34b4c63c325e40342352d3caf3624f8a72be66782b5814ee17f1675e95ac7439

Resubmissions

31/07/2026, 14:30

260731-rt8evswves8

31/07/2026, 14:27

260731-rsgkrawvat6

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
269s
max time network
273s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nico.cfg
Size 288B
Sample260731-rt8evswves
SHA256 34b4c63c325e40342352d3caf3624f8a72be66782b5814ee17f1675e95ac7439
MD5 3a2da1e9d7d2d3fdcb802c1585d941ce
SHA1 d79bb195cfce4340f72852c500a33f7c8806d2b7
SHA512 d14eed309a510d34041c1c7f9aeee1ea00df85409528c96157e691622c570c9c03010c0df0cd3435df615ad052f29b43708da4a05264118993e136024338715c
TLSH
T131D0EBCB63E02C93F00B0BF95D9EEA000B8593888376C3811A8CAC29A7A6084C07B130
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
92	1568	chrome.exe

Executes dropped EXE 5 IoCs

pid	Process
4112	volt.exe
5984	VoltShield.exe
5412	VoltShield.exe
4288	VoltShield.exe
4040	VoltShield.exe

Loads dropped DLL 64 IoCs

pid	Process
4112	volt.exe
4112	volt.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5752	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	drive.google.com
33	drive.google.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5984	VoltShield.exe
5412	VoltShield.exe
4288	VoltShield.exe
4040	VoltShield.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	volt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1568	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299818470858296"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	VoltShield.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	VoltShield.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	VoltShield.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	VoltShield.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	VoltShield.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	VoltShield.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5412	VoltShield.exe
4040	VoltShield.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4132	chrome.exe
4132	chrome.exe
5984	VoltShield.exe
5984	VoltShield.exe
5984	VoltShield.exe
5984	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
5412	VoltShield.exe
4288	VoltShield.exe
4288	VoltShield.exe
4288	VoltShield.exe
4288	VoltShield.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4040	VoltShield.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4040	VoltShield.exe
4040	VoltShield.exe
4448	taskmgr.exe
4448	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4040	VoltShield.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe
Token: SeShutdownPrivilege	4612	chrome.exe
Token: SeCreatePagefilePrivilege	4612	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4612	chrome.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4880	OpenWith.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe
4448	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 5996	4612	chrome.exe	91
PID 4612 wrote to memory of 1568	4612	chrome.exe	92
PID 4612 wrote to memory of 752	4612	chrome.exe	93
PID 4612 wrote to memory of 752	4612	chrome.exe	93
PID 4612 wrote to memory of 4192	4612	chrome.exe	95
PID 4612 wrote to memory of 4192	4612	chrome.exe	95
PID 4612 wrote to memory of 2656	4612	chrome.exe	96
PID 4612 wrote to memory of 2656	4612	chrome.exe	96
PID 4612 wrote to memory of 2396	4612	chrome.exe	97
PID 4612 wrote to memory of 2396	4612	chrome.exe	97
PID 4612 wrote to memory of 3192	4612	chrome.exe	98
PID 4612 wrote to memory of 3192	4612	chrome.exe	98
PID 4612 wrote to memory of 3792	4612	chrome.exe	99
PID 4612 wrote to memory of 3792	4612	chrome.exe	99
PID 4612 wrote to memory of 4276	4612	chrome.exe	100
PID 4612 wrote to memory of 5548	4612	chrome.exe	101
PID 4612 wrote to memory of 5548	4612	chrome.exe	101
PID 4612 wrote to memory of 1048	4612	chrome.exe	102
PID 4612 wrote to memory of 1048	4612	chrome.exe	102
PID 4612 wrote to memory of 4452	4612	chrome.exe	107
PID 4612 wrote to memory of 4472	4612	chrome.exe	106
PID 4612 wrote to memory of 4452	4612	chrome.exe	107
PID 4612 wrote to memory of 5816	4612	chrome.exe	108
PID 4612 wrote to memory of 4472	4612	chrome.exe	106
PID 4612 wrote to memory of 5816	4612	chrome.exe	108
PID 4612 wrote to memory of 4552	4612	chrome.exe	109
PID 4612 wrote to memory of 4552	4612	chrome.exe	109
PID 4612 wrote to memory of 2732	4612	chrome.exe	110
PID 4612 wrote to memory of 4400	4612	chrome.exe	111
PID 4612 wrote to memory of 2732	4612	chrome.exe	110
PID 4612 wrote to memory of 4400	4612	chrome.exe	111
PID 4612 wrote to memory of 1700	4612	chrome.exe	113
PID 4612 wrote to memory of 5944	4612	chrome.exe	112
PID 4612 wrote to memory of 1700	4612	chrome.exe	113
PID 4612 wrote to memory of 5944	4612	chrome.exe	112
PID 4612 wrote to memory of 1324	4612	chrome.exe	114
PID 4612 wrote to memory of 1324	4612	chrome.exe	114
PID 4612 wrote to memory of 4080	4612	chrome.exe	116
PID 4612 wrote to memory of 2548	4612	chrome.exe	115
PID 4612 wrote to memory of 2548	4612	chrome.exe	115
PID 4612 wrote to memory of 4080	4612	chrome.exe	116
PID 4612 wrote to memory of 1384	4612	chrome.exe	117
PID 4612 wrote to memory of 1384	4612	chrome.exe	117
PID 4612 wrote to memory of 4932	4612	chrome.exe	119
PID 4612 wrote to memory of 4932	4612	chrome.exe	119
PID 4612 wrote to memory of 4364	4612	chrome.exe	120
