-platform-channel-handle=3432 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --mojo-platform-channel-handle=656 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --mojo-platform-channel-handle=2428 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=1052 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:1528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=2388 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3480 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=704 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=1124 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:1080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=3432 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=852 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:1536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4228 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2840

C:\Users\Admin\Downloads\Covid29 Ransomware\TrojanRansomCovid29.exe
"C:\Users\Admin\Downloads\Covid29 Ransomware\TrojanRansomCovid29.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\8621.tmp\TrojanRansomCovid29.bat" "
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8621.tmp\fakeerror.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1636
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2544
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2892
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1356
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2548
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2312
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:696
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2792
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2984
- - C:\Users\Admin\AppData\Local\Temp\8621.tmp\mbr.exe
    mbr.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:2768
- - C:\Users\Admin\AppData\Local\Temp\8621.tmp\Cov29Cry.exe
    Cov29Cry.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Drops desktop.ini file(s)
      Sets desktop wallpaper using registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2456
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1152
      - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:2268
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:548
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        5⤵
        
        PID:2912
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:2064
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled no
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:2684
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        5⤵
        
        PID:2184
      - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete catalog -quiet
        6⤵
        Deletes backup catalog
        
        PID:560
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\covid29-is-here.txt
        5⤵
        
        PID:2840
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 300 /c "5 minutes to pay until you lose your data and system forever"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 9
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:108
- - C:\Users\Admin\AppData\Local\Temp\8621.tmp\Cov29LockScreen.exe
    Cov29LockScreen.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Covid29 Ransomware\covid29-is-here.txt
1⤵
PID:2452

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1356

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2364

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --mojo-platform-channel-handle=2304 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4144 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=3892 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4272 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4404 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4428 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --mojo-platform-channel-handle=4476 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:1804

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --mojo-platform-channel-handle=3576 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:1992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --mojo-platform-channel-handle=4240 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --mojo-platform-channel-handle=4364 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --mojo-platform-channel-handle=3656 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3464 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:3032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --mojo-platform-channel-handle=2692 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:1072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2480 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:2408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4708 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:1212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4816 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --mojo-platform-channel-handle=4796 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --mojo-platform-channel-handle=4428 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:1560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --mojo-platform-channel-handle=4840 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:1492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --mojo-platform-channel-handle=1984 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:1836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --mojo-platform-channel-handle=4416 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2596

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --mojo-platform-channel-handle=4468 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --mojo-platform-channel-handle=4296 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:2128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --mojo-platform-channel-handle=2712 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --mojo-platform-channel-handle=3392 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --mojo-platform-channel-handle=4476 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:1
1⤵
PID:1716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4436 --field-trial-handle=1196,i,10888235151112437218,9818211115556716089,131072 /prefetch:8
1⤵
PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
62KB

MD5
e5fc91cbce096df1d36191f9eedd3c64

SHA1
1a8076bf524b6d2b8a44c18fa8afb199a60dc1c9

SHA256
0e111dba5797ec182bf4af537a2c928ebd3957b99ed291610fbf322d6c2c9e19

SHA512
c9b064fbcb2df48dcf5bfa4387c164acb2bae075af013e6c39166dddc7e91ce993caaa0fdfac3ba1c3a12ca6c21577d99776fb1445f3009c7359b926a173f668

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
38KB

MD5
d4586933fabd5754ef925c6e940472f4

SHA1
a77f36a596ef86e1ad10444b2679e1531995b553

SHA256
6e1c3edffec71a01e11e30aa359952213ac2f297c5014f36027f308a18df75d2

SHA512
6ce33a8da7730035fb6b67ed59f32029c3a94b0a5d7dc5aa58c9583820bb01ef59dd55c1c142f392e02da86c8699b2294aff2d7c0e4c3a59fce5f792c749c5ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
24KB

MD5
87c2b09a983584b04a63f3ff44064d64

SHA1
8796d5ef1ad1196309ef582cecef3ab95db27043

SHA256
d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0

SHA512
df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

Filesize
72KB

MD5
7c244372e149948244157e6586cc7f95

SHA1
a1b4448883c7242a9775cdf831f87343ec739be6

SHA256
06e6095a73968f93926a0a5f1e7af9d30ecca09c94c8933821ca0e45732161ed

SHA512
4ce4d73b785acde55a99f69ea808a56dec69df3bb44ac0d049c243fc85544db4c020412634da52a069b172e2484a6f2c36799e38adbfb988bcb5703fd45b3601

