Resubmissions
30/04/2026, 18:28
260430-w4my5acx3j319/04/2026, 06:51
260419-hmrdbsdz5r1019/04/2026, 03:57
260419-ejblxscs8j10Analysis
- user interaction
yes - max time kernel
899s - max time network
893s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/04/2026, 03:57
General
- Target Athrun is asutistic.zip
- Size 287KB
- Sample260419-ejblxscs8j
- SHA256 762a1cf7b64b1f415036e4f945614ff74a70315071bc8e4e7e5f60d4b351ab65
Score
10/10
Malware Config
Signatures
- Family: Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (801) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables Task Manager via registry modification
- Downloads MZ/PE file 4 IoCs
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Deletes itself 1 IoCs
- Drops startup file 5 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 64 IoCs
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 6 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies Internet Explorer settings 1 TTPs 64 IoCs
- Modifies Internet Explorer start page 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 13 IoCs
- NTFS ADS 9 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 48 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Athrun is asutistic.zip"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87512c728,0x7ff87512c734,0x7ff87512c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1912,i,12417333019335158874,12440330832721928192,524288 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2120 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,3205135025298904442,7547266773313227952,262144 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1996 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,17229904879718466838,6945574698965979320,524288 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2372 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,16640105435254974046,18304816937105275389,2097152 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,6002422741890741599,12190654730051694395,2097152 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,12406271448911737542,579223711168404493,2097152 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4264 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4660,i,13664904778429096887,8921000165570933185,2097152 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4680 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,13514022962890281727,4960011661024963796,524288 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5428 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,5318689499380531272,10399207402735988264,524288 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5780 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,12161300490273720401,13769697745516861584,524288 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5448 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,11004440107279859800,15993318115417322916,524288 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5764 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4264,i,11410767136752650480,14586401408734804044,2097152 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3220,i,11594592724213382657,1856591827396938514,2097152 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3428 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=872,i,9592979325210983708,9216807350954921160,262144 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3544 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,16589369163268549385,10609729732906114783,524288 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5716 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,10772926271706823138,14517983786683312090,524288 --field-trial-handle=2000,i,14961433727020738596,288244720922741275,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5772 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Artemis.zip\InstallBC201401.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Artemis.zip\InstallBC201401.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff87512c728,0x7ff87512c734,0x7ff87512c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1820,i,12178158054064950475,655627099928625063,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2012 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,15085115304823425088,6013289698209324046,262144 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=1980 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,13415850303341077500,13106343325580858063,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2304 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,10016389572261940969,9679960767669974906,2097152 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,8937106873589347572,13013332225105263540,2097152 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,17747083550305018335,8837148119694883129,2097152 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4464 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5248,i,15168776478228541464,10845457648325330538,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5252 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5320,i,17030060994675031316,11740939854192401212,2097152 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,16390540896620733216,11871034694936524102,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5640 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,3671712224620049928,12347627331008602446,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5776 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,8830274227270818994,13682933447133417515,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5736 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,8237811455882240536,270658166885222246,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5716 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,11801264834385582778,6139487632640866892,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5964 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=876,i,11578134776440621145,16908851685332594535,262144 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5256 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,919396430271268589,1695421152266276318,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5644 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5688,i,6817045147591152463,13802320006976739038,2097152 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=1480 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6228,i,6337192913860824066,8462565594358511208,2097152 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6496,i,17882391561716365577,9432164794847666591,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6152 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3388,i,1937224283920080749,2755101942372477494,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3376 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\Floxif.exe"C:\Users\Admin\Downloads\Floxif.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5508 -s 4563⤵
- Program crash