PID 4612 wrote to memory of 4364	4612	chrome.exe	120
PID 4612 wrote to memory of 1844	4612	chrome.exe	121
PID 4612 wrote to memory of 1844	4612	chrome.exe	121
PID 4612 wrote to memory of 4156	4612	chrome.exe	122
PID 4612 wrote to memory of 3192	4612	chrome.exe	123
PID 4612 wrote to memory of 1700	4612	chrome.exe	124
PID 4612 wrote to memory of 3708	4612	chrome.exe	125
PID 4612 wrote to memory of 3708	4612	chrome.exe	125
PID 4612 wrote to memory of 2528	4612	chrome.exe	126
PID 4612 wrote to memory of 2528	4612	chrome.exe	126
PID 4612 wrote to memory of 3928	4612	chrome.exe	127
PID 4612 wrote to memory of 3928	4612	chrome.exe	127
PID 4612 wrote to memory of 5400	4612	chrome.exe	128
PID 4612 wrote to memory of 4512	4612	chrome.exe	129
PID 4612 wrote to memory of 4512	4612	chrome.exe	129
PID 4612 wrote to memory of 4876	4612	chrome.exe	130
PID 4612 wrote to memory of 4876	4612	chrome.exe	130
PID 4612 wrote to memory of 4500	4612	chrome.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Nico.cfg
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:6080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff90271c728,0x7ff90271c734,0x7ff90271c740
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,15579035799888850253,9543132747377786419,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,534607844718567788,13293301188977014994,262144 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1692,i,8721067442590056044,11445663339085587173,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,17437126287698563683,11649667812657733171,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3316,i,3348828006814712309,16673551671898554072,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4716,i,8977987652514775438,8108140500365095190,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,3566575163362999972,14646726919465828802,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,12757638909401831135,17382757459758094151,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,629496015435235279,3967818759700054215,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,7229925169100714942,10076111159206444173,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5856,i,10893279073050829867,7707208083422242136,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,17206333167932859846,12765266699382925411,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5392,i,14155651767285565765,11965634771842227750,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6236,i,16061068472180878161,893687293101983778,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6184,i,11478949271827935273,17573392034856102184,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,2632488065219183728,6994370293559070609,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,9239367958699637839,11376223876061872143,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5668,i,16140674188800933446,798987426831326326,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6352,i,11602060884816989731,14591500203070958027,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4856,i,10302760141229031964,15103281307782670714,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5684,i,1643287461911188503,5630936671987275169,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:9
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6140,i,7583628263253313579,11968676474943105552,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6360,i,10842545300005300788,2084427021062081159,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3620,i,384273091270287493,14470457800091961556,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5988,i,9693070356592151607,10549951226897146902,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3564,i,16406806285995186568,13865614198096705330,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,10104611207767141327,3650125958022420332,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6484,i,6006946372886824751,13321063100062971552,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5764,i,3698249223031422262,11036688104396282699,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5524,i,17043864598034593982,9652758404022081031,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5444,i,8229766202749205262,4283997678297521688,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,12989534056689488817,8610472725902373743,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6480,i,12380358101664690937,8119906182646744703,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=900,i,2081740259494984247,5080473378505027907,2097152 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,6290864099928254082,10818870872642883760,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
  2⤵
  PID:4500
- C:\Users\Admin\Downloads\volt.exe
  "C:\Users\Admin\Downloads\volt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6156,i,10058631681875066801,8655956587890602642,262144 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5908,i,15914398666122979633,1090746629323316959,524288 --field-trial-handle=1992,i,14471493174710067861,5598348317521306597,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
  2⤵
  PID:3472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2596

