5229082ce1191b377ac3a18b5eb5463bf9fcf266006201f8c88c15472a94cff7

Analysis

user interaction
yes
max time kernel
218s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
hwid_changer.py
Size 14KB
Sample260731-ea1vfstbrd
SHA256 5229082ce1191b377ac3a18b5eb5463bf9fcf266006201f8c88c15472a94cff7
MD5 39c67f389c76c9368fa196f9b6c589ce
SHA1 d22823c4e6966764800b67836a6695c688b8a4ea
SHA512 5cb7fffcf955dae9afea12cb969d9b7a671ea2a2016d6647987ab1473f4e6940116ce8968dcf7e3d34378f430cbf576c0e4d8284041bf7f48e4affa8de8edbdf
SSDEEP 192:TkIWBb4qA3ZeLeWOB+YKFc4A0evGW1BeBA1K1052QWTUy8KMXxiKgz830yA:TQBzKehiBW/7MXxiKgzN
TLSH
T1A962A44AED511871E783C0AED862E856E71B392F170C5AA5BCBDD5841F88072C2BD9F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery execution persistence ransomware

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2176	loader.exe
4628	loader.exe
3452	loader.exe
1008	loader.exe
4992	loader.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4964	powershell.exe
616	powershell.exe
1264	powershell.exe
4244	powershell.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	loader.exe
File opened for modification	\??\PhysicalDrive0	loader.exe
File opened for modification	\??\PhysicalDrive0	loader.exe
File opened for modification	\??\PhysicalDrive0	loader.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
3360	loader.exe
2412	loader.exe
4744	loader.exe
1008	loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
524	cmd.exe
5100	cmd.exe
376	cmd.exe
3620	cmd.exe
4980	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3640	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	loader.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "25"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299431238549006"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	loader.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	loader.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	loader.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{60AB4D70-FD06-4785-9B7C-3E83CFE9F4DD}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.cdr	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.cdr\ = "cdr_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cdr_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cdr_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cdr_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cdr_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cdr_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cdr_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cdr_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\cdr_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3376	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4964	powershell.exe
4964	powershell.exe
4964	powershell.exe
616	powershell.exe
616	powershell.exe
616	powershell.exe
1264	powershell.exe
1264	powershell.exe
1264	powershell.exe
1820	chrome.exe
1820	chrome.exe
4244	powershell.exe
4244	powershell.exe
4244	powershell.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1784	OpenWith.exe
2512	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
3360	loader.exe
2412	loader.exe
4744	loader.exe
1008	loader.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe
Token: SeShutdownPrivilege	4856	chrome.exe
Token: SeCreatePagefilePrivilege	4856	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4856	chrome.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe
4904	taskmgr.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
1784	OpenWith.exe
3360	loader.exe
2176	loader.exe
2412	loader.exe
4628	loader.exe
4744	loader.exe
3452	loader.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
2512	OpenWith.exe
1008	loader.exe
4992	loader.exe
4132	LogonUI.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 1928	4856	chrome.exe	91
PID 4856 wrote to memory of 3640	4856	chrome.exe	92
PID 4856 wrote to memory of 5040	4856	chrome.exe	93
PID 4856 wrote to memory of 5040	4856	chrome.exe	93
PID 4856 wrote to memory of 3456	4856	chrome.exe	94
PID 4856 wrote to memory of 3456	4856	chrome.exe	94
PID 4856 wrote to memory of 1020	4856	chrome.exe	95
PID 4856 wrote to memory of 1020	4856	chrome.exe	95
PID 4856 wrote to memory of 932	4856	chrome.exe	96
PID 4856 wrote to memory of 932	4856	chrome.exe	96
PID 4856 wrote to memory of 3600	4856	chrome.exe	98
PID 4856 wrote to memory of 3600	4856	chrome.exe	98
PID 4856 wrote to memory of 2408	4856	chrome.exe	99
PID 4856 wrote to memory of 2408	4856	chrome.exe	99
PID 4856 wrote to memory of 3088	4856	chrome.exe	103
PID 4856 wrote to memory of 676	4856	chrome.exe	107
PID 4856 wrote to memory of 676	4856	chrome.exe	107
PID 4856 wrote to memory of 4596	4856	chrome.exe	108
PID 4856 wrote to memory of 4596	4856	chrome.exe	108
PID 4856 wrote to memory of 4212	4856	chrome.exe	115
PID 4856 wrote to memory of 1468	4856	chrome.exe	116
PID 4856 wrote to memory of 2904	4856	chrome.exe	117
PID 4856 wrote to memory of 3452	4856	chrome.exe	118
PID 4856 wrote to memory of 5020	4856	chrome.exe	120
PID 4856 wrote to memory of 3068	4856	chrome.exe	121
PID 4856 wrote to memory of 3068	4856	chrome.exe	121
PID 3360 wrote to memory of 2176	3360	loader.exe	123
PID 2176 wrote to memory of 5100	2176	loader.exe	124
PID 5100 wrote to memory of 4964	5100	cmd.exe	126
PID 2412 wrote to memory of 4628	2412	loader.exe	132
PID 4628 wrote to memory of 376	4628	loader.exe	133
PID 376 wrote to memory of 616	376	cmd.exe	136
PID 4744 wrote to memory of 3452	4744	loader.exe	139
PID 3452 wrote to memory of 3620	3452	loader.exe	140
PID 3620 wrote to memory of 1264	3620	cmd.exe	142
PID 4856 wrote to memory of 1820	4856	chrome.exe	145
PID 2512 wrote to memory of 3376	2512	OpenWith.exe	147
PID 1008 wrote to memory of 4992	1008	loader.exe	150
PID 4992 wrote to memory of 4980	4992	loader.exe	151
PID 4980 wrote to memory of 4244	4980	cmd.exe	154
PID 4856 wrote to memory of 1408	4856	chrome.exe	159
PID 4856 wrote to memory of 1408	4856	chrome.exe	159