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f

Filesize
410KB

MD5
cd04cb54ea43a2fdb442dd710b177548

SHA1
e5901e351150813f65425e39a21836fe9ff0393e

SHA256
05ff3273299b89e0e3d52ce31cc13da80627054c58bd54f9a3b7be717701a7b5

SHA512
924a2344b976087f9c39650084cce1dd7e775234acdadb87408249abb55b1afc4ad136d695af716e37318cdaea74b74ffbfc2aea5657b4fd86545e7ee8aab3eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024

Filesize
20KB

MD5
0c09ecadc992eb2eacc5746e1e1344f5

SHA1
472bf3982b7f0c032d340ba3d2dd98136bd7f783

SHA256
b96a585f43a2cfcb2991f151c4cd786d9dc4cd4a0604815d9caae0c39b769b92

SHA512
15a5bf7c85efddc3af852fb77238889249e2cbd9c22e439d79ed39881eddd3fce3506f5911cf7e933f4a3baeefa0a74de211cd92c67934342ead4b4c58a53c22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025

Filesize
48KB

MD5
c516fc64c2ce2da54e42fa31bd5e663a

SHA1
91323242547fb20ba7c4751ba23469907dcf38e3

SHA256
23625b65966e0e7aee05db5af64384107139cfb3b23783e51e2d98bd6b7c8921

SHA512
69b802c19e43c72d0ba03b12ea31b9a4034073ef7cd9db7c6bf1ba649a927abc99ad08655c78bc9ce380a6ee48442533ad23ac44e2728252f040a20b598f7296

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

Filesize
98KB

MD5
3338260f53e2ef61c463bf1de1d8f25f

SHA1
d4476b55cab4b67061f8ac31a532c8b0f4834c2c

SHA256
e1ab6e425d73b68e9bf5dcdfee88292348156109ebbecc24a4e9935cfb11c333

SHA512
838cfb78e0dec497fc65b1c08b20714e42dd5bc575fb48beaeb821854e4ccca530b7e7252ddd5275a67f02ad8f538d78ff0f1f6e9a4099613de6c0bf48261638

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027

Filesize
612KB

MD5
c13a4abe06af6a47d5e62517fcd4915b

SHA1
a2ae312b8e96890ae55f56c73e4e4c1afa96685c

SHA256
c0e700686718ba247defdde0846e7e45f7c2afe880e4ac520373094089cf2d36

SHA512
442b611fb1a9b330e15ef1c37ea42b1479861668a9e4233f27d6faa135ed8a20dbe9dc600cca519167897994cd03669dd2d980e3aca6f75bb3498be0917a3545

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
32KB

MD5
62648e6e3910199480832b555c8418a8

SHA1
870b6a7bb756b92f3499a20f3d3fea6b320b25ab

SHA256
8631d292e0c4e26adb84ef6a8635aac042ca4615b3fb2c610c66581093ccf274

SHA512
196bfbbd286b7567480513201df291e2295eaaa361ad77620a63fb97b2e657dcac50b34ddbda274a8070385d15359b58b8140f72e38e77ad78e01b543168c401

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003f

Filesize
170KB

MD5
f21cdad7ae3a08a915c0de7fc7821787

SHA1
9477fab65713d21154c98fa69c332ceb8fbde70a

SHA256
cfd624fb5b021c5972dd18599c93d8dbf5ec7d95f95b335e48f0a1d3929f95ad

SHA512
21bc7baf0fa69a090272208e7fac4a7bf4dc6166fa8bc58b68435a3408283b3924f8ca9d0f1d190f7f710813cbd0d59acbcd78eb09e7d236172984d8a36269a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000040

Filesize
132KB

MD5
4410e761d2a76f4fd5f470c04496061b

SHA1
81e3116bdd7dbb243078344d8b33751282745aab

SHA256
7bb1458565c93f6aeaaba0007462c1ae363ed83f31c8c8950d623debf63dca24

SHA512
2d5543ba26166745210c8ea8ec454e280ee5599d391900545d3a087fb1d7375b1d509c302246bd4f4f18906215df7976393dcfaabaaef0499f46f1c95911f711

