bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

Analysis

user interaction
yes
max time kernel
167s
max time network
169s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42-password-42.zip
Size 41KB
Sample260417-wfxtesew4p
SHA256 bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
MD5 1df9a18b18332f153918030b7b516615
SHA1 6c42c62696616b72bbfc88a4be4ead57aa7bc503
SHA512 6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
SSDEEP 768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK
TLSH
T12E13D028061AD50DEAC0CA78F3FE431F5B322E575F6D9AA5CD6D90968C14D803EB660F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
74	camo.githubusercontent.com
72	raw.githubusercontent.com
75	camo.githubusercontent.com
76	camo.githubusercontent.com
77	camo.githubusercontent.com
89	raw.githubusercontent.com
15	raw.githubusercontent.com
43	camo.githubusercontent.com
73	camo.githubusercontent.com

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
444	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209220652378651"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\42-passwordless.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe
Token: SeShutdownPrivilege	224	chrome.exe
Token: SeCreatePagefilePrivilege	224	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe
224	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 5080	224	chrome.exe	85
PID 224 wrote to memory of 444	224	chrome.exe	86
PID 224 wrote to memory of 1072	224	chrome.exe	87
PID 224 wrote to memory of 1072	224	chrome.exe	87
PID 224 wrote to memory of 2012	224	chrome.exe	88
PID 224 wrote to memory of 2012	224	chrome.exe	88
PID 224 wrote to memory of 1020	224	chrome.exe	89
PID 224 wrote to memory of 1976	224	chrome.exe	90
PID 224 wrote to memory of 1020	224	chrome.exe	89
PID 224 wrote to memory of 1976	224	chrome.exe	90
PID 224 wrote to memory of 5096	224	chrome.exe	91
PID 224 wrote to memory of 5096	224	chrome.exe	91
PID 224 wrote to memory of 776	224	chrome.exe	94
PID 224 wrote to memory of 776	224	chrome.exe	94
PID 224 wrote to memory of 1488	224	chrome.exe	95
PID 224 wrote to memory of 3720	224	chrome.exe	97
PID 224 wrote to memory of 3720	224	chrome.exe	97
PID 224 wrote to memory of 2464	224	chrome.exe	98
PID 224 wrote to memory of 2464	224	chrome.exe	98
PID 224 wrote to memory of 4596	224	chrome.exe	99
PID 224 wrote to memory of 3064	224	chrome.exe	100
PID 224 wrote to memory of 1976	224	chrome.exe	101
PID 224 wrote to memory of 4328	224	chrome.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\42-password-42.zip
1⤵
PID:3240

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd63f5c728,0x7ffd63f5c734,0x7ffd63f5c740
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,7980377082848185335,10866123211186113654,524288 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1996 /prefetch:11
  2⤵
  - System Time Discovery
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,775714082583905184,8368617512857058814,262144 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,4869885402735331774,11439189924988254489,524288 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2396 /prefetch:13
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,16197986778760752236,12053057248868120273,2097152 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,3855737162762940167,10181088175736824083,2097152 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,11352291263150190573,14151029189278092981,2097152 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4268 /prefetch:9
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,4607074086356535443,2130115387764413379,2097152 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,15622423812652455721,5805534552487915704,524288 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5728,i,5002949849793411552,8822935176978044072,2097152 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3616,i,18202517823940943883,12193224532128883002,2097152 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=220,i,5697526632605357216,990555588868561362,524288 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,856059331294569646,5438249511840802214,524288 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,7572993297663259610,17655574989040362560,524288 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4344,i,1528345931304171151,14331831634531215295,524288 --field-trial-handle=1952,i,1796161719802953240,3383587463704184646,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4368 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3024