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\VOLTSHIELD-ALLVERSIONS\" -spe -an -ai#7zMap23022:106:7zEvent26517
1⤵
PID:5328

C:\Users\Admin\Downloads\VOLTSHIELD-ALLVERSIONS\VoltShield.exe
"C:\Users\Admin\Downloads\VOLTSHIELD-ALLVERSIONS\VoltShield.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5984
- C:\Users\Admin\Downloads\VOLTSHIELD-ALLVERSIONS\VoltShield.exe
  C:\Users\Admin\Downloads\VOLTSHIELD-ALLVERSIONS\VoltShield.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  PID:5412

C:\Users\Admin\Downloads\VOLTSHIELD-ALLVERSIONS\VoltShield.exe
"C:\Users\Admin\Downloads\VOLTSHIELD-ALLVERSIONS\VoltShield.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4288
- C:\Users\Admin\Downloads\VOLTSHIELD-ALLVERSIONS\VoltShield.exe
  C:\Users\Admin\Downloads\VOLTSHIELD-ALLVERSIONS\VoltShield.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Set-DnsClientServerAddress -ServerAddresses ('8.8.8.8', '8.8.4.4')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5752

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2756

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x0000000000000498
1⤵
PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 960B
SHA256 40b150e7250940c6d70d20caf93beba982554afc5a8c0c662c2424b79ef6e2e2
MD5 650f0f14f6240cdca54c93bb41a2ccaa
SHA1 1515c2bdc46dbd3079ce0f8c8725e311a2ee8a55
SHA512 7b8fba5754087d8fede7fad00e389c6299b3b8b775354b7362b53b33e35446415fd750026d8feed592693aa2f187dc652676eea1145ea6c1a904dc1f52cd049b
TLSH
T1B5114105BF9EA084CB481BFB1684BCC02530008903C34ACF8F984DF46B223AE21C21E8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 2db6994b77fdbd881f589903fbcae22648dc46883763810d3078739f728f85d8
MD5 2daa13e65e2dc04572d9a3062d9c302b
SHA1 d19fe1f7d4fb697ac8990bb7731ae5cd0c2d5eae
SHA512 6a4aeae74f50bbd59f20f5dfb1d33c95898ba6973b57f12a2473fecc58242984d507443a66814d846ed213f376fee5f825ea4a3fc545ba6893fd265c5831f246
SSDEEP 192:DTqoDKf6hGzPuqFhPshSYNmcYDojQu/U0SQLS6cmjfaDrZyCMhMRp:DTqoDKf6hGzPuqFhPsIYNhYDojQu/U0k
TLSH
T1B4229BF7C7E8862DC85156F89B15AE1FCE2E0A14531C3C26C8D8AE5B93E2471E21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 416fd99a8c1241766bbcc5f2fa0b30a75e06de3c9fe6b798fd049440119c7151
MD5 d477c2f68487878124cd23d3c0b61b65
SHA1 f379cea481f2edf8b1a9bd8738aa378a0a3598b7
SHA512 a06d1e40e62da1e51c995b99d434f44d73b7b73f407b1ceafacae880518c088750b470816baa890e354502dd16eafd3cab2c395d31fe4e65775d024983424e35
SSDEEP 192:DTqoDKf6hGzPuqFhPBdhSYNmc3ojQuV0ShS6cmjfaDrZyCMhMROE3hU/:DTqoDKf6hGzPuqFhPBdIYNh3ojQuV0SB
TLSH
T1BD32BBF7C7D8862DC85156F89B25AE1FCE2E0A14131C3C26C8D8AE5B93F2471E21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c84a721bb398546829055710ddc3bcd30174f2867389b2645a33c035fabe1ea8
MD5 4738d9feb0c2ee00e15b2ddcdece2d29
SHA1 72e1f64d0eb14820181e1483702664b6e109f685
SHA512 50592c85df7490d7cb9d3eb0a9b8d5b8ffb26d6b206159123f56f1071b2ade20e1304a2bfbb95800d66647634796990dbb26f4d3b60ca59926eaaf1660cd59ab
SSDEEP 192:GRfua6Jv7pAPRp2o9XxHsb+WNnTzd+Zc2J40kwlVyIsnAUge:GRfuFJAXjfw/dF2zze
TLSH
T15632B83EBE10653B6DCBC22AF9627753D7F6102175E42E44E6F88A2C15DB5CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a2ec4bd018f26f64c01bb0afa32e46379e636c01bfab348c7730e66046b6abfe
MD5 f062c85cb1190f0825a47176f2555c55
SHA1 0586bdbe2c1de1f9f8f8b569091a0d3c64808e84
SHA512 24bf0480e85af789d1bad76d2f2abac56c10cf8c3e6d38ccb74e4e28594c6a81a59d6fe5055f4997d9e993c7061818ef75b12524f6468fd8bb0d311428675e1e
SSDEEP 192:jRscBzea6Jv7yHPRpTmxdtaGc9XxHsb+WNKunfzUg+Uo2/Zc2J40kwDNVyIsnAUc:jRsmzehJSXOyfwxT+222zjbvb
TLSH
T12952B62FB920693B6DD6D22AF9527756E7F6102175E02E84E7FC8A2C11DB6CC2217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 242936b497e10ef4c603400c6657c8500803c1543afcfa307257b622828e3015
MD5 e24e24a7a6dfeb92a8d3b89ae2b1e6c7
SHA1 b755ef82c944014d27ff611a57a548de48432d87
SHA512 7ad20abf89d81e0064853e99c9197864ed96bab21097de7e8d0ccabc32669b2f4cf5ac0cc57879aafa7fa37686f67e91dd720f503df6612efa0c20ba1a8cea3e
SSDEEP 192:jRfua6/v7yAPRp2mxdIW9XxHsb+WNnnfzUg2YZc2J40kwRNVyIsnAUgE:jRfuhXPXFbfwfT2v2zxbE
TLSH
T1A042A72FBD10693B6DDBD22AF9527757E7F6102171E42E44E6F88A2C11DB5CC222780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9a89b12c7c046e06000fc512fb721aee7f65cb33b277c11ee24e00e34a2800b2
MD5 f06c717f293084d067fec9ad55a25d0e
