Overview

overview

8

Static

static

1

Traduccion...01.zip

windows10-2004-x64

1

Traduccion...01.zip

windows11-ltsc_2024-x64

8

Traduccion...ue.txt

windows10-2004-x64

1

Traduccion...ue.txt

windows11-ltsc_2024-x64

1

Traduccion...ue.txt

windows10-2004-x64

1

Traduccion...ue.txt

windows11-ltsc_2024-x64

8

Traduccion...41.png

windows10-2004-x64

1

Traduccion...41.png

windows11-ltsc_2024-x64

1

Traduccion...d5.png

windows10-2004-x64

1

Traduccion...d5.png

windows11-ltsc_2024-x64

8

Traduccion...3b.png

windows10-2004-x64

1

Traduccion...3b.png

windows11-ltsc_2024-x64

8

Traduccion...ac.png

windows10-2004-x64

1

Traduccion...ac.png

windows11-ltsc_2024-x64

1

Traduccion...03.png

windows10-2004-x64

1

Traduccion...03.png

windows11-ltsc_2024-x64

1

Traduccion...ef.png

windows10-2004-x64

1

Traduccion...ef.png

windows11-ltsc_2024-x64

8

Traduccion...db.png

windows10-2004-x64

1

Traduccion...db.png

windows11-ltsc_2024-x64

1

Traduccion...aa.png

windows10-2004-x64

1

Traduccion...aa.png

windows11-ltsc_2024-x64

1

Traduccion...60.png

windows10-2004-x64

1

Traduccion...60.png

windows11-ltsc_2024-x64

1

Traduccion...34.png

windows10-2004-x64

1

Traduccion...34.png

windows11-ltsc_2024-x64

8

Traduccion...ff.png

windows10-2004-x64

1

Traduccion...ff.png

windows11-ltsc_2024-x64

1

Traduccion...e3.png

windows10-2004-x64

1

Traduccion...e3.png

windows11-ltsc_2024-x64

8

Traduccion...84.png

windows10-2004-x64

1

Traduccion...84.png

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    208s
  • max time network
    202s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 04:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Traduccion Tyberos_v1.9/Español By Tyberos/img/parallaxes/2b700449143c77d5.png
  • Size 590KB
  • Sample260705-e4nf8ahv7x
  • SHA256 ae54218733363fccc94737ba8536e24b46556ab6bb63100eabe593ee291cf7bc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 40 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Traduccion Tyberos_v1.9\Español By Tyberos\img\parallaxes\2b700449143c77d5.png"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5552
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
    1⤵
    • Checks SCSI registry key(s)
    PID:240
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4324
      • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\AddTest.ppsx" /ou ""
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:4896
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        3⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1096
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ffb1b19c728,0x7ffb1b19c734,0x7ffb1b19c740
          4⤵
            PID:5592
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,3446866894652175263,17300477734482934181,262144 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:2
            4⤵
              PID:4232
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1936,i,8708950079667983293,12852922066702472473,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
              4⤵
              • System Time Discovery
              PID:5968
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,8413829655202830142,1993744796721362242,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
              4⤵
                PID:5132
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3340,i,891520400404736384,11361466585141554318,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
                4⤵
                  PID:5860
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3308,i,14537227662835926097,6404228895465633587,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
                  4⤵
                    PID:4116
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4748,i,9222083419176642752,6381712861409722191,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
                    4⤵
                      PID:4548
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4920,i,8482170700594174639,2280063925080473564,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
                      4⤵
                        PID:4528
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4980,i,9475786817108239964,1791841774648731187,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
                        4⤵
                          PID:4268
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,14937508827279921150,14684184422973053891,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
                          4⤵
                            PID:2260
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,13932899952593807146,5946075494927683733,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
                            4⤵
                              PID:5512
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5520,i,16595113645469559989,14168759811616655311,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
                              4⤵
                                PID:4512
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5532,i,2881694087513962145,6006882367224665085,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
                                4⤵
                                  PID:3528
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5812,i,1497886175874410994,13689220505645742715,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
                                  4⤵
                                    PID:4584
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5972,i,16624233777436926788,8615011756497279541,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
                                    4⤵
                                      PID:5180
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,4109261872824152633,9583707052285855132,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
                                      4⤵
                                        PID:4888
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6112,i,16101966546077180824,6766510014393179441,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
                                        4⤵
                                          PID:1428
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5948,i,343538620336855817,6372128540301485497,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
                                          4⤵
                                            PID:4552
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,12270510947180424377,17846537031106259313,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
                                            4⤵
                                              PID:4528
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5488,i,929907492959793382,15464373325430760165,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
                                              4⤵
                                                PID:2284
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6332,i,16401082656781471312,11193022968317095812,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
                                                4⤵
                                                  PID:5616
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,13953289331815455786,3682767541559097814,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
                                                  4⤵
                                                    PID:4156
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5632,i,3734763298206372860,8543638806059918712,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:9
                                                    4⤵
                                                      PID:1512
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5708,i,1226879939610341614,8557395043421477522,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
                                                      4⤵
                                                        PID:5016
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4812,i,4420778236205449316,2159672859693269384,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
