a0a319f0e3c40de2beb3b5323c667731219bb0ca8646e77fbf065978dacf8e5f

Analysis

user interaction
yes
max time kernel
300s
max time network
304s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
t.zip
Size 104KB
Sample260808-w2n4easfna
SHA256 a0a319f0e3c40de2beb3b5323c667731219bb0ca8646e77fbf065978dacf8e5f
MD5 a6b1f291826b8b4756ed1e890620ff77
SHA1 244d2e93a387d9c198ce0d8487e324884c7baf18
SHA512 4f12007b16a05671d347d80a6bf6f4ac71d1cf5a8915c6eb8b5a1c37f5cb47d4bae0621edcd3d035b4782cf14964a8cc125cd10d7e1497c2ac5b886f1bd7852e
SSDEEP 3072:n7RtRNl45R8JL7t4JqFf2jPDXvFplrd0WHgJQMON:nd305RK7tbFePvFPryWAJFk
TLSH
T1BFA312E4EB688168EAC56AB8BBF85B4002940C555CEB400F015FB2FDF246F7547AC6B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5456	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306874598178172"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2848	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5168	chrome.exe
5168	chrome.exe
5808	powershell.exe
5808	powershell.exe
5808	powershell.exe
5168	chrome.exe
5168	chrome.exe
5452	idk.exe
5452	idk.exe
3472	chrome.exe
3472	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeDebugPrivilege	5808	powershell.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe
Token: SeCreatePagefilePrivilege	5168	chrome.exe
Token: SeShutdownPrivilege	5168	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe
5168	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5480	LogonUI.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 5672	5168	chrome.exe	96
PID 5168 wrote to memory of 5456	5168	chrome.exe	97
PID 5168 wrote to memory of 2828	5168	chrome.exe	98
PID 5168 wrote to memory of 2828	5168	chrome.exe	98
PID 5168 wrote to memory of 2248	5168	chrome.exe	100
PID 5168 wrote to memory of 2248	5168	chrome.exe	100
PID 5168 wrote to memory of 2608	5168	chrome.exe	101
PID 5168 wrote to memory of 1660	5168	chrome.exe	102
PID 5168 wrote to memory of 2608	5168	chrome.exe	101
PID 5168 wrote to memory of 1660	5168	chrome.exe	102
PID 5168 wrote to memory of 4252	5168	chrome.exe	103
PID 5168 wrote to memory of 4252	5168	chrome.exe	103
PID 5168 