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\hwid_changer.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbc094c728,0x7ffbc094c734,0x7ffbc094c740
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1920,i,6712364358528164265,4500411239217495762,524288 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,3668736122267301136,14358485394236182778,262144 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,18051823248411136634,3730487141537905728,524288 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,17134330430347323253,1148100273103264329,2097152 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,3814812003771534345,9355137281523637405,2097152 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3984,i,16168513945044629500,4294731414277288366,2097152 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,12347120287561923222,17740755138665350776,2097152 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2452 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,2806502707702920328,7138637764714312420,524288 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5828,i,3140587259513966818,1987462463467663443,2097152 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4756,i,16663337664850803171,1666978457094040688,2097152 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,12417664980165827799,7909216819075818541,524288 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,4439487715649464392,18060640456238747133,524288 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,13515829645947726356,10925966666571788413,524288 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4392,i,8841766787577697543,11348970011002406170,524288 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,6650403663605064530,9999781600931820150,524288 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,11027908758693930533,2107792255140099141,524288 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2624,i,116572238116955820,17680062060075381291,262144 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4408,i,16014674189431522518,10801465276016542785,524288 --field-trial-handle=2016,i,1223457100614880144,8718597603669016062,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  PID:1408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4300

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2784

C:\Users\Admin\AppData\Local\Temp\Temp1_loader.zip\loader.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_loader.zip\loader.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\Temp1_loader.zip\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_loader.zip\loader.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^"^& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }^"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4964

C:\Users\Admin\AppData\Local\Temp\Temp1_loader.zip\loader.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_loader.zip\loader.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\Temp1_loader.zip\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_loader.zip\loader.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^"^& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }^"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:616