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3840

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\E787293A-6B51-48C9-AC84-63C8849BBDB9\dismhost.exe
C:\Users\Admin\AppData\Local\Temp\E787293A-6B51-48C9-AC84-63C8849BBDB9\dismhost.exe {1434AAE8-8100-4FC5-9AAC-6298FD1BD03D}
1⤵
- Drops file in Windows directory
PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 93765f219199c5a0b637d9405b2eee710599a6492f308344f98c3bdab667fffd
MD5 abfe1cb2502e560e51308e17cfe267d2
SHA1 fea45ff7d3ed3d0f6cfd1559a64069ecf6396d53
SHA512 934fda8c3e11ec46f88a3a6f1f963d6878e1b5cf455cb82d4a2983cefe2605830e518085644c7c799c24db600925791092f1e101fa70b2548b142b6881e4a4ea
TLSH
T14EE02BAACC11993B0CFD271A60648A47EB5013572750489F3A3D420D4FB163B454585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9d65a1ffc4ef34f66fb610ad6ebe2dfe57e3550901a194b6093131438f80ed27
MD5 0056e6cbc9142f5ef386b5e49721f060
SHA1 208f8c432dca555debb9b3524422c1365a3d7722
SHA512 84c23cc71b3d4d83cff8b4cc1ea6573a9ddda4bcaa116d8ff641e631947c8b384a1bccf01bb0699c0e435a6efdb5bf8e0c25a8372aea1099300dcc87fdc4489c
SSDEEP 48:dyzDR7VChyU55y/PhvCblafu/8mbO9XBto0TVGaopxM7Eau4eB8pTiImFWs/8XS4:dyX1VCEU5OYEWoXBto0AUgq1iImg1E6
TLSH
T13181F642759BC342FB2538FC93C5AC17722D391E04CB3E1AFDCE447C49167998682A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 610b93e1546f12cf6888880cc6fd574799ae800969a04c1ca14bd54a99d46d5b
MD5 a16f24beb1bddbb6166ca54b354bd0bf
SHA1 fb754956cc5967bce8d39da2dc3d4b66d9489317
SHA512 8cb3a047f01c3432c815dd3743107cd8062d017f492f9b917498dc832d114f0e2091f3fb5023940c6abaadc0d61df64beb7f01de4d3f33c7c885c3bfd25a4aba
SSDEEP 192:D9KgitmQm8A4aIamT6+rZ7EAUm5pqmAmDmcHmgmtmSmmE:D9KgitmQm8A4aIamT6+rZ7EAUm5pqmAW
TLSH
T116E19FF7C3E5852DC91266F4AB15BF2FCE290614431C3C66C8D8AE5B93E2872E21135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 143abede42448fecfe45d977a5e3edcd70fb2e30edbd4beb86d9146bd136339f
MD5 d0b7b8c201b451137206c4f04bb150ba
SHA1 b36bf07a8f63706e76f18e33c467efb8fbb8abf1
SHA512 ec040b03e8b29d0b42fab9b5d6e82e0b46172e6737a5c367620d9db8f239c3ee5a934bda15e4997f2c3422185a00ea46acbd54d757b042ffb1435e9b64d9afb7
SSDEEP 192:oROcBzF6XaK1+Ldv7shAPRp2NQ80T9AHsb+WNtu8c14Mt2kNS2EDGHaFVyIsnAUp:oROmzF6edg8XB2wt852kI2MGCe
TLSH
T14352C62ABA24297F9CE6C22AF821B757E7F5102165C41EC4E6FC8E1C14EB9CD321B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9d044e3a0dfce94bd39403e0997d2706ff9897e73c698cf433341696d6d02517
MD5 4e4e2a16b0a37d39cb1027f96e31ecc1
SHA1 22bd7f1972884636ab718df0de4e47fd976caee2
SHA512 4a1a6d1477d80c3448385b5bd754294d85384b82f52ba7ce47591d26013e2b4638cd77f499681da0f736454bd701c0c0d450f8c3b1723fc7a2fd3d099b70b782
SSDEEP 192:oROcBzFn3q+LYNv7shAPRp2NQ8ugT9AHsb+WNtu8c14Mt2nS2EDGHaWVyIsnAUg8:oROmzF3BYtg8XVa2wt852S2MG78
TLSH
T1C352D62AB924297F5CE6C22AFC21B757E7F51021A5D11EC4E6FC8A1C14EB9CD321B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 452ab3b51043b14244868191785ce6450b04b0f2c230dbebdeaf79d5d90a8a46
MD5 ba2057874ea1f94087a197003b778534
SHA1 478dd9c39695029f70e645d936350200d2ae4c5f
SHA512 4afccd2ec9a3817f8fb4757e77498eaee9ea7466b7463290941bfcf494413a4c4fec28062e063f79600ce8fdf5a5558987c80439d86a9e1498e103ea3c70e581
SSDEEP 192:oR2Fn3q+yXv7shAPRp229AHsb+WNnc10XS2EDGHaWVyIsnAUgtaJ:oR2F3E/g8X92wU0C2MG78
TLSH
T14B42D62DBA14297F5CD6C22AFD61B753E7F5103160812EC4E6FC892C14EB9CD222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 46d84b179d15e5535b2b22db2bc43ce7f79f608762308849213d9e48e5f27ff9
MD5 edf7349db7107528b6fe887414789263
SHA1 5bc9ec39b980ee1dfee3594a2973b48d0ab88d4b
SHA512 dea9ae0c67c5c5559dcd7db28bef3a8df92722255c89f73f8573808af4403b8e2889487a00ff8ad5b92812319344ba4b1d375602937b3ab04b36ea850ebfcde6
SSDEEP 192:oROcBzZ6XaK1+Ldv7shAPRp2NQ80T9AHsb+WNtu8c14Mt2kNS2EDGHaFVyIsnAUp:oROmzZ6edg8XB2wt852kI2MGCe
TLSH
T19652C62ABA24297F9CE6C22AF821B757E7F5102165C41EC4E6FC8E1C15EB9CD321B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
MD5 191a425abbe14997e55d6c34d96395de
SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
TLSH
T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d3171acfa9199019caaf981e5a6fcdcd9b6872ddf230caffcbe76d79448991fe
MD5 b6c98b9f2a2d9df582442efcd76313ce
SHA1 41f52a7b4a4f240a816e888c9e5c40009a78055e
SHA512 080debec784caf67e517a39912295fcd475abaae6282287aa8d19f8e83a0630a214be5cb38b28a311222dae281d3f11c6730e2a5b003dcfed2c187bf720273d4
TLSH
T100B01250C8019501C84306B025D214C971145F24CB47230153E46EB2DA262E18014660
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c058.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c058.TMP
Size 96B
SHA256 b4fab49044a8bddbaa12e7f7b67e49a916567b31b2b20d2a870aa4d5cb0bc2ab
MD5 4c2c14ba2c7b89f1de7f7c54bd866025
SHA1 b814210b813e7895f2ff1e25a899be8a472069f6
SHA512 71b9b6f0bb3b608780db7f7e3e2fa61ea6d580c563e742a2a5da3708ec2bd0fa5fe37f24d6afbd5bcdfed95c464fdfddb985d989ae5719a58a58034c30056949
TLSH
T1E1B02200C002F302C00223B02A82AACC3020FF2AC203322383E02AA3CC2833002200A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 6eebe3edcadb78c4d841bf6a7fb5c23f47d41d2b0cd477cec930390ffb08d74d
MD5 b033a06d92c65b56e0e20a6ddbafceaf
SHA1 13642ad3fc3f5d9127e89165f8c8511510fdbda5
SHA512 0b91ded769812351bdc0d38d224be3daea1608a837c1eb02a39cc1515587262cd42d7c7959aa2083e6ed4cf54929f43cbab1db4d10ccde15e0fe65016a7a93af
SSDEEP 6144:WTnmv+u2o6AHeOT4SOa++JjcMW2VcVLl7:WT2+u/+OTvhOMWj7
TLSH
T1941412F85A2D7E63879AC2A1350F2D6E0DE29ECF453886B822461B4F147C3A35347C69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 34b9841acc5df67e53468a1e770cd60cd8ad7fb14e3e986d3450e0351deda0a3
MD5 6b1c7fbc61ac0407469953a7aaf3d1a0
SHA1 5303bffc01f96dfe7ead37e1ecc1a67366f8981e
SHA512 5c50835212ca698828f453e3c07a048dd7587cd884d735f3c819a464933ba4d8031ea7fbac495bbd3014bd6b760e59a23296a574767c9bfe84020ec94aeb03d8
SSDEEP 1536:4LYP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:g+++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1DA9312B9991E7D39636ED396A0179CAC8CD3DCCE151055BC30C76F0E14BA3A3A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 b6e0ba9cb113399485990982342166ab566266c83f91b09fd1a51ea411bc6467
MD5 bf125052af547c040eeca34176349388
SHA1 96defdc6bae29b41845b0452d095dc38fbdb5079
SHA512 c307ad8fa9ef9b3415dcd6804ce8a380513c32fe88589e2f79e6166a03eec4000ed2d384096bd6a347b2aadd95f0a067b455acda0d474bf4ca4ab151424d3137
SSDEEP 6144:DTnmv+u2o6AHeOT4SOa++JjcMW2VcVLl7:DT2+u/+OTvhOMWj7
TLSH
T1761412F85A2D7E63879ED2A1350F2D6E0DE29ECF453886B822461B4F147C3A35347C69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 46d81be7519d578b65f506698954a794f0baee485810d7d67ff6257db2e9e45f
MD5 48859da51091e132924259f6556a740d
SHA1 4f5cc9b8afb49655e00245bdfdd8d3f815e5c4a8
SHA512 b8b3e71312ec47232e3f9ed467e3060d81c30616ae0418e5fecf5a5b35a92fbcd595a456b86a1a3ccc72917f08f44bb18652b964dd6d1a9b3a69dca465f34fa7
SSDEEP 6144:DCnmv+u2o6AHeOT4SOa++JjcMW2VcVLl7:DC2+u/+OTvhOMWj7
TLSH
T1401412F85A2DBE638B6BC291350F2D2E0DE19ADF453896AC22461F4F047C3A79347C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42-passwordless.zip