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6504,i,577506832621836682,5213458293426627550,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6740 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\$uckyLocker.exe"C:\Users\Admin\Downloads\$uckyLocker.exe"2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3344,i,18342209513476022940,11314257131947777716,2097152 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6472,i,14075978780846175946,17523908977330572163,2097152 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6680 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6844,i,15484549648101062825,5137918324289422299,2097152 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3296,i,16008912376083685649,400003322284764370,2097152 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6996,i,14350175300758122348,9682257827021315538,524288 --field-trial-handle=1984,i,13585834564599897538,13856869329772428957,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6484 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\CoronaVirus.exe"C:\Users\Admin\Downloads\CoronaVirus.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"3⤵
- Checks whether UAC is enabled
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Jigsaw.zip\jigsaw"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Jigsaw.zip\jigsaw3⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {adf3185a-ab56-4f02-a806-951dc8218a1e} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {eb7e2ba2-fb16-4a71-8950-acff712a3de9} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 27274 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {1c701617-055c-4ffd-8896-c70f0525fcd4} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3980 -prefsLen 27274 -prefMapHandle 3984 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {74fba3a8-3b8c-4bdd-ae32-34e05e45e0a6} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3220 -prefsLen 34773 -prefMapHandle 4416 -prefMapSize 270279 -jsInitHandle 2708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4280 -initialChannelId {dd70dabe-cd05-4456-a962-ab2892893990} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2888 -prefsLen 35010 -prefMapHandle 2892 -prefMapSize 270279 -ipcHandle 5028 -initialChannelId {9002f0c2-a876-4380-ae91-938c33f3ae90} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5704 -prefsLen 32952 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 5712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4904 -initialChannelId {15f0a7b5-2599-4a60-9e54-5b718da2d779} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5880 -prefsLen 32952 -prefMapHandle 5884 -prefMapSize 270279 -jsInitHandle 5888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5672 -initialChannelId {21ef6d81-1a9b-40f3-bc93-37fa559e6f2b} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1412 -prefsLen 32952 -prefMapHandle 2920 -prefMapSize 270279 -jsInitHandle 2924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6048 -initialChannelId {8d32b40e-8ab6-4363-b4c6-4817a95b6c2c} -parentPid 4356 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4356" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_W32.CodeRed.Worm.C.zip\I-Worm.CodeRed.TXT1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5508 -ip 55081⤵
-
C:\Windows\System32\CoronaVirus.exeC:\Windows\System32\CoronaVirus.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:10568 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:10568 CREDAT:17412 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
4Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
AppvIsvSubsystems32.dll.id-2DE60F9A.[[email protected]].ncov
search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
CrashpadMetrics-active.pma
settings.dat
8b0895ff-aa25-4dc8-8f3b-a88756ee7fd8.tmp
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000036
f_000055
the-real-index
the-real-index
the-real-index
the-real-index
data_1
LOG
Favicons
History
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Reporting and NEL
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
000003.log
LOG
the-real-index
the-real-index~RFe591860.TMP
000003.log
LOG
Tabs_13421044940543161
000003.log
LOG
LOG
Web Data
QuotaManager
QuotaManager-journal
f09f5bfb-141c-4044-9fb2-4f22c16e4813.tmp
000003.log
LOG
000003.log
LOG
data_1
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
data_1
Variations
metadata.json
e3267fe5-0e0b-48a5-825c-217e0b8ae504.tmp
ukm_db
Readme.txt
Setup.exe
Setup.ico
_Setup.dll
Kno4845.tmp
TsuB58A160F.dll
data.safe.tmp
data.safe.tmp
events
3ada9423-538f-43d5-b00c-a57c447ad990
3d33f82e-32bf-4308-8207-09a4b35dd425
63dd31d6-d807-42ac-aa5c-33f138a7eeb9
75af6552-913a-4220-895d-c2a9a0185919
a5d11c0b-0c59-4198-9b3d-6f97a5e07a2d
d7441b04-766e-482c-b745-cdb1392931a5
prefs-1.js
prefs.js
prefs.js
sessionCheckpoints.json
$uckyLocker.exe
Artemis.zip.crdownload
Artemis.zip:Zone.Identifier
BlackEnergy2.1.zip
CoronaVirus.exe
Floxif.exe
Ransomware.Jigsaw.zip
W32.CodeRed.Worm.C.zip
jigsaw
memory/488-820-0x0000000004B10000-0x0000000004BEA000-memory.dmp
memory/488-806-0x0000000004B10000-0x0000000004BEA000-memory.dmp
memory/2436-1133-0x0000020C7C440000-0x0000020C7C516000-memory.dmp
memory/2436-1134-0x0000020C7C440000-0x0000020C7C516000-memory.dmp
memory/2472-0-0x0000000001120000-0x00000000018CE000-memory.dmp
memory/2548-1887-0x0000000004D80000-0x0000000004D8A000-memory.dmp
memory/2548-1984-0x0000000004F30000-0x000000000500A000-memory.dmp
memory/2548-1886-0x0000000004BF0000-0x0000000004C82000-memory.dmp
memory/2548-1885-0x00000000050C0000-0x0000000005666000-memory.dmp
memory/2548-1905-0x0000000004F30000-0x000000000500A000-memory.dmp
memory/2548-1906-0x0000000004F30000-0x000000000500A000-memory.dmp
memory/2548-1884-0x0000000000210000-0x000000000027E000-memory.dmp
memory/3144-1168-0x0000022982A20000-0x0000022982AF6000-memory.dmp
memory/4108-719-0x0000026E29DD0000-0x0000026E29EA6000-memory.dmp
memory/4108-718-0x0000026E29DD0000-0x0000026E29EA6000-memory.dmp
memory/5368-1633-0x0000023CE8030000-0x0000023CE8106000-memory.dmp
memory/5368-1632-0x0000023CE8030000-0x0000023CE8106000-memory.dmp
memory/5508-1841-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5508-1843-0x0000000000550000-0x00000000005C5000-memory.dmp
memory/5508-1844-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5660-1518-0x000001B417B40000-0x000001B417C16000-memory.dmp
memory/5964-2175-0x0000000000400000-0x000000000056F000-memory.dmp
memory/5964-20231-0x0000000000400000-0x000000000056F000-memory.dmp
memory/5964-2184-0x0000000000400000-0x000000000056F000-memory.dmp
memory/24404-30075-0x0000000000400000-0x000000000056F000-memory.dmp
memory/24404-28745-0x0000000000400000-0x000000000056F000-memory.dmp
memory/24404-20234-0x0000000000400000-0x000000000056F000-memory.dmp
memory/24664-30083-0x0000016732DE0000-0x0000016732EB6000-memory.dmp
memory/26140-30086-0x000001B2467A0000-0x000001B246876000-memory.dmp
memory/30168-30087-0x000002A742B40000-0x000002A742C16000-memory.dmp
memory/30168-30135-0x000002A742B40000-0x000002A742C16000-memory.dmp