C:\Users\Admin\Downloads\loader\loader.exe
"C:\Users\Admin\Downloads\loader\loader.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Users\Admin\Downloads\loader\loader.exe
  "C:\Users\Admin\Downloads\loader\loader.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^"^& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }^"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\loader\report.cdr
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3376

C:\Users\Admin\Downloads\loader\loader.exe
"C:\Users\Admin\Downloads\loader\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Users\Admin\Downloads\loader\loader.exe
  "C:\Users\Admin\Downloads\loader\loader.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^"^& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }^"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4244

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4904

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38e3855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

35e48a54-17e6-49da-a97d-31bc46e2932c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\35e48a54-17e6-49da-a97d-31bc46e2932c.tmp
Size 115KB
SHA256 76ca9e2590c783d5d63a09d38a1efda73c5f5ca3b30e728e7f2077492cf0e93f
MD5 9c872aa5755ab3ec296b8b945ecefa01
SHA1 f07088c05c745b404356a0b70bbf6e1e1f10d1f5
SHA512 1998c930bd4dae941e5a2423fa50b4926c4b9352f49205d554f2ef7ea9d3918473b49d4ae565794c4a9c179ca78d86dc0408860e0adef6a5f0afbb058ab0b75b
SSDEEP 3072:/iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Vm7Rkm1tYpBeh2BAoM
TLSH
T149C312275E75E8375879BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6702b0847f09e03eba79c819e45c98073fb26a01d7572492ad89409b12554e9d
MD5 f535b358b3083c327dd6311afef352c6
SHA1 c53d675bac152f0c2cbecf6d69b87e45aba560f3
SHA512 124b5609a29e76182dd18d0574818e0d4ba4d499a35e199233621d379b5196f9632329343dd52dbece58921a695eea7ff3cc20a9b204d5ff5ceb795f9c14a498
TLSH
T159E0A2A9C923AC3B08FC2329A8624705EA8123872A509D4F373D810C8FB433A4A83C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 672B
SHA256 0f62143b9893645874c87f432dbef2c9048b97ede6c4b4e7815d8b63c64c0bdf
MD5 add5df4958a1b9996a325ed32e9dfec3
SHA1 f717c4f9277a26289a994a4a630c169f1fdcc8bc
SHA512 2ec1afa4fd9fa039fbce7dc4fa0594fb5a3b630d8cc8002fb988ef55da9f1e1d2614497b9c5033373abd7680cf0907759bbe0c514c1985278bde5514cbbcd148
TLSH
T1B2015C2A39C76423EF00E5F1ACC81B487C3453A5A2831EE7A550DCB8C94FBAF0B56550
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 d7ffa471bf9b7ee537793116507f57a7b961d4c5fe71d6467aad9bf150a2c1e9
MD5 feea7078710d9c84ea71cb60d65433dd
SHA1 dd96bb76d941196103dc6003e2afcc717194d58c
SHA512 fa17365ee6acc983091c74d028a645aa32638af5c6ce1b309c03e78b8815de62d83d48bb44b32627298ccc2fd2da8e5853bfb3b939339639c51d21445407a1ba
SSDEEP 96:DNVxH+mNoeaaIEdsd8pDlwZXOAvmEi1nydshdIluVrxWe:DHxH5NoeaaIEdsd8pDlwZXOAvzi1nyd6
TLSH
T147C1BBF3C3F4862E994652F5EB143E1BCE6D1919432C3D96C5ECAE0B63E2870E24065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e3428723ff7b851002e9c407bbbd112856d099e592da369591297882552746c0
MD5 fb91e97b5d6c74afa31c69682b69115c
SHA1 c5c4ed5b93a1d2c9f516545de033566e1c3f5ad9
SHA512 019a1fd4c5b7ca5ff812ffed8e30b247c3e98d6295a9fcabe03c67b17fdc56731bd35e6b8580f9cd5fce647236f8afd43e07347ab9372ed9de34862257979e7b
SSDEEP 192:PRpX/I5RjzJBv7MF+pAPRp2n2c9HHsb+WNnMLzVqZ2K34kwNGayfkCqitVyIsnA4:PRpXERhRgoUXiH1wAz+2PIayfLq08