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000041

Filesize
33KB

MD5
989ea4bdf915114a4082307b3daf3a70

SHA1
fa12c215e109a77346af8a2ae74a194ad04e12e2

SHA256
9ffd00d7dcbd5d4eff10539b32ca2b2ef593463fb00356519bc8a4e294d0d188

SHA512
52b0ceecdf5b3fde65bd0e3cd6297a785ce00a487d2d8d071df0b5a7d79a5adb6f16ac95ffda8d621de81d6f3562d69225dd748331c82d40b0c1a5b592233408

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000053

Filesize
16KB

MD5
5830feed3e34072f13cdbb9c3d433a5a

SHA1
f2f9f9b1912cedb68aca907f320abecdf8303513

SHA256
1e6d79f76ccab623a4f200df039f9f70c02a61f41fd9475f5dbda5a4fc2ff96a

SHA512
009536aeddbb09f2e21cd8c0adaa4bece6c96399f73f93e0cb73919f80c79c959d6c0184636afc56ee197cade57d7d02b9f19a59e18d8b94618dd6c141720515

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000054

Filesize
20KB

MD5
9ab049e4fa2e057058b33715b6caeae5

SHA1
16958cdc71f415bdec24f1359e40f66c4960c767

SHA256
d147489e927ae1eacc5ab01c03e52653593dbc4bf7112c040ce26c370cb6b2d8

SHA512
efedf364b2601eb5e7369f5e2a2b359ac83908a1cd07bbc10e52b76bfccd3339bfa6f4cd5c9f55bf934f477a12da878f3de07971109fbaef341592ef6a62ae70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b

Filesize
47KB

MD5
015c126a3520c9a8f6a27979d0266e96

SHA1
2acf956561d44434a6d84204670cf849d3215d5f

SHA256
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

SHA512
02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
5ae2a51d6dea604d27b451cdf01c7ffb

SHA1
0a585912c953b571716a60508907fee946a5b460

SHA256
31c009cf36bd85e949d8db3a2c9742bf28b44dca8cfdf407fa73e111a4155df6

SHA512
94c83e649c2aeefa04bc5b3a8b855828cc8fb28209f789a13e2fd1203a130db6fa1b4e324ad04fd2e792fc2a9fbaa1e9e2d6b665e57962460e5ed43bd51b88e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
d627b13a6a4c6d1f970f62f91e69bab1

SHA1
72747e03e269e5ed4dd087cd616b6bfc90c3f6b5

SHA256
322b0f059496663f0b47377029352d23c5f39d821cc90b335234a98ec7ba6451

SHA512
cfc33ec391f813f5961996b35ab8749ca23d68f54e7bbd39fbf589a13ba346f24660d6fc9e5eaa56ae21dab3f106bd89193131b2b92693930b42207bf6cc35aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
e1c1b95d0a4a1e6c5bb882514af2b759

SHA1
d512e36c06f497ce39f649c5e80f4f622a4b4ebd

SHA256
f48b8e107aec14f345bda0be41e92071837f04e8d416344316a9e6852c1e8943

SHA512
7d8cc49204e4bcd0e55a62ae922edf9fed31785b51e63788be5b4079e0716314ef82f1e6fe29b629dc908b239eb20f0606bc203140f21625eba2888e0ef2722d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1017B

MD5
b1f26e1d28db7808729eb541aa10b270

SHA1
ff11f084a9172e113b1c218df4a4c3b94d2d2f38

SHA256
a75ce0d119fc4bd89b69d207f7bac79d880ff23ce260b375cba328fdacb86f30

SHA512
74f19b0b083a007156a726478aec793c215dffe8bcb4a3fbe0b124c50c22c01f96b91c13fbeee4dcaf7d533f365fe076874f97a6ce4b8bc9c7ab530aa01a5239

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
854B

MD5
c1ffa9e200ac1f061efacf25d56882aa

SHA1
07b689b192a236a6fdd88c897fc218c376f47359

SHA256
9ed68ec30edf137178ba87956b9d1f3afc41e9e8877acba5b20b575240f8a786

SHA512
8c648c3e2da28265b1c3184fb147d9f4c4277be2f6a38439981a11dbcd8b9c417c322d83f49f7dc669d5323621778eb603cbf87283476b982a68df29c847aa34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bdbe4623a0777f6bde654f070b5a9123