Path C:\Users\Admin\Downloads\42-passwordless.zip
Size 41KB
SHA256 db6981082063dbb4bac89d27c41fbeb86d9e4a97b36661c0945b77a6b9bb0948
MD5 d9050d6ba1e86a0decc9262dd8f3038d
SHA1 1c403526e3a858775c88d113df46ecea85269964
SHA512 4858ee1b3f0a0aba5ac2640f07d3e449bf3afcea7fcb7fdca3d18881e5ecb38dac76d82498d47d9fb9d6b44a382ec2582bb35d7ddfe7acfe670518b0f68cbfda
SSDEEP 768:jGv8GvpGvjGvnGvAGv9GveGvrGvEGvMGv5GvqGv3GvQGvNGvf:ajES+Pwhq7T0Fu/gX
TLSH
T15E13F704A6272FB6E7B68027ABF8C40593CA56710B0D267877EB56A1FCEE0F15F0454E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42-passwordless.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\42-passwordless.zip:Zone.Identifier
Size 55B
SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
MD5 0f98a5550abe0fb880568b1480c96a1c
SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6
TLSH
T1CA900297040444480F5535C459DC9418B11E7554CD454688EC5140D6D98409D42E9416
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3380-694-0x0000000000B70000-0x0000000000B76000-memory.dmp

Download