TLSH
T1EE42C66EED14697B6CCBC22AFE127B17D7F5102165C42E84EAFD8A1C14E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bda7bdb68c86caa2d84c4a644639cb62839e1d3d1914cd18935e2c56a60ce56b
MD5 69d2f357fd0db9adba6986614381a130
SHA1 ab937ae6568b533acdd5487273e550e9bfd6d67d
SHA512 8c275350a29472f93467e6201b25c2f27cc179d15d16d2144907ac1f5aab0f4dbb66bbe631c29c497187a6bc9b5bd11d76074390cee3a17b8394f50ce24c62d0
SSDEEP 192:PRprPs0ar3zJBv7tF+pAPRp2n2P9HHsb+WNnMLzVuVVa534kwNGayfkCqn0tVyI6:PRprwRxoUXik1wAzuVayIayfLqnOe
TLSH
T13852C62EAD15697BACCBD22AFE127B13D7F5103161C42E84EAFD8A1C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 54988db6a011bb5abd2d5b73b5edd897bba2ac8037dd19264e5b86fe5ee2ce56
MD5 d8388fdfb5a4e188b62794b7ac65b975
SHA1 555185c20db1d1260deea353ad5499322a3032a3
SHA512 97851dd1f94edf84c1bade5d0f31144b8ca90aa0dc8efcee7af153d4d8d3b86ba67e721992d525936483004f9cebe16dfa1cc159fedf35ff8c443d64c7633c81
SSDEEP 192:PRprPs0ar3zJBv7MF+pAPRp2n2P9HHsb+WNnMLzVuVVa534kwNGayfkCqn0tVyI6:PRprwRgoUXik1wAzuVayIayfLqnOe
TLSH
T17752C72EAD15697BACCBD22AFE127B13D7F5103161C02E84EAFD8A1C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 50002e456ee027781f548d219a281e089e52ed13a749f020bf6414edb4f8dfac
MD5 ed48d2af700ef4a27285fa9496b21917
SHA1 fed6b83a4bf09c8b06695360626015a6ce2606b1
SHA512 d2da8eb6384f6794f392e251b4202ce575dffcc3f0190f3762694365d78920c978940ede1e067da3654e8268bb9cc243185812d8bf62ff6bebf98a1ab1680aa9
SSDEEP 192:PRpXPs0ar3zJBv7MF+pAPRp2n2P9HHsb+WNnMLzVuVVa534kwNGayfkCqn0tVyI6:PRpXwRgoUXik1wAzuVayIayfLqnOe
TLSH
T10552D72EAD15697BACCBD22AFE127B13D7F5103161C42E84EAFD8A1C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 918d8397b7b4502c5cb9bbe45cb3ae3ba1f986a69649de52ac688361dd2cfc1b
MD5 973a7e71acaef98491f8774f05f26be6
SHA1 72df9658826964943cffb50c6c9969a68c6270c9
SHA512 728da0f1d0b9b49d5a691ab1d6b822d433ce4b3a6239b52744ff205a603e3983cc2999527a1d7ab6937876b9b59d5edd038ad18e25274f325e9fba9ab6bc17e0
TLSH
T193B012C080015105CC1302F41292659CB1189F10960E2745D3E069668836190C024050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589361.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589361.TMP
Size 96B
SHA256 1d7c25e9e5c1350f7fdeeb30cbbc24dc4d367ac9ce779aee30e52045af163063
MD5 08d848770c136a20407a2ce5c16f776a
SHA1 a950f4ff9ba229e47c51b1f5e3e5f8f6c0aa3fee
SHA512 8494b07504ee6deca28ff31a52b43a813b3a856ed2cdd295db9c5d4c8d40b93f0b0afa3aa70567032799deb13387f3d1aebf143f7e0a50958aaaa1ca989bfe21
TLSH
T158B00256C1026212C04643F03D9595D87160EF76CF43125A92F01B77DC356A19526561
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 e38f2db9d454f6716f71f845d823891837d78e3c86f94518d6c0802ab997a177
MD5 8f01d8f2090fd40baf98b392678fe58f
SHA1 83bd0c1bbbceea52dbe1605b2a5067228dffa787
SHA512 be80606a0e00f370c2976c677d1fcc5f4c29cb972e7b7752d590440a0f679e1297328dd917e8c99c11529fbc185edf37f4e6634263736848d9757214e0b203da
SSDEEP 6144:bcOUxnhyHltj38EBTmnC+Mm7Rkm1tYpBeh2BAol:byM/8ESB/9oBGcAol
TLSH
T1CE3412776D36BC739E98E71E604E222E1FF28DB78919CC99E4D42E042BEED450A05D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 7ce1d0f7c07e1e04e2778298c376e3f4e57b029ea2ffd9e27ac371ba3937d97e
MD5 b88d8fed5c63bfd5506b292c7037aed3
SHA1 2e70cc153bd0ea2ad53c5fbf661f859db49a5d2c
SHA512 6ea65a063b3d91bca37cf1f1e4ff4ecf488b930a5a773e78ecdfa5aa78f16199cd78bf4de1f251e144b744ee148cb1c331b067a3968d407353ca9edd23a84cbb
SSDEEP 6144:6wUxnhyHltj38EBTmnC+Mm7Rkm1tYpBeh2BAol:6fM/8ESB/9oBGcAol
TLSH
T1C53412676E36BD739A88E71FA04E122E2FF28CA78929CC99D4D41B442FEDD490605D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 f758a98a825e3d4f21b7ac9fb8232e215c04a85b02398841bcf176d87edb3a88
MD5 caacedeb46e01d10d3fd176a9dff8ac9
SHA1 8ff85be3f6fdb77abd428a04be6aacb75a69259e
SHA512 7534511e0108ca15243b97157994dc172303dbe39f2ad06313cf1ff41a13ffcf89fd1909de48c322a03102371dbb81bd06bdc155c2dbdc8b01c6382843cf2349
SSDEEP 6144:bwUxnhyHltj38EBTmnC+Mm7Rkm1tYpBeh2BAol:bfM/8ESB/9oBGcAol
TLSH
T1203412676E36BD739A88E71FA04E122E2FF28CA78929CC99D4D41B442FEDD490605D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 277KB
SHA256 6942eb404cc1ab2c70e1d91fc1df323fb6e4da6b6a93bb627af6b5f95214e523
MD5 212be9cfce28082fd7a1b7c484b2ec1f
SHA1 60455f50631e9ecac23be3cff2f54004cc74658e
SHA512 dd186c2908b6afc9566eaaa6e579333d629c48e5630874e00c05cbdead66f1a83511d02bb25f71842ce56518db1ef47a29fd58dd360dcd8f8383f92859cfaeb1
SSDEEP 6144:boI/w9tPPHBUxnhyHltj38EBTmnC+Mm7Rkm1tYpBeh2BAol:b49VuM/8ESB/9oBGcAol
TLSH
T13D5422366E26AC739A98E70E504F211F2FF1CDFB8A2CDC99D4D42A402BDEA451B05D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 35b3d4f543f93948d62dec77b1a9ba94a9084bade9f78748e240bc074142eb95
MD5 06a50d1f4aaf0977e5dcc4169da4e55a
SHA1 65a365203f96167f9b195f4937df2cf46c5de0c5
SHA512 566a414ac483b60fc3d3f30eaad90eb3a204d9ddc74f26ba57a5a64bc2c1a006deff72c955bfe28ece853034dd9ac1c044d3ee21a572673507e4327aa76f44a9
SSDEEP 6144:TBWUxnhyHltj38EBTmnC+Mm7Rkm1tYpBeh2BAol:T7M/8ESB/9oBGcAol
TLSH
T1243412776D36BC339A98E71EA04E222E1FF28DB78919CC59E4D42E042AEEC450A05D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 263381d02c2fc4793afd5fedeca03c8ba7b7ebb791c37cfa4d91e1009b80fcf5
MD5 f838202c103c74b8a265786fa006b58c
SHA1 7030e75e162347800caa420527ddde9d3a956929
SHA512 5524530babbcd97008e969db396e57d0fe59d02ad1b252c187011395964e88b8429c9382b12385c9182b1f94fa6afc2ede8f2c3e16a5dd19717baf003aa597c0
TLSH
T11681EF323275B1D8C9167F071A6C158463BF4355FA54AF58B25C625EE92600B9F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1c253e447b78f8cfa704dbc6ae3237cf58eb67643e4b75aaf5074453163ff1d
MD5 41d8d676919b91f706dea5f271a648ab
SHA1 c77edec7b02ed750983579928937818286487fdb
SHA512 d1b2ea5ea3a157ace516c9889fd7e609cc8f570ef79cee40283fad5f50e68ff1502ba9eba27532155aa4d9e001fc4cbd590b5a3e77fefb952c4c0d5ace4594b0
TLSH
T10B219727F39C8A21CC96053A109DAD5532B286E7809ECE9BABC4C618E17F494CB62590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1fd17b37aa7cc0585effcaa76371c5fa81dc13882a4b329c4643319c5a75a12c
MD5 b64f2724b81192f90d710f6f1e9a869e
SHA1 2f6e430d96c4f8e7105a313a927a98e4473e6e7c
SHA512 09cd5a102c4bea2f3e547746e63f08be50b787b93a7e76112e993370dee29e7f6c5c2144ca23e2ae766b23c83706a8c8397c8913c5d583f44a3c5eaa4243c84e
TLSH
T10221A927F39C8AA2CC96013A109DAC1472B7C6D7809ECFCBABC0C618E27F594CF61590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 27dc4899e47068dbcbabe4e37b78348a9e1494ccb04bc9426c1427db7b421195
MD5 65dcaf1e6f3c83da810fd977199274fe
SHA1 e576f61abe949fa3a4f1b05db86ab992371ca312
SHA512 111d8310ff42c3f5e6e85a81f08bdc9b7405d70da3457a582eb9ca621adc1737761da1fdfe6ad9e4adbbacd499a1ae7865fa0c73ff8a175008713df152058a6f
TLSH
T175219727F39C8A61CC96013A109DAC5532B686E7809ECEDBABC0C618E27F594CB62590
MD5 SHA1 SHA512 TLSH

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp1_loader.zip\loader.exe
Size 18.0MB
SHA256 18deeedd2e337f6da7ea21f687d209bff4943a6583089f0bfcc6d7e2cca75455
MD5 1f1d50205d5903eddadceeae79d4151e
SHA1 ad52322cff0d987370b21d49490cd34d17e9ce18
SHA512 b2b8c1e8e9b3fc7006b0bc310d3468bbfdfc44fb43a99aab3e0a26c71f4b4b13b78f0029c6097c789b2ed02a73b07fd43fdb555d7674595b16688d5ba7b33284
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Yw3:ee3Zqd5My9lqnSw3
TLSH
T1EA1712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp1_loader.zip\loader.exe
Size 18.0MB
SHA256 28fc0ae59780eb720c1512ab53bc9e7b963c6bb7b3c0716eb6247b4a4fe202e6
MD5 326e96e6749c3a2a18cc32103b74222a
SHA1 a551244ff4fd1f696b597f54e531dfe735af8628
SHA512 cb0405047bc1d62715b1409605816706a72cb21b5fefb346cd13b90d560423e93d8154b5ac34f655f23229821ce28b6f6f94a9d6b15b84881be0b21a4e845614
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Ywq:ee3Zqd5My9lqnSwq
TLSH
T11A1712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

report.cdr

Path C:\Users\Admin\AppData\Local\Temp\Temp1_loader.zip\report.cdr
Size 3KB
SHA256 10cf0c8de9b4fa5f3542a869a75243f9cc9bf6e543645f636fda26d31347923d
MD5 9e09770e5c7ba0c90aac6afb9db71c51
SHA1 8d5711d0a9d3518adf8b83d078508507e2274ff7
SHA512 27d630410f6c08b000195d393a46ba8165f1b73f2d7a32992d96f706aa61eba09e4dfef301abf2cc8890cf441359b0c7a579d509a61b827aab71b43c987ff466
TLSH
T1B5613A0CA412E2887DAC49C6FC3008436F8E5999828CEED8BC525E2D4F28E1B7720AD5
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_co055bpq.hbp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_co055bpq.hbp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

loader.zip

Path C:\Users\Admin\Downloads\loader.zip
Size 15.2MB
SHA256 d9fd29f0ad31d5d80267d608c6293e808cc495453d4a89afd87b85ab31628d5c
MD5 9a4392d40471bc522aabcc92d234d175
SHA1 21eda9872da4312a90878ff05ca96cfb1abb0b8a
SHA512 33ffa1496275fb044555210451c543e02f4b274ab37f21f5683fc4a5c4a007aea3589659748e2e3e9964c0d0ca4f5102f1656061b8048124ccea58470dad01e8
SSDEEP 393216:k3rxyTxxywrX4MD4DtAjgT8NhqYbYMCvQPWlGMyVm1j8M4A:g0XN4DtA+YbY5oPdVm1vB
TLSH
T110F633F54D33F5B3979319B8B788225B18DFB4BB8865028A7285FB1C86D40894F6D339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\Downloads\loader\loader.exe
Size 18.0MB
SHA256 ab4fd090fc6710c0bd62c9099ee2b17c0091b328ea0505005816121b3981ff99
MD5 b6fb2f1ce15d4b824b72928dacbaf50e
SHA1 062fb1e1670a6a218667903d31dd088ccd836bd3
SHA512 1ba3eaa3acf468a064fc81f5676fcd77a78c01f2a00f201172e114b33b4ab071ba873a786e536c7596737ddb9e9080239642b27ffcc338e904be699aee09ff1a
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6YwI:ee3Zqd5My9lqnSwI
TLSH
T1F61712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\Downloads\loader\loader.exe
Size 18.0MB
SHA256 669d7520a0e0bae5792d73211196ace389eab44aff116cf3bad02cc523c125b4
MD5 8de289e2b47351b9ad8e732ef0ed710c
SHA1 c5bc04ae4fd6bb1abcfa186b7c11749deaa53a62
SHA512 208cfedf28d6d744e208a6c054d17f827df85a0c4e95415b6a08edad8cf4d8e0b8d14da129a8712aa5d4bf2610d41d7d8db05d24b0261413850a5f61cf2f6bf5
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Ywx:ee3Zqd5My9lqnSwx
TLSH
T1711712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\Downloads\loader\loader.exe
Size 18.0MB
SHA256 7a826b94744fd66d1d7f884222d7451c20feebbe7497cc72689d306dc9cd1074
MD5 ec8f408123c35d550f7f89ef8af35022
SHA1 6f15dd42ff52a2a6341641f3a5d3b4a0fa5d5c60
SHA512 fa16424e4c660748500488d7a914e6df793c5db73519f2d60ce5f857006b120a92e770d36d2dd61c4755a904cb0225b15181c186b0013cc1a811600090c2a3c4
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Ywb:ee3Zqd5My9lqnSwb
TLSH
T13F1712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