SHA1 d5f45de2d1f8fd26df1c804ee3248d62cb9a1a45
SHA512 e2bedb61f95aec225370ec65f560f6c5883272cd35daff8ae27f6362b58c24d95b5635088289749727674f34812908455e3d0ecdce0955550444c12abf3b059e
SSDEEP 192:jRjcBzea6Jv7yHPRpTmxdtaGc9XxHsb+WNKunfzUg+Uo2/Zc2J40kwDNVyIsnAUc:jRjmzehJSXOyfwxT+222zjbvb
TLSH
T12C52B62FB920693B6DD6D22AF9527756E7F6102175E02E84E7FC8A2C01DB6CC2217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3c05e194e56c2e2d35704c93da6819502e2e77fa55c8226f8b3605bec6acd311
MD5 33f886274f83bbd55c8c9d144c0b31b8
SHA1 b886227f18ab9feab02fc10fed6e8615cf7a33e6
SHA512 106b3e6ffa9c15ebbe5c97df255f2ec6b2ca02c44f8c166e29b88aad4d28e6b8e98a3844e64853d3b85db6afc907596791424a5d8b31fb5fb3716e4009a2c53f
SSDEEP 192:GRfuaJdv7pAPRp2mxdIW9XxHsb+WNnTziUg2jZc2J40kwlVyIsnAUgE:GRfuidAXFbfw/O262zzE
TLSH
T11D42A72FBD10693B6DDAD22AF9567757E7F6102171E02E44E6F88A2C11DB5CC222780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e5e26f3ee3432605870de883096e0faf068e54975223f6ee8746541c6dd62469
MD5 1a0c6ed993e64d97c2221c4e50ff17f9
SHA1 0a276ef829b27f2e70aacf46d1b80afdaaf07a66
SHA512 0ee0e67c82feb2fca53910184ca933d7708fb05a6444da1352690bbd316926c9b4375afc6f289b6f40d96b4ea3eff95c26894075a00cf650f748c4a3d56db41c
SSDEEP 192:jRfuaJ/v7pAPRp2mxdIW9XxHsb+WNnnfzUg2YZc2J40kwRNVyIsnAUgE:jRfuiXAXFbfwfT2v2zxbE
TLSH
T12542A72FBD10693B6DDBD22AF9527757E7F6102171E02E44E6F88A2C11DB5CC222780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 53d282783806dcaa0088b6fad3d1865445c738bfd2989df32778986698825a07
MD5 7071f2613dc0f7c214018e70f41c3436
SHA1 8d89afe5f526384c45a2fd49278d7b8d95bef5a1
SHA512 12933d2300f1b10674d95fc93203c7248a0062829ad499da22b22ffae96d5747a0a28cdd9d283a3b074a33c8f37fc0a5c132f40a90bfd1eccdff2744532b89ae
SSDEEP 384:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTXOD0b+ErU3WZHGSEM8K:/d0X7KxkXqKf/pUZNCgVLH2Hfgs77O4N
TLSH
T1CA520927644D9A3F0FD8D64DDC166F4FADF60146A6B8092493FA5D0803A97CF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 8156f7591386761a251f664908fa80e171796b5566e392d479b31a1691513c48
MD5 5bc5b668691c339d1bd35266c81996d0
SHA1 85a249c79a7983983cc066f285764dff4a63ca1f
SHA512 1367c91aedf14d6fbe1460053637cd8c7c33d95644a6453747805887267d45cb377ebec32c74b61cb4d237a9d4f9703fb41e29a7f2b04c69753dd80ae4b5218d
TLSH
T1B5B002B614410522DF09837827E159893B7D0C531786C137E7F025B5ED72747E3E1B91
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 126db0d95889d1b38289406836135e6fb974831cdd3026d3ee1cfcdd88a5ee5f
MD5 bca06d7c69cc55d04316447797d98ec9
SHA1 17ad645fe15ab60df610f7fbe833f178ed798304
SHA512 0039c7d2aa1d64a1170fb4e65cd3680fcb8a7ba73830a7c4911f78340b42c72c836f8ee3a01b44bce0f1aada6ef204fa77b42ee5d75e50dca6e468ce26d2d413
TLSH
T1C0A0021145C08511FD089271E4A115537B915C559A9183439CD518E48D5F1F59B42245
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2462.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a2462.TMP
Size 48B
SHA256 a7774fee1948b7028e0a1b57bc568d63d5a77250f76e4bacab2574f623edaa72
MD5 39829aca2f700c2a80bf549fdde12c06
SHA1 fc9e9b89f5167ad5bf7da3390261c24809072c16
SHA512 8627dad4b6601b573e9d7785847c88d9ec06933c40544e77b82f856bfacc17ad2faf16aa73d5cb0a89c57157b0846f92a11dcf464162b19bfa43b36a5f14d898
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 13093a3b300adac6832dda88d58e93861043cabe07628080ac123d7aee036812
MD5 1eee1dc58afb12fbddf6ab6d6d07eb2f
SHA1 447eddbc58b1fc028827c314e3930650e62e62c8
SHA512 dc6b5e175fce6e6be265f5e518db82bc136f52b2d6ac492e7f616018a8e7f6c8acc94e9b0343e9f8288331e6ad835502a5746106f9a49b4115e0485e18769ab9
SSDEEP 3072:syMTHfDL0Qs395M1FrbbNEzHj7AaHE7cWuK05W7e:stHfDL0L3IFrHNE37LHWuPr
TLSH
T1B6C312B83C705CDEEA25E912F111392B5CC9F44BA28C6E785D505C8A0D9FBED422BD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 8fd03537ce8c3a4c924e8c94684ed560a3f142758192623140b850cdc8f8cbd4
MD5 7e8c3e5b1cb0f15150795de8fa5b2aa1
SHA1 feb642c4c53b120dcfad04c9ba5b51d1b00744d7
SHA512 83ea9da30bcf584205987b3e85bf441262ead16adb96962f4c1b2471d409d60355ed5f2403347543809ae4e8c3d2c7bf8e457d0c0f89d73670ff3fd307c1bad3
SSDEEP 3072:9yMTHfDL0Qs395M1FrbbNEzHj7AaHE7cWuK05W7e:9tHfDL0L3IFrHNE37LHWuPr
TLSH
T152C312B83C705CEEEA24E912F111392B5CC9F447D28D6E785D905C8A0D9FB9D422BD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 f569a5c73db6eccfc483a5e78dee107d08a48e6d1bb74059d9ee184d58ec2cd2
MD5 55cd22205ea0c26222360a660d3bf9cf
SHA1 93aa9cbf03326e68787d8cfd7c935e69abc6d0d8
SHA512 a698b3650473a46a91338e3904563ac4b3267c7deea86c79679b5ceb64a31d39ce18fa089e296a0f406df37985d96a5171d64624411a35a3fcf1cc004c19aa34
SSDEEP 3072:9iyMTHfDL0Qs395M1FrbbNEzHj7AaHE7cWuK05W7e:9itHfDL0L3IFrHNE37LHWuPr
TLSH
T1A8C3128C3D705CAEE618E613F122382F98D9F447D1CD1E745E90588A4EDFBA9432AD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 1aa44c0c520549c421a57309f8b3afe755ac2d342c4416b203066f0c578f5164
MD5 4ed91f763f273cae6345074165f4a502
SHA1 02985ec61e48060dbd7aa3f1b6ee11a6cc1debac
SHA512 c10a088817637ea02809d45d7e1f98fc0b384079d7d170beaa218c892b139eff567f0f8f4da486f6c8c09c72bec543b6bdd2757b68c483c7931635fef14f1253
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5emDqB6nGyvn0b4T8iEybJv4a:xC0ITo+TQ0InDUDV6PPb4T8Nybl
TLSH
T11AA10935E0284D775476D446B1626A43CFB97067E972AF90EAD90F0D14F70EC1351A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 df63d7858a91195988cc7508f8bbb9b111d7f0550a914d560dbb1ba3f39ea290
MD5 0218d73ada9282d532a8990c915bd712
SHA1 5b3da5bb3a3da42ec7c05d1d20e5967310f29f55
SHA512 0a8fcbcce6c59f8356b83cee08312b6c6288927080beb2ba270a4ff2afeba85c8cb8363caba18d3cfd3b93279a84e1088b717a6908e136434af542cb20827fe6
SSDEEP 3072:1iyMTHfDL0Qs395M1FrbbNEzHj7AaHE7cWuK05W7e:1itHfDL0L3IFrHNE37LHWuPr
TLSH
T1E3C3128C3D705CAEE618E613F122382F98D9F447D1CD1E745E90588A4EDFBA9432AD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 81cb5ebe7bb535e446381d2f6604c040d328c4a160cb546ea593af3763bf02f2
MD5 ecf877a4c0bff1cfd5fa275073ab418d
SHA1 e5df8ad58e8e9347b86ff471924bad4b38a9706a
SHA512 ef57e79ed28bdb9a6f075e111fb4fdf7f4579b8dfe824343bd860a59cfb951237a57acbd1e877087a0c2672e233eeca82d7bae505575d6a17440a87f135d03eb
SSDEEP 3072:tyMTHfDL0Qs395M1FrbbNEzHj7AaHE7cWuK05W7e:ttHfDL0L3IFrHNE37LHWuPr
TLSH
T16CC312B83C705CDEEA24E912F111392B5CC9F447928D6E785D905C8A0D9FBED422BD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
Size 84KB
SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 2be172c3086efe56c7e1d3279142295a
SHA1 910e0d7ec11d1efda15d03ef826423834aa59fe3
SHA512 37f84d9e6d766d8a97ccf0bd3c1a2a07f528cf45290762ef1f45e603cb513f43befec046693cf2e029366cca1682cd2753e54c53431773aba63c840bafcbf369
SSDEEP 1536:5Qioz7CmAZG1OwJYrmbdmmv0KV06G68u+SSnrO+pIWCVeytH/9vfIZRE2:dozW2vJYanvEd3rlpIWCVWZb
TLSH
T184839E82F36857F6F49B91B986810797F770BA55071093BFF288C2992F03B816E5C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
Size 124KB
SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
MD5 9314ab9707985aaf6e234b5c1fc3c3c6
SHA1 e8ba1f40f800397e3e6a7f95ffe2b9f63bf812ed
SHA512 a8436ccbc32dd31694d3a66072fa76933a2ecf0ef5eaa0b79380e6c53c8e8bd0bfaf7fe9341c17ced215792f3990f4ef220049da92dd4991ebc1d83ef3d41484
SSDEEP 3072:SxVJxKqXCjbqPzMM+kffELENy/Zq4e4lIWLPhG:UHxKsCbqbffELCya4c
TLSH
T197C35B0B739410A6EBA35178C5B36F07E7B1B42B171183CF02A4C6992F637A36E6E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd
Size 157KB
SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 7c25a079b992919cc97221955dac050c
SHA1 d12d4e0f36bad9c578dcb69436fc2a7505feb316
SHA512 ac7e3a3c7b8f766a0e0811718a048f0f8a4340374023fcfc7df0454e030521cd52314c23e80de118f24755046d77bac17d5abee634e7e5fe950b97f53bf5a64d
SSDEEP 3072:tfXToXxWCKqZGOPenZCIlznfF9mNoxe6FK0GIHMJpIWZ1iW4I+:troXxSBOMvNYOxzxGIHm
TLSH
T10CF34B96B394F0D5F7328C38D6628F53E7F5785A0320929A01CC976D2B1FB759A2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shiboken.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\shiboken6\Shiboken.pyd
Size 33KB
SHA256 1bbb27747949b24bc0f6176be73188ef77a83e9db0ac2f933da1b0b7b5e6cb33
MD5 b8ce9f62c17a3543da36247aed3f8d96
SHA1 92320c3410b6ad7b3e0d1b0c14fff2454b3f6fdd
SHA512 19cbf4a8b04801de52485eb04c2fc8edcd77da49938ef4d5a5849767df3df730409d1a7ee6f96aca4cedf69ee3adaeaf6280c0d169c8c5bedd4b276665df6de2
SSDEEP 768:Vd4Z0s8jvWYBt4/zemngKxnVbGYJNF5ALv:VyZibWYuemngKxngGY
TLSH
T10FE27C479A6864DAFD94C67A40868E16D4F0B660574393CF136BC0EA4FE33C23E3AB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjD6DB.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsjD6DB.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsjD6DB.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

types.js

Path C:\Users\Admin\AppData\Local\Temp\onefile_4288_134299820063566859\playwright\driver\package\lib\client\types.js
Size 1KB
SHA256 8daa2915fbdf51c6e3a08e0e4d808d672bdb5166f719a9157c343e64d87550cc
MD5 9cb9240676bc76137e8d6f4aed21f462
SHA1 d167223162ec6298bdcd278d13e5c629b0b360f6
SHA512 9d62bbf847848f9e02a131bc8c439cbebc888a9dcaaf2cfe3e99c800f7d39fcc996125c2901dc206ce6477e0284eae450893d6be9677859905372775be6a5cc6
TLSH
T1932163030170A35D03B194F9727CEE43A7A861619035C868AFECD7B540CDA2F44E8D26
MD5 SHA1 SHA512 TLSH

Submit Download

types.js

Path C:\Users\Admin\AppData\Local\Temp\onefile_4288_134299820063566859\playwright\driver\package\lib\server\codegen\types.js
Size 741B
SHA256 4e4d8fa8a86983748bad7e158d3e58b2ba98806699a7fb66d04a644b7ae01e45
MD5 9e17e684e49336d6627dc202ebc1cb15
SHA1 ac2a1790001ad78230a2da12e13c6a614975e66b
SHA512 ad0033ddb53558d313ccd41d86d77ea1d397a0cb397dcccd541696df3d4340a1362c3de0ffed8a6a40d53ddef1779c4b233245fbf161d2750029eda119a40653
TLSH
T18E01B8032471A75D03B110FAB1799D46EBA861344039C828BBF8E7B555CA92B48A8A3A
MD5 SHA1 SHA512 TLSH

Submit Download

codeMirrorModule-C3UTv-Ge.css

Path C:\Users\Admin\AppData\Local\Temp\onefile_4288_134299820063566859\playwright\driver\package\lib\vite\recorder\assets\codeMirrorModule-C3UTv-Ge.css
Size 5KB
SHA256 eb0b48397129ddd6af23cae979051d4ef010a0dcfb8d46c2dbf289c90b76c6da
MD5 99d5ba8852ed906a649a393b5fc4beaa
SHA1 aa936e261602816fb64deeeb5561698215fbf891
SHA512 6b561626cba9ec755659b11040ef181ca39f79d1b80edd3e7e75607391222fe143533f42f2301e00001e19414a9a0da2e9038da1d2f82696221bd1d79fad2a0c
SSDEEP 96:+TDTwf7BPZ7ihz1Gxx0/ttcNh/0ycjamY77ZtwPqWfIWTFDyAmjkraujziuU+g2V:+TDTy7BPZ7NggA0uFDyAmjkvjbU+g2Ue
TLSH
T133C1CAE3F04CF41BB237CA3164D0AE7D232980E698165EFBB539B4A845E799DDD12309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

playwright-logo.svg

Path C:\Users\Admin\AppData\Local\Temp\onefile_4288_134299820063566859\playwright\driver\package\lib\vite\recorder\playwright-logo.svg
Size 4KB
SHA256 6b0a4367bdeab10995bc239278f04c68c10e48adbec15e799e01909a0d66dcb9
MD5 3a2e616a4c02faa220f078f403535bfa
SHA1 6a163ae94b0df23c01e41dddd064170a4c0a18e3
SHA512 041a1221998fbe2c0b0802923d45e700bb31887cc3811d3a4556dd3e071f7205db7a0e0cf4b10635da7a2096201ad5636dd32bfd716ef773183a055b01d2e1c1
SSDEEP 96:bKf8/pzqgQ8DtY9ET3OsaT+5Zkt9BfS2zsyDZ5vlBxNaebPyDwiE+RXJCMW4nQ/h:bK0/pzDDG9OuyiLRgyV5LxbPyn/RXJCz
TLSH
T180A180ED6FF20DE2CC8687D7BF4254AD381B857B49D48A14C24C5B4838EA91E8C21ED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtwebengine_resources_100p.debug.pak

Path C:\Users\Admin\AppData\Local\Temp\onefile_4288_134299820063566859\qtwebengine_resources_100p.debug.pak
Size 148KB
SHA256 fee884da3daa2ea3fef7a0c562117c011f4805776c9ded4cdd035d0163ccf8a5
MD5 ac122e0d1314d719e13a5d9515318a66
SHA1 ee7cdc7e97433931aba93b058912f9613d6f4114
SHA512 935ba9ca1e6a731fb35a484a56e1da69dd7c3d8e9e3e382cb70d703fe8e0631ab4ce8886fa20b2fc8127dc2de3366604f3fbd0ffbdbd0772db7512eb314066d4
SSDEEP 3072:2Ldb+XiAG5+hws8TUV3cWSHINP1L2o418Gb0+VRLf0ld0GY3cQ3ERVs:m9QQ+hETa3RTN5K18Gb0OV8ld0GecQ3T
TLSH
T160E3F1C373F9E9BDC29B57F7A1164072DDB30A3825A1410B0B4A9932AAB1744CDCDB97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtwebengine_resources_200p.debug.pak

Path C:\Users\Admin\AppData\Local\Temp\onefile_4288_134299820063566859\qtwebengine_resources_200p.debug.pak
Size 202KB
SHA256 0128070365a443a80d5fc340221bf186d2c006f00920f19ca53e9e643dfc40c8
MD5 e8ce23ef101c872157315337dc33b4b5
SHA1 f99ac87e79ed4061a15d5c454048ceedc65aa425
SHA512 31b858ab4cc7f0362235bb5dba668baea2d9c74aabb037903012b768f2ca490331c953313f2c1a8727717d707180a6ece21cd0ff77af07866cdce6933a2b6f14
SSDEEP 6144:l9QQ+LnIEb8Hgs4jTls3RTNugx5GMRejnbdZnVE6YoppH:rx+LOgs4jTufa6edhVELoXH
TLSH
T17E1402DBB3F86C7CC4635AF3622601F1DCF2153911B6420B07DA9836B995AC5C8CEA97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt_help_en.qm

Path C:\Users\Admin\AppData\Local\Temp\onefile_5984_134299819671906358\PySide6\translations\qt_help_en.qm
Size 33B
SHA256 494ac9a2b2cb2fdeced353f4a9f898ed8dcf616e9bc667438c62681e3f7f79cf
MD5 aaea7ba475c961f941d0a23488457beb
SHA1 2bf0054002c8f7d85dd080df332553bf9b3a8e26
SHA512 5b408c36c8f93f71e73e3d3b1c0c2ad699e92a6088604b8adf8e588e8a75fc3fc92828199b7f00f5b05b224ae819220d07e56d610a76a267594870bec77172be
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5984_134299819671906358\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5984_134299819671906358\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5984_134299819671906358\main.dll
Size 46.3MB
SHA256 616e749ec921924a82c88efbfe97ad8a34f79108c296feabd58adf6c378edc57
MD5 1a53b92b7a54a792a2c492a93f004d34
SHA1 f6d4e19930377d75d902cfc776869963a9eeb77c
SHA512 1e5498a44495ac7ad45c3f4867129f944e70d97dd8e0c974d0ea785e599b0396f579e636086cd5b56bf3d016da4dcff9a9414c872c39ea29faae12eff7c49091
SSDEEP 196608:oJ5Tj11FUfUjv2w1z0Ezk9Roqxz8r1N7KMc1bs2D1moXsc2GD/Y:c5Tf2Cew14E49RB8r1JKMkD1xF2
TLSH
T1D0B73C43E13130A7DA6AE0F45F1694B36BB8F82E423079F771DD89352B12C619F6C668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocol.d.js

Path C:\Users\Admin\AppData\Local\Temp\onefile_5984_134299819671906358\playwright\driver\package\lib\server\firefox\protocol.d.js
Size 751B
SHA256 6b7467f93c2627e3833867266eca9c25639231878e0544a2dd08c23e2ad07ff6
MD5 80caf7835f7af181789664cf55f7d58e
SHA1 e61b06432e370a586ef1fd7e624569e6d4af9727
SHA512 1ab3903d887d609f93f28b8a1d626bf2811d7c172780f4f75567a768de507bcf8908cf5910009d915a5b6958567209f5b1d5c0d2f9d242d74806c51816ccf77f
TLSH
T14701D0035431B75D03B150F57179ED47E7AC61344029D828BFF8E7B555C682B4894D3A
MD5 SHA1 SHA512 TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5984_134299819671906358\python3.dll
Size 68KB
SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
MD5 962428e9e68d43ecc16f3e33f2ea8667
SHA1 6d0f349ab2e795b138a64346b784fc7fcdb6d87f
SHA512 a925586bbc4cc9d2f58f5b6eeed82e429c23dd57d7b33609c0067fc14ed66ed165ac8121eeec1db3f993412f28ba527e961e3d6bcc201d4cda2037f85931ffc5
SSDEEP 768:BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/s:BDmF61JFn+/OulIWL0vytH/9ifITgj
TLSH
T125637042BB54F893DBFA66FC7AD199CE642B12CC572984ECA47593D30D1A310A2E334D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5984_134299819671906358\python312.dll
Size 6.6MB
SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 de50496cece613ec7ebedbf9f2aefecd
SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
TLSH
T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shiboken6.abi3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5984_134299819671906358\shiboken6.abi3.dll
Size 373KB
SHA256 0fe96e805a6001efde58818a1ce6cb425227f74be72f3b10d7c06c7435fefa5a
MD5 35b18d84bd75636b1e23034058839baa
SHA1 ab410d2c487773737ec8a0604af93eb0b571a21c
SHA512 186c339409f3710a7182a086d7f88bc3dc693e98b6351fc517f546f37ec3bf990c9f6a3fd0c6f16910d1be05d570d4f61006cb9d0aec7af47b5c469a505228d5
SSDEEP 6144:sSS2oJHwF8VhgtcN7T1KZur2F0bYqbP+Jlz5/08au+rWI5AON7:sHLt0l0bZbP+/zsuON7
TLSH
T1B9848D2BAF5410ECF667827C88638507D6B670A2035097CB23F9C2D52B63AD57A7FB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4612_620794896\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

volt.exe

Path C:\Users\Admin\Downloads\volt.exe
Size 11.8MB
SHA256 0c5bdb32e115cace2aebdaa8bf314a747883a5b94c46c0f815c0da9eaf8514ae
MD5 996ccbb76ca518b1e9c3f06e10fffe13
SHA1 6fb65b94ec387a44136f8aa85a6a6b6f7cc67789
SHA512 f917337a55bfb3260a09eccf46465712ae485ed4be54d6261350d8dc7c004b15885fe978b03773fa2d2d81653fe756014ee570a4dc9e06c8844b1553afc12df9
SSDEEP 196608:dQI21WHkVJc9lSE7Z9HyyB6Br6k6TqEOWXVu2ZPm6r4tN5cXd1iqXEph+eb7u1c6:dQmHkVJAlN91NkBr6ZpNXV3ZZONit1a2
TLSH
T157C633BB45CCE676D836453237962A0AFE7131D08E88697BC110B6BD3C3E536E537229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4040-3444-0x00007FF74F440000-0x00007FF750440000-memory.dmp

Download

memory/4040-3472-0x00007FF8F3580000-0x00007FF8F6496000-memory.dmp

Download

memory/4040-3456-0x00007FF8F1A20000-0x00007FF8F2066000-memory.dmp

Download

memory/4040-3455-0x00007FF8F2070000-0x00007FF8F251D000-memory.dmp

Download

memory/4040-3454-0x00007FF8F9D40000-0x00007FF8FA065000-memory.dmp

Download

memory/4040-3467-0x00000211E5600000-0x00000211E5799000-memory.dmp

Download

memory/4040-3466-0x00007FF8F3580000-0x00007FF8F6496000-memory.dmp

Download

memory/4040-3468-0x00007FF8F3580000-0x00007FF8F6496000-memory.dmp

Download

memory/4040-3457-0x00007FF8F0450000-0x00007FF8F0805000-memory.dmp

Download

memory/4040-3480-0x00007FF8F3580000-0x00007FF8F6496000-memory.dmp

Download

memory/4040-3477-0x00007FF8F3580000-0x00007FF8F6496000-memory.dmp

Download

memory/4040-3470-0x00007FF8F3580000-0x00007FF8F6496000-memory.dmp

Download

memory/4040-3474-0x00007FF8F3580000-0x00007FF8F6496000-memory.dmp

Download

memory/4288-2006-0x00007FF74F440000-0x00007FF750440000-memory.dmp

Download

memory/4448-3419-0x0000025080CF0000-0x0000025080CF1000-memory.dmp

Download

memory/4448-3422-0x0000025080CF0000-0x0000025080CF1000-memory.dmp

Download

memory/4448-3420-0x0000025080CF0000-0x0000025080CF1000-memory.dmp

Download

memory/4448-3413-0x0000025080CF0000-0x0000025080CF1000-memory.dmp

Download

memory/4448-3411-0x0000025080CF0000-0x0000025080CF1000-memory.dmp

Download

memory/4448-3421-0x0000025080CF0000-0x0000025080CF1000-memory.dmp

Download

memory/4448-3417-0x0000025080CF0000-0x0000025080CF1000-memory.dmp

Download

memory/4448-3418-0x0000025080CF0000-0x0000025080CF1000-memory.dmp

Download

memory/5412-1701-0x00007FF9003B0000-0x00007FF9006D5000-memory.dmp

Download

memory/5412-1705-0x00007FF8F3580000-0x00007FF8F6496000-memory.dmp

Download

memory/5412-1708-0x000002B4EE820000-0x000002B4EE9B9000-memory.dmp

Download

memory/5412-1679-0x00007FF74F440000-0x00007FF750440000-memory.dmp

Download

memory/5412-1704-0x00007FF8F13E0000-0x00007FF8F1795000-memory.dmp

Download

memory/5412-1703-0x00007FF8F17A0000-0x00007FF8F1DE6000-memory.dmp

Download

memory/5412-1702-0x00007FF8F2720000-0x00007FF8F2BCD000-memory.dmp

Download

memory/5752-3482-0x000001F1EC670000-0x000001F1EC692000-memory.dmp

Download

memory/5984-786-0x00007FF923180000-0x00007FF923182000-memory.dmp

Download

memory/5984-790-0x00007FF74F440000-0x00007FF750440000-memory.dmp

Download

memory/5984-789-0x00007FF925660000-0x00007FF925662000-memory.dmp

Download

memory/5984-788-0x00007FF925650000-0x00007FF925652000-memory.dmp

Download

memory/5984-787-0x00007FF923190000-0x00007FF923192000-memory.dmp

Download

memory/5984-782-0x00007FF925630000-0x00007FF925632000-memory.dmp

Download

memory/5984-783-0x00007FF925640000-0x00007FF925642000-memory.dmp

Download

memory/5984-2664-0x00000215F1390000-0x00000215F1529000-memory.dmp

Download

memory/5984-785-0x00007FF923C40000-0x00007FF923C42000-memory.dmp

Download

memory/5984-2052-0x00000215F1390000-0x00000215F1529000-memory.dmp

Download

memory/5984-784-0x00007FF923C30000-0x00007FF923C32000-memory.dmp

Download