                                                        4⤵
                                                          PID:1380
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6192,i,16751384368135147137,11072927842885504249,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
                                                          4⤵
                                                            PID:1176
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6200,i,5391529374668777394,1784221485683472550,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
                                                            4⤵
                                                              PID:3088
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6136,i,17938646457149520926,14428744082752381731,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
                                                              4⤵
                                                                PID:5992
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5724,i,13279282895431064439,6430317152013992076,2097152 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
                                                                4⤵
                                                                  PID:2072
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,3758385614300312964,10066794361797987272,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
                                                                  4⤵
                                                                    PID:2736
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3632,i,12351349173187041619,9052680116611250291,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
                                                                    4⤵
                                                                      PID:2860
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,1778069021557272979,8077497931167041417,524288 --field-trial-handle=1856,i,6546442493326512930,9940086586560761852,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
                                                                      4⤵
                                                                        PID:2980
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                  • Modifies registry class
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:832
                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                  1⤵
                                                                  • Modifies registry class
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:6076
                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                  1⤵
                                                                    PID:4188
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                    1⤵
                                                                      PID:3556
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                      1⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      PID:5256

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v16

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          0a40e39f-1ddf-434d-951d-29cabe1fc45e.tmp
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0a40e39f-1ddf-434d-951d-29cabe1fc45e.tmp
                                                                          • Size 6B
                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          f_00001f
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
                                                                          • Size 21KB
                                                                          • SHA256 13753756eab1db0b2faee0c9e28a8c714420894e44f84e5aaa3add52038e1558
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          f_000045
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000045
                                                                          • Size 61KB
                                                                          • SHA256 93615e01a2ef486055af78b4dba90f0fabef5a26b8e306a26b0be7c3c0082145
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                          • Size 1KB
                                                                          • SHA256 ff3618bd131382d3e7cfc4f9ec57c8582d4a885d3701f5468d6fc4bc5ef218ec
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          messages.json
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                          • Size 593B
                                                                          • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          craw_background.js
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                          • Size 531KB
                                                                          • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          CURRENT
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
                                                                          • Size 16B
                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          Network Persistent State
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                          • Size 9KB
                                                                          • SHA256 2abcf4376d030d9245664092f189e0996b6977f6c553249cd2cf728c01bca3a4
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          SCT Auditing Pending Reports
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                          • Size 2B
                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          TransportSecurity
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                          • Size 691B
                                                                          • SHA256 4c73757c2787feb269bb1c8d2aea494c891fb421bc240bdc2c7f984459de2961
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                          • Size 11KB
                                                                          • SHA256 34d9cc0ae691829cca42de541ea0db8074dfcdefe603c93c993ed2ab9dd9a082
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                          • Size 11KB
                                                                          • SHA256 c54bbdbe90bb8c386773561003e3e28cea8f87b5d9e4c4bd4cff7e0db1f924b9
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Secure Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                          • Size 13KB
                                                                          • SHA256 fdd6c3c43798fbc086b00c6a04ab6e67704e1f7ec5fd44236e9caa1bd03711a5
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                          • Size 48B
                                                                          • SHA256 2879d40a06fe2a882b1af27b29d6747f12e3e5ae5fecb01e43b78ea90617c9c7
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                          • Size 72B
                                                                          • SHA256 49bab724dc8644bea6ea713f6e20dd9d3b9ca467fbc45145ff8a182b3755b8fa
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          data_0
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                          • Size 8KB
                                                                          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          data_1
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                          • Size 264KB
                                                                          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          data_2
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                          • Size 8KB
                                                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          data_3
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                          • Size 8KB
                                                                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                          Submit Download

                                                                          MANIFEST-000001
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                          • Size 41B
                                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          Network Persistent State
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
                                                                          • Size 111B
                                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          Network Persistent State~RFe5b0b66.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5b0b66.TMP
                                                                          • Size 59B
                                                                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                          • Size 122KB
                                                                          • SHA256 d75c78f01b85da05f3801a93506992c44952f162bcd2100ffa0969736007ec5a
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                          • Size 122KB
                                                                          • SHA256 e9aaeb3df4fbf330a228f0162ef35d48a73ef78e89a94f9aa2930bf8bf87b04f
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                          • Size 4KB
                                                                          • SHA256 32c4ee565d3019d17e5e38c258d3ebbef72288f5bdde66d6b05900c1776d226d
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                          • Size 122KB
                                                                          • SHA256 e33f443c90e4f9c548dedc4b26dbced81f4cfe4b58191bed195b1fcc1f8a1c43
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          prep_Activatable Class_Hermes_perf.cache
                                                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                          • Size 595B
                                                                          • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          prep_Activatable Class_Hermes_perf.cache
                                                                          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                          • Size 599B
                                                                          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          messages.json
                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1096_1767746764\CRX_INSTALL\_locales\en\messages.json
                                                                          • Size 450B
                                                                          • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          memory/4896-195-0x00007FFAFA760000-0x00007FFAFA770000-memory.dmp
                                                                          Download

                                                                          memory/4896-192-0x00007FFAFA760000-0x00007FFAFA770000-memory.dmp
                                                                          Download

                                                                          memory/4896-197-0x00007FFAF82F0000-0x00007FFAF8300000-memory.dmp
                                                                          Download

                                                                          memory/4896-198-0x00007FFAF82F0000-0x00007FFAF8300000-memory.dmp
                                                                          Download

                                                                          memory/4896-212-0x00007FFAFA760000-0x00007FFAFA770000-memory.dmp
                                                                          Download

                                                                          memory/4896-193-0x00007FFAFA760000-0x00007FFAFA770000-memory.dmp
                                                                          Download

                                                                          memory/4896-194-0x00007FFAFA760000-0x00007FFAFA770000-memory.dmp
                                                                          Download

                                                                          memory/4896-214-0x00007FFAFA760000-0x00007FFAFA770000-memory.dmp
                                                                          Download

                                                                          memory/4896-213-0x00007FFAFA760000-0x00007FFAFA770000-memory.dmp
                                                                          Download

                                                                          memory/4896-211-0x00007FFAFA760000-0x00007FFAFA770000-memory.dmp
                                                                          Download

                                                                          memory/4896-196-0x00007FFAFA760000-0x00007FFAFA770000-memory.dmp
                                                                          Download

                                                                          memory/6076-22-0x00000185000B0000-0x00000185001B0000-memory.dmp
                                                                          Download

                                                                          memory/6076-33-0x0000018503900000-0x0000018503920000-memory.dmp
                                                                          Download

                                                                          memory/6076-66-0x00000185140C0000-0x00000185140E0000-memory.dmp
                                                                          Download

                                                                          memory/6076-35-0x0000018513D40000-0x0000018513E40000-memory.dmp
                                                                          Download

                                                                          memory/6076-51-0x0000018503B40000-0x0000018503B60000-memory.dmp
                                                                          Download

                                                                          memory/6076-20-0x00000185000B0000-0x00000185001B0000-memory.dmp
                                                                          Download

                                                                          memory/6076-21-0x00000185000B0000-0x00000185001B0000-memory.dmp
                                                                          Download