SHA1
4edad77cb9ac06248d2bd8e254998849c668f88c

SHA256
51a8d7cf7b3528eb31dce4f7960a684dfa637af4c99e95eff9c1a50e57ac478d

SHA512
fb4b6c455a343c93789f582d50762794eab960edeeafdd14b1805b6734b219fda9250b8088ab3deefd77dfe9c59865a71b421b3aae4763f208cf2a6c4e1ee85d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
af88c87b587a03f5e168e959b249c6b8

SHA1
d27edb4348e07621a6e14566fe60b5116fe326a4

SHA256
c750224a30f37aff6b7a7d107d57cd2b8499f143f1d820cef155fbf78fb7aa80

SHA512
5937e481f6329e02e22af9b1cdecc28ff4f6050637092cc7f202d4e9e9a44f5755b620a5ad0be283ea7727e92bd78a6e8be45e428b9c2853b79d6f667b8c9789

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
527B

MD5
708500c70673e243ede0c6cb9e11a3a3

SHA1
75020f41370ed080f4a94d3ba56b4b0d3cf698db

SHA256
1b49e39b311258de351ec338ecd954549c34b79a51c547d4b30ea92bf424c843

SHA512
1928eba5f00e01489a5a97ab02002e9be588c00532fc7fab37147351ee56f9aebee825792cf4353871b941decb30a7f714405189cac5cd1e742a08e70cf68eed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
527B

MD5
356d22084f4c54d3d7d84ac2b538ab62

SHA1
43a7aa73e34818daf97cf21c1dc9998db10967a6

SHA256
560fe830d37c35acd687501a5f19e2bfceb15854e96155133ca606c050916c15

SHA512
4703973241992043376ad2097664cb2960fad99797dfa88e6076fa46ba82fc11e23972a3de798370b7f9bc85decaabd40fdf6308ca67ab0723b0f32f6687a4ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1013B

MD5
0aa303c24009e28865b29604975e7f91

SHA1
905facc3b5b1c58a04db41b7144742c5978b798c

SHA256
2d271f6c678bf77f44731d9b3082723846c0f92ee72e96d7fddd073b30d76823

SHA512
41fc5a40386c3d7db3884c24966bb5b454b480b84bde0b7bfe37c9dc64232e3fa5035a06bb57a5b4aa24b9964164127c4b0a24dbdc7239068995ab9b79d4b990

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f3e20d22cef04138dd7485f2c586af1c

SHA1
45ca7f19ad26132b6d3fefbd95fe238b88210c8c

SHA256
ed315c67285a12be84098ac698db54009992a8ffc2d0ef60bb464095dd3a3733

SHA512
bef60f9f616922df6f1d1a40e3d062d5c0a57d13d851abd0a2b3a4958f43dc6e6849dd0233c09bd10d2641de91da3b38525dccb8fb74e33940f5e1cbf5b8d758

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
5dac77189fa7fc2c18fec8a709482657

SHA1
dbc68872fd23986a2b292f9daf25d85fdd9907dd

SHA256
578f0df9f8fe462f55edf3144e19c878c60ee21487350f4c701b07fa44b1ef01

SHA512
43f16046294be018449d47746fe7642748b43cb093b1c7ef1b482a5fc03c055362bb767b9a3503c8eacf24f809fa6b0949c40e489b1cdfcedab03bdb3f38a7f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1017B

MD5
700de06642fb6cad39438c4a3e46d265

SHA1
b9e339fb98c0e50f660260d7e1f1317629536254

SHA256
8796d2fc066da5feeecd5657c4ba6f95208c3f6f855f8ec3c657a814a264964a

SHA512
6872f5ac05781b8136187d93e22996c46b65111084a4beb4ede2042080a0a23d992f7eda175f2a9b5aa4e5ee271779f6d87955a276dae9c1159cddf98ae1e5d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1017B