report.cdr

Path C:\Users\Admin\Downloads\loader\report.cdr
Size 3KB
SHA256 4a8c597554d35324c4e907745860e17c248fe33f7bac141452d46c29949e05db
MD5 645f75b761de9e4d4fb498f0badd3cf1
SHA1 2aed254475dd1e76c5a79b6aa3b77760139bac68
SHA512 61955979fa2a59b343205df28196d13cef31328e892523ae1e8d57615f473c3dbc9aa384a132d7a0042f5a74e1c61318cca2a5949798fe1816611459f90ee469
TLSH
T10A61390CA412E6897DAC49D5FD3009536F4E5C99828CBED8FC529F2D0F2CA1B7720AD5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1008-314-0x00007FF71BDF0000-0x00007FF71DFDB000-memory.dmp

Download

memory/1008-306-0x00007FF71BDF0000-0x00007FF71DFDB000-memory.dmp

Download

memory/2176-205-0x00007FF6EE080000-0x00007FF6F026B000-memory.dmp

Download

memory/2176-181-0x00007FF6EE080000-0x00007FF6F026B000-memory.dmp

Download

memory/2412-237-0x00007FF7A2090000-0x00007FF7A427B000-memory.dmp

Download

memory/2412-229-0x00007FF7A2090000-0x00007FF7A427B000-memory.dmp

Download

memory/2512-301-0x0000023C2FAA0000-0x0000023C2FC4E000-memory.dmp

Download

memory/2512-303-0x0000023C2FAA0000-0x0000023C2FC4E000-memory.dmp

Download

memory/3360-170-0x00007FF68B150000-0x00007FF68D33B000-memory.dmp

Download

memory/3360-162-0x00007FF68B150000-0x00007FF68D33B000-memory.dmp

Download

memory/3452-280-0x00007FF794C60000-0x00007FF796E4B000-memory.dmp

Download

memory/3452-296-0x00007FF794C60000-0x00007FF796E4B000-memory.dmp

Download

memory/4628-269-0x00007FF790210000-0x00007FF7923FB000-memory.dmp

Download

memory/4628-251-0x00007FF790210000-0x00007FF7923FB000-memory.dmp

Download

memory/4744-271-0x00007FF7F1840000-0x00007FF7F3A2B000-memory.dmp

Download

memory/4744-279-0x00007FF7F1840000-0x00007FF7F3A2B000-memory.dmp

Download

memory/4904-343-0x000001C970A30000-0x000001C970A31000-memory.dmp

Download

memory/4904-353-0x000001C970A30000-0x000001C970A31000-memory.dmp

Download

memory/4904-383-0x000001C968FB0000-0x000001C96915E000-memory.dmp

Download

memory/4904-342-0x000001C970A30000-0x000001C970A31000-memory.dmp

Download

memory/4904-344-0x000001C970A30000-0x000001C970A31000-memory.dmp

Download

memory/4904-381-0x000001C968FB0000-0x000001C96915E000-memory.dmp

Download

memory/4904-354-0x000001C970A30000-0x000001C970A31000-memory.dmp

Download

memory/4904-348-0x000001C970A30000-0x000001C970A31000-memory.dmp

Download

memory/4904-352-0x000001C970A30000-0x000001C970A31000-memory.dmp

Download

memory/4904-351-0x000001C970A30000-0x000001C970A31000-memory.dmp

Download

memory/4904-350-0x000001C970A30000-0x000001C970A31000-memory.dmp

Download

memory/4904-349-0x000001C970A30000-0x000001C970A31000-memory.dmp

Download

memory/4964-204-0x000001B9E6C20000-0x000001B9E6C42000-memory.dmp

Download

memory/4992-322-0x00007FF6CA440000-0x00007FF6CC62B000-memory.dmp

Download

memory/4992-315-0x00007FF6CA440000-0x00007FF6CC62B000-memory.dmp

Download

memory/4992-332-0x00007FF6CA440000-0x00007FF6CC62B000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads