45930023c6ff74f19416bba5f1cbd0ad41cf93b8c195299d00b7935f4f4a2d9f

Analysis

user interaction
yes
max time kernel
67s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
MINA NORMALA.png
Size 16KB
Sample260701-166apsfs7n
SHA256 45930023c6ff74f19416bba5f1cbd0ad41cf93b8c195299d00b7935f4f4a2d9f
MD5 7e1a1857a490b7d09b4394a25b85e86d
SHA1 96f48cca63f3705c2f1075beafe6eeaa06cd66c9
SHA512 bd95110047a95065c13c836e7bf50cb374248b3a8eb1d28e0fdff82d08aa75c9309cdbdaad58307dea68876f6282c0bc590a9bfdb33d6b04c5edaf8524d4339a
SSDEEP 384:pwiub79+Yx6B9h5opGz+ELZ49Oq39eagz5E92eY9qdpEzOuMcoD6Xa93:pSOThN5U20Mz/MpIO
TLSH
T14A72B3CC86EA1E5F8A95C462245897DB8F3F17E746E780EBCB1233E019D052BE521C9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
52	camo.githubusercontent.com
68	camo.githubusercontent.com
70	camo.githubusercontent.com
71	camo.githubusercontent.com

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5944	chrome.exe

Checks SCSI registry key(s) 3 TTPs 50 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274178396521203"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{B2831319-E597-41ED-9324-B941357B43E4}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{ED10BADF-4C38-426F-B941-765228115EE4}	explorer.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3724	mspaint.exe
3724	mspaint.exe
5708	chrome.exe
5708	chrome.exe
4952	explorer.exe
4952	explorer.exe
4952	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe
Token: SeShutdownPrivilege	5708	chrome.exe
Token: SeCreatePagefilePrivilege	5708	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
4376	sihost.exe
4952	explorer.exe
4952	explorer.exe
4952	explorer.exe
4952	explorer.exe
4952	explorer.exe
4952	explorer.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
5708	chrome.exe
4952	explorer.exe
4952	explorer.exe
4952	explorer.exe
4952	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3724	mspaint.exe
3724	mspaint.exe
3724	mspaint.exe
3724	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 5028	5708	chrome.exe	93
PID 5708 wrote to memory of 5944	5708	chrome.exe	94
PID 5708 wrote to memory of 2256	5708	chrome.exe	95
PID 5708 wrote to memory of 2256	5708	chrome.exe	95
PID 5708 wrote to memory of 3520	5708	chrome.exe	97
PID 5708 wrote to memory of 3520	5708	chrome.exe	97
PID 5708 wrote to memory of 4052	5708	chrome.exe	98
PID 5708 wrote to memory of 4052	5708	chrome.exe	98
PID 5708 wrote to memory of 4888	5708	chrome.exe	99
PID 5708 wrote to memory of 4888	5708	chrome.exe	99
PID 5708 wrote to memory of 1136	5708	chrome.exe	100
PID 5708 wrote to memory of 1136	5708	chrome.exe	100
PID 5708 wrote to memory of 3200	5708	chrome.exe	101
PID 5708 wrote to memory of 3200	5708	chrome.exe	101
PID 5708 wrote to memory of 3216	5708	chrome.exe	102
PID 5708 wrote to memory of 3216	5708	chrome.exe	102
PID 5708 wrote to memory of 2768	5708	chrome.exe	103
PID 5708 wrote to memory of 2768	5708	chrome.exe	103
PID 5708 wrote to memory of 3616	5708	chrome.exe	104
PID 5708 wrote to memory of 3280	5708	chrome.exe	106
PID 5708 wrote to memory of 4660	5708	chrome.exe	105
PID 5708 wrote to memory of 3280	5708	chrome.exe	106
PID 5708 wrote to memory of 4660	5708	chrome.exe	105
PID 5708 wrote to memory of 2956	5708	chrome.exe	111
PID 5708 wrote to memory of 2624	5708	chrome.exe	110
PID 5708 wrote to memory of 2956	5708	chrome.exe	111
PID 5708 wrote to memory of 2624	5708	chrome.exe	110
PID 5708 wrote to memory of 5240	5708	chrome.exe	112
PID 5708 wrote to memory of 5240	5708	chrome.exe	112
PID 5708 wrote to memory of 2724	5708	chrome.exe	113
PID 5708 wrote to memory of 2724	5708	chrome.exe	113
PID 5708 wrote to memory of 5048	5708	chrome.exe	114
PID 5708 wrote to memory of 5048	5708	chrome.exe	114
PID 5708 wrote to memory of 6128	5708	chrome.exe	115
PID 5708 wrote to memory of 6128	5708	chrome.exe	115
PID 5708 wrote to memory of 1460	5708	chrome.exe	116
PID 5708 wrote to memory of 2304	5708	chrome.exe	117
PID 5708 wrote to memory of 1460	5708	chrome.exe	116
PID 5708 wrote to memory of 464	5708	chrome.exe	118
PID 5708 wrote to memory of 2304	5708	chrome.exe	117
PID 5708 wrote to memory of 464	5708	chrome.exe	118
PID 5708 wrote to memory of 1984	5708	chrome.exe	119
PID 5708 wrote to memory of 2580	5708	chrome.exe	120
PID 5708 wrote to memory of 1984	5708	chrome.exe	119
PID 5708 wrote to memory of 2580	5708	chrome.exe	120
PID 5708 wrote to memory of 2604	5708	chrome.exe	121
PID 5708 wrote to memory of 2604	5708	chrome.exe	121
PID 5708 wrote to memory of 5904	5708	chrome.exe	122
PID 5708 wrote to memory of 5904	5708	chrome.exe	122
PID 5708 wrote to memory of 3456	5708	chrome.exe	124
PID 5708 wrote to memory of 1132	5708	chrome.exe	125
PID 5708 wrote to memory of 6032	5708	chrome.exe	126
PID 5708 wrote to memory of 2360	5708	chrome.exe	127
PID 5708 wrote to memory of 5308	5708	chrome.exe	130
PID 5708 wrote to memory of 5308	5708	chrome.exe	130
PID 5708 wrote to memory of 552	5708	chrome.exe	131
PID 5708 wrote to memory of 552	5708	chrome.exe	131
PID 5708 wrote to memory of 5096	5708	chrome.exe	132
PID 5708 wrote to memory of 5096	5708	chrome.exe	132
PID 5708 wrote to memory of 5440	5708	chrome.exe	133
PID 5708 wrote to memory of 5440	5708	chrome.exe	133
PID 5708 wrote to memory of 3840	5708	chrome.exe	134
PID 5708 wrote to memory of 3840	5708	chrome.exe	134
PID 5708 wrote to memory of 3236	5708	chrome.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\MINA NORMALA.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:1308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb9e0dc728,0x7ffb9e0dc734,0x7ffb9e0dc740
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,16348621103721434212,12024881202339659718,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,14284123130412797324,3831651308289001339,262144 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,15155995940168094173,8123141823776970703,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,13212985053498068526,6082218488742683601,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,5403217114829097585,13625678888805661679,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4632,i,2271189684080973797,11250692798950426982,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,868698287397055891,17115626122647201635,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,13052559603204208889,6404986609380773221,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,3584671210817268451,875562879442886629,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5164,i,809999798048759302,7648273466634360237,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5432,i,16666823317621192632,12133030120411606636,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5472,i,1750751661722657659,12422328169784202766,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5776,i,8996914718293603345,12567356611404305567,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,11555419492953188572,6168019664949576910,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5636,i,5829847858810865605,8176001079973996754,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5984,i,13825310876157009697,12573658119394778635,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5184,i,17791019473903424258,2157936997277253840,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,16667092591317634181,8302621236312481259,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5980,i,2551263237487551853,3719487895477374317,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,7348200582820295998,423030523487461186,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6148,i,16356707047050368710,16910282149667628839,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5944,i,1839152534003998263,11923498347924249415,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6136,i,7214686217791211598,16795093752083080914,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:9
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6528,i,9347397723368538272,9661162031019858648,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3960,i,17957247517979841084,1002948842587524128,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6856,i,2524948725167215363,9866317045003999148,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6864,i,3723385005442507946,8450669654796048281,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6876,i,10196217277585823247,2284398656785891987,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7036,i,3674444557714304805,14867476205487890992,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5556,i,1627343969764755287,7121836778654357744,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6544,i,17196624381042949131,17876472949644679904,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7084,i,199576483960969298,10826657325066852058,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,1919479759365987753,1644283102771562531,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6008,i,17029993311973288404,12327178600329339384,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=4276,i,4585503922098193276,16138743793414118499,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6196,i,13485843990151801290,1994147049970065748,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,12834273311040457775,515536119984618540,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4220,i,9359355805624266855,11683463793482793832,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:12
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7012,i,17996487925765721447,10596798315081307258,2097152 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4228,i,11625146956779792527,12824762269900838745,524288 --field-trial-handle=2116,i,15578209314820852104,12546253297346407344,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:7064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3344