MD5
0f59ad3d580d05c9aaacc4e8d0bf96fd

SHA1
a75827338e8a700cf33612b9b4e0e628a029963e

SHA256
734c3e66a76b3e9b1fd485fba49b6eefaac329389bdc9d4820bcfd680ab33191

SHA512
4cbf94ae71b24c755c44b70c9427c2f51b7d83aadf957d701f80fd9c8e2d7b30ab376ed057e035b79c897bb7b35b23a9561bda62f57c3b07b90e1a05221666f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1017B

MD5
7521b39111f56def7d88d4a07e443daa

SHA1
fb0f48ee377002eae8a0bd54c260164e94b643bd

SHA256
5b45cabf333cd697dbb8d8ffb94f6ae8f4c2a53889467ed277cd72c3a8388895

SHA512
d09a25f72f63534da994f987c0cb70dc7cf9f3f6b30b1986d32a4fed929b3984536a0472b80dcb37386a38982c4629487eb6916be2dd8b6a983518c7b25a13b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\8621.tmp\TrojanRansomCovid29.bat

Filesize
1KB

MD5
57f0432c8e31d4ff4da7962db27ef4e8

SHA1
d5023b3123c0b7fae683588ac0480cd2731a0c5e

SHA256
b82e64e533789c639d8e193b78e06fc028ea227f55d7568865120be080179afc

SHA512
bc082486503a95f8e2ce7689d31423386a03054c5e8e20e61250ca7b7a701e98489f5932eba4837e05ec935057f18633798a10f6f84573a95fcf086ee7cabcbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\8621.tmp\fakeerror.vbs

Filesize
144B

MD5
c0437fe3a53e181c5e904f2d13431718

SHA1
44f9547e7259a7fb4fe718e42e499371aa188ab6

SHA256
f2571f03eb9d5ee4dca29a8fec1317ded02973c5dd233d582f56cebe98544f22

SHA512
a6b488fc74dc69fc4227f92a06deb297d19cd54b0e07659f9c9a76ce15d1ef1d8fa4d607acdd03d30d3e2be2a0f59503e27fc95f03f3006e137fa2f92825e7e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\8621.tmp\mbr.exe.danger

Filesize
1.3MB

MD5
35af6068d91ba1cc6ce21b461f242f94

SHA1
cb054789ff03aa1617a6f5741ad53e4598184ffa

SHA256
9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e

SHA512
136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

Download Submit
C:\Users\Admin\Desktop\covid29-is-here.txt

Filesize
861B

MD5
c53dee51c26d1d759667c25918d3ed10

SHA1
da194c2de15b232811ba9d43a46194d9729507f0

SHA256
dd5b3d185ae1809407e7822de4fced945115b48cc33b2950a8da9ebd77a68c52

SHA512
da41cef03f1b5f21a1fca2cfbf1b2b180c261a75d391be3a1ba36e8d4d4aefab8db024391bbee06b99de0cb0b8eb8c89f2a304c27e20c0af171b77db33b2d12c

Download Submit
\Users\Admin\AppData\Local\Temp\8621.tmp\Cov29Cry.exe

Filesize
103KB

MD5
8bcd083e16af6c15e14520d5a0bd7e6a

SHA1
c4d2f35d1fdb295db887f31bbc9237ac9263d782

SHA256
b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

SHA512
35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

Download Submit
\Users\Admin\AppData\Local\Temp\8621.tmp\Cov29LockScreen.exe

Filesize
48KB

MD5
f724c6da46dc54e6737db821f9b62d77

SHA1
e35d5587326c61f4d7abd75f2f0fc1251b961977

SHA256
6cde4a9f109ae5473703c4f5962f43024d71d2138cbd889223283e7b71e5911c

SHA512
6f83dd7821828771a9cae34881c611522f6b5a567f5832f9e4b9b4b59bf495f40ad78678bd86cba59d32ea8644b4aa5f052552774fea142b9d6da625b55b6afc

Download Submit
memory/1736-346-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/1736-187-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/1736-340-0x0000000000400000-0x00000000005D5000-memory.dmp

Filesize
1.8MB

Download
memory/1836-267-0x0000000000FF0000-0x0000000001010000-memory.dmp

Filesize
128KB

Download
memory/2456-273-0x0000000000B70000-0x0000000000B90000-memory.dmp

Filesize
128KB

Download
memory/2768-263-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2804-0-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download