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:4376
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4952
- - C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe
    "C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe"
    3⤵
    PID:6664

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4848

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3324

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1516

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d8055 /state1:0x41c64e6d
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:6512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 cb05453bd0a9e8705a2adb8c8aac8178ed858d386b037e95e82c88ff83574f85
MD5 32e2504db9ad61411379aa69ff8d2539
SHA1 21a8a5a77681e108ede2b3d122e74e93c43ae25d
SHA512 470b573f9c79734e00b77092c6eaaf38152d9916965b9cde65fadaa6bbbab637a0413034353f170e7c9bb75f21dbf7441d6b622ffffb458bb8bb7c9724b5478d
SSDEEP 96:rGkL29PGt17oEjDaXDjc+mp0ymBeUZrsymAGOed2Yb6SHreZDuC6RBPg8YvfsDv3:rI9u4UnpvArHGffYuu4ca
TLSH
T18BB1C71CB7B1C09FCBD28E7017D3702D2F7684095AE39A260884BEF49DFB265A7592D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 20bc61298712bcd8c739c0c98b6ea1bcb76691a091f1b7dc70fe45e31a3abef2
MD5 b76543ea4e5fda16e751c4d2f62d9ac0
SHA1 558a9890e972b90297828f2e0224a9533045a6c4
SHA512 83df19553a5fbd2cd74c8ca617b9bd27c3fb99411a3f2e853ec745e5099bb85a431b91d96000725f8e904f96354b04b3c8d106ddc06095f6e4e59a094521d9d9
TLSH
T1E581401DB79A80E3DBE8467054D768263F37C4091063AE2A4CA4BF7439C33A196ED6C1
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 cc4daebb8feffe34d4bffd9279dc2c7b5f997f210f5015635dadb5635d4b310a
MD5 5acdeb0ed56a0cabdb57cea3e96d1ca5
SHA1 d6da6ae95b400d0d0785aea6e2b01d9f8e160f50
SHA512 e01a36c0d4482340ba12338a790eeaab53e315d1760abf0151b9c5f175e167eca57a1cf4c04c7f4e8a08ea5276b2a94e7d3dd6081ace227fe46635c6235ca4c0
SSDEEP 192:DNVSOWd84mPm0VNRAJR6t7HUm9mxmVmDmtmSHmZXF7mNnfwj9IbIPIyNPxvVx0as:DNVSOWd84mPm0VNRAJR6t7HUm9mxmVmY
TLSH
T132329BF7C7D8C62D891115F4AB15AF1ECE291A28432C3C66C8D8BF4B93E2871D21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 77e81c2721feca3850f2e4f6539949b2210ea9d0133fc06081f07be126f20454
MD5 9c65ad32bbf9970a24897477cb3ab9a5
SHA1 b51f1044dd41b97ec6f39d78d326ba09c28cf26a
SHA512 c4c9f57b16e231a07fca280a0a455307a44fca524a145f90425d2da726f32a68ec327478b475d7c955095c22960eea40057c47df8edfefa1ef9e30416046472f
SSDEEP 192:lREcBzk+3Bvv7+fAPRp2cFf9WHsb+WNnZI1U7OK2W6eDwVyIsnAUge:lREmzjxnHXn4wP72he
TLSH
T10D32A42FAD14667B5CCBD21DFA65B763E2F21021A5942E84EAFCCA3C12D79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2e30befef5def9e66c272cddf8d1769480d1e6b75a2dff49bb410a6c4d43dbdd
MD5 1550c890b89dc2902bcc86439695f6c5
SHA1 6ecf92d21112000b74432c2ea49408ff6ded97dd
SHA512 6a4a995fd5191b4f2516cdbaf5f90a1705a3b5903a5833bc69d9976035853023064e8b9e353fa77a02307f1d4d9d32e9a7702c6abee5b9b96b7d2912fa2f551c
SSDEEP 192:mREcBhkMG9mvv7wfvPRpfEqEac9WHsb+WNaJeKRG9+uiW56em/rVyIsnAUgE:mREmhv3nsXK4wy26WYtE
TLSH
T14D52D76FAD146A7B5DCBD129F925B766E3F11032A5D01E84EAFCCA2C12D79CC2207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2d0c3b7c60d94caaf06cf1a69b38184a7c1848e1164ee3a9719bd34f71f5c650
MD5 152016e53bb3487aef02d6abcc4d9213
SHA1 ca2d2f79266da063b248d5950eb53e57b5a7d63f
SHA512 29f044d6e346a651ba40e8a9caca939924d412d3422a7bf6248da0285c0236b9cd0bfc0c6f75a2546ca972f248643f96c4a6296c633cb354f38ce53b49612a59
SSDEEP 192:mREcBzk+3zvv7+fAPRp2EqdRf9WHsb+WN5BnzKOK2d6ekwVyIsnAUgE:mREmzjjnHXy4wLG2xE
TLSH
T1B242B56FAD546ABB5CCBD219FA25B767E3F11021A5D01E84EAFCCA2C12D79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6aa555a9983edc75e2fb92b487d83a103b99171af5ca11930c1e9a5bc72f83f7
MD5 4ffb237291bcca287add7aaae976c77e
SHA1 e089dda3ec27a539f28f2d0e3a4ce06db8ffdd21
SHA512 0ae86d42d8fb169e3f6c577ac2bf23653312dff664a4d29cfc74ca2c65b8ede7bd29ff7f2ed92efb0fea151b9acc313c2504705e0a1b6c43eb876290a8bb0a19
SSDEEP 192:mREcBhk+3zvv7wfvPRpfEqFRo9WHsb+WN5BeKquiWd6emwVyIsnAUgE:mREmhjjnsXE4wDeW/E
TLSH
T1CA42C72FAC542ABB5DCBE259F925B766E3F11021A5D01E84EAFCCA3C12D79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bd7fd979334ae31595c186dde454efcb6889ffd76819669e73fd7c46a0a78f7f
MD5 81f3886bd5ad1ede94de66cd67b17529
SHA1 daf21b07bd7534324421756469722ba717ebb615
SHA512 d2b98b3911cea6f96f3776a7bd33a2a02bd3522d0f58a69bf2505ba83d77dd99f3dda4c93d6bf89be97087114cf05a340cf898121fea192bf5edea4096a0a541
SSDEEP 192:mREcBhkM39mvv7wfvPRpfEqEac9WHsb+WNaJeKRG9+uiWV6emwVyIsnAUgE:mREmhvQnsXK4wy26WXE
TLSH
T1B852D76FAD142A7B5DCBD229F925B766E3F11032A5D01E84EAFCCA2C12D79CC2207017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 c961af8cda59da7db3fc127c6ee78f2e0ed026ba0946b4dc616aaa3c40a309f4
MD5 273f6b383cad0c2db94fac3ed62fb0c3
SHA1 db5f7e96d9095dcd74128a1164fd5a185b7ded11
SHA512 89cd94f3b15447849fd85dd69ea0ba8bc2798012a5bea04641e273a13bafe477a7690ebbfb534a8dd35e7ed88bd9cf274b0ac60355865ab3c3f3f5961f78c52d
SSDEEP 384:Vjjz67KxkXqKf/pUZNCgVLH2HfgslPCXODJg+ErU3Q2HGKuVfvy:VPz67KxkXqKf/pUZNCgVLH2Hfgs1QOdJ
TLSH
T1A2521A27688C9A7B0FD8DA8CDC177F4FACB501576668492853FB5C0803A5BCA124A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 bb9200ff9d23e16df32a91c3794d3bddb0acc992fb5d08db198b3f5e631921bc
MD5 63dbf853bba2dfbd8061f7f6d9da7b56
SHA1 9771c53e9ec91e4d449606218d02dcca6eba41e6
SHA512 ebedadd3b0a8d6bb9bda724310e153d47ab79e1125fa272b101dd72c6462cf67fd15b632393953728d869e7ff0b212fcb1985a04cbe9b7ab0e24a5a584cdad19
TLSH
T1C0A0027912C04A55D9912778B3C261C42725AC195716D31380F154C8E8922438685720
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5e223f6db1f861226c8d46f453f621e8a749595a6584964ec6d58427ea8bd1dd
MD5 7ea3fa0de00f50f186426dac24f69459
SHA1 1e69e791a19598d0268c2464dcb3355e7fa5d46a
SHA512 2b4551747efe789d7085704629c8da300d3bf57291d194faa481a17ccee0b79787707b29dfd0086bd4a799b02f897ec332cf5dd8d234f67b0e7017cb8b0f743f
TLSH
T172A002AC41E10821DF814271646109466FB55814BD955353A491155C9CDB1D04E45504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592c27.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe592c27.TMP
Size 48B
SHA256 923704c099b2ac5b3d2ee7d4dd5641417844e5301b8ed87f79d65d5d53f85284
MD5 244e8a9ffba34716e896463648ac0587
SHA1 465433edede2a6d60c9cc32da05d24f9db67a605
SHA512 a4e42e28f3e332eb16411322624bd349c5ed226fde92104dbf9941bfe7b30bda6dca6c160f79192b15e0c6e041268170da8c83bf4ed7dc7fc2542455e86434d1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 d12f7081f30c1f2dcffcdea1ae62d6eb099c3de830a02ca203c2af7095613ad0
MD5 d6e850481d4888295554b2cd1ed5581d
SHA1 0d305dadc1483ae3efddf02a277c68ca010de84f
SHA512 feb9a873583caa8c1852646581ba9e5e7fc5abe184f83b8d28eee201102399a803203615e6e084a7b669117d32e36f7744cafe8a72924e5ffbcba4a0d773235c
TLSH
T124C04CD31911998B5674EAD93418712ED55B865D9CD5CEFC9548901A31F4E3A4402628
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59ef09.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe59ef09.TMP
Size 157B
SHA256 5485a6b89cb39b74af8440dea4596be422eef553d193764894dd832b7be09453
MD5 5cefe32ff7e60c7b71cef90b1404bb10
SHA1 7158e1c0f3eee45560ff11ecf30b30be98d9ebfe
SHA512 a28830b23f02be479595880102676cddbcc2857e52ba9687602881a999723b93c80eb3b809380cc99e8952d6f0b926c8996ab0bae9d381fedb2f99e318d83f01
TLSH
T1BDC08CD31810088B4730E9C53028311EC56B8D2D8CC1CEEC8949B00A30F4E3B8001628
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 fcddbcf48726a4a5ccd89e2feb66bd1b58b4ad6408b6bb3847bb5d3e45ddec47
MD5 b61a9070bf9a9c5aca33741aa108e5b3
SHA1 182cd953644cc76d3429e93ebd0e16eac9d0acd0
SHA512 3069f5f2082cfd32064eaacbe69ecee2eb68616dafa22e14f29cb95146d1f5e4672229d5e64f841ab9d408b42fb4e317d4249467f1bea0e6bac8cc73a6d16930
SSDEEP 3072:F1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5R:bmg1kQfATCFbzQACjG
TLSH
T152C3129E49E40DBE1716086221821E76E3D6A72FDE522EDC936B07B616D7C8A1387412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 48491516ca1c3d08947a066b4869bcb0d1b8570536c603a58d205b8f9f3db509
MD5 2c05dfde415f2bfb48375e4e35c4fbb4
SHA1 4d7a483e5f01a7cb41760262898e3e00e628fa0c
SHA512 c05c43b9660bb3ec694f48a74d2d2f86b74b96825b50a16fe05cbf08ebe4f3c25fe3f11dfc7dd6f63418a656e10e6a958bdc85477e8ecf47e75bac002a13747e
SSDEEP 3072:A1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5R:mmg1kQfATCFbzQACjG
TLSH
T1BDC3129E49E40DBE1716086221821E75E3D6A72FDE522EDC936B07F616D7C8A2387412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 c9b0f5bd48dd744dfbf009a0827fe88083cf961e168aefd6bfd018cc14730df0
MD5 42bf6e971967a81135b7db47efc4277f
SHA1 8006dcb192dfa663768a3a1f36c51c0dfbba757c
SHA512 5a7ab7130fbcf97870befa317e610bd0a668537dafba1a357dda149aafe5f3c22f5820d6e29f15f7c2749695e7f3d38a04cd6cc206d356791b7e807ddc36a660
SSDEEP 3072:L1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5R:hmg1kQfATCFbzQACjG
TLSH
T127C3137B4DE409FE1712089121422F65EED9A76FDF523F9C526A0BF51ACBC8A1343863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9ecbbf2ddb120a802ba65656f82028844ab564ec5fe6c916c9d0548a7937a2ba
MD5 757b1993194a95665636b4c121c03365
SHA1 1c44e950f0d770b5297e33994d0dba81c4cb5948
SHA512 abd0d8c2cb403209f91ed5bba3678f9fccf23eb5c6cf9866399f0c1b893140518a081f0d2d412467e98b4f46fa60f0654358af18de1971942c4cd9ba0c88a971
SSDEEP 96:JC6rd+FKJXPXDJAKWTeVslfnbj5EsVRDotok5DxDYB6ydGyvyv1P1ibmjiv4a:JC6PJX/dAeyt/3DUD9sFw7P1ibqM
TLSH
T132A10772686D5DB358B2E489B9832F03CF652197D961EF88A9EC4B1C05EB0EC0343973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5708_2093690023\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

noescape.png

Path C:\Users\Admin\AppData\Local\noescape.png
Size 391KB
SHA256 cf7b5334e06a13501821834cd1aedb7c3306a543f7d8ec03d1f20bfaf9bed613
MD5 9e655cfd3d501f1ed01d6a2e0db0e744
SHA1 481cda76b89cb4785672f598d7b59c994f7d143b
SHA512 5c55676d0b76429ca6408cd197a7dcad895753f3e68a73b75f141c4f193f0526476937704a32e7e051119a9cc14ce8b48baae5a8e10d3eb5e9250186cc9c5e32
SSDEEP 12288:InL32CPdWMpJsCaa7xGBW1Sg6edbjquhl0EQA51:22yWMsCaaFQWvdnqVW1
TLSH
T1E28423271536CF74DEFF90BDCA768F0B497B85AD54C16A4683F123AE3D58E0A8315812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 13KB
SHA256 eb4e4a7200065462c6a063c52c282dca1e557d889235f72aaedaf250dbeaa18c
MD5 5855521f54461d3cb654ba66708ba014
SHA1 7fbc6d7b86dacc3f1c6372903fff246863014e9a
SHA512 3cde5d1c56c9ed9e2bed892d4557e9a5f848bf48354074cc4754aac076e2df201c78e67bc4568d59fbeed9ac90d841285007f484d48d290236d982a5ac2f97a5
SSDEEP 192:YqTcPxy9ZVFXEgGNUIeT/3RE5SN3SaZ8H3G8+d:Y1py9dVDX/3RtVSS8H3G8i
TLSH
T106521E005EE5A266D0B5A7312D77E646D330BD16AE429E1FB580B34F9D31380CDA6B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NoEscape.exe-Download-main.zip

Path C:\Users\Admin\Downloads\NoEscape.exe-Download-main.zip
Size 13.5MB
SHA256 7b55dfab141eb69abbe47267e396fe8ee6bc4054fc8d4a5d91049b950c7d84aa
MD5 6da84fd648c8811cc112f4fffe20a24d
SHA1 ba4f8d7fb51ee0a31b068cca51d5e5388c4b081b
SHA512 0ba4c4379b77b465aa13af7ec295a9e7cc1421cff76e735890f46228af2f500202f879468322ad59b6d6ab06710828536ffcddee23093adf82498a365fee6bdb
SSDEEP 393216:8mpOKhF/fEB5KyYEvARy5DiydlufgDaDh5Z8sJzOvhz9R:8uB3f7koRseynegDU8sJzQR
TLSH
T195E6332FA32CCF19C94B5462CB56B10983847B3BF5594DF5CA0827197EA614AA3393CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NoEscape.exe

Path C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\NoEscape.exe
Size 666KB
SHA256 d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
MD5 989ae3d195203b323aa2b3adf04e9833
SHA1 31a45521bc672abcf64e50284ca5d4e6b3687dc8
SHA512 e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305
SSDEEP 12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t
TLSH
T174E4230297780DB8E2B619755070A50FE8F4FE1A30781D1A84EC77A139F9689733B6DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x86.exe

Path C:\Users\Admin\Downloads\NoEscape.exe-Download-main\NoEscape.exe-Download-main\NoEscape.exe\vc_redist.x86.exe
Size 13.1MB
SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
MD5 1a15e6606bac9647e7ad3caa543377cf
SHA1 bfb74e498c44d3a103ca3aa2831763fb417134d1
SHA512 e8cb67fc8e0312da3cc98364b96dfa1a63150ab9de60069c4af60c1cf77d440b7dffe630b4784ba07ea9bf146bdbf6ad5282a900ffd6ab7d86433456a752b2fd
SSDEEP 393216:S1RPq5dCsKSR65cX7Eyd/qnejOFxP7OEnl4L/Vvc:yP5iw56oyleej2OEnlwc
TLSH
T189D63336A3648126C5E30573EE15E1206F687329BB1488FBD3447E1D3E69587A3BB34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

♆ᄧⱀ᮸ณ⋞ᜐⷅᴬ⍛ᘧ⡭Ὅ⡅⟢⇁▬఩ᖝץ఑ᠡ૗ᘐᆷ᮰⾌

Path C:\Users\Public\Desktop\♆ᄧⱀ᮸ณ⋞ᜐⷅᴬ⍛ᘧ⡭Ὅ⡅⟢⇁▬఩ᖝץ఑ᠡ૗ᘐᆷ᮰⾌
Size 666B
SHA256 8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
MD5 e49f0a8effa6380b4518a8064f6d240b
SHA1 ba62ffe370e186b7f980922067ac68613521bd51
SHA512 de6281a43a97702dd749a1b24f4c65bed49a2e2963cabeeb2a309031ab601f5ec488f48059c03ec3001363d085e8d2f0f046501edf19fafe7508d27e596117d4
TLSH
T11D010292F2C309682B19FE75C76CCFBD4B5A12A58AB7D19F0D84034344C0611599D76E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3324-968-0x00000201001E0000-0x00000201002E0000-memory.dmp

Download

memory/3324-975-0x0000020101DE0000-0x0000020101EE0000-memory.dmp

Download

memory/3324-1013-0x00000201146A0000-0x00000201146C0000-memory.dmp

Download

memory/3324-974-0x00000201019E0000-0x0000020101A00000-memory.dmp

Download

memory/3324-991-0x0000020101C20000-0x0000020101C40000-memory.dmp

Download

memory/4848-1231-0x00000274ED000000-0x00000274ED691000-memory.dmp

Download

memory/4952-2032-0x00000000039A0000-0x00000000039A1000-memory.dmp

Download

memory/6664-1967-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

memory/6664-1600-0x0000000000400000-0x00000000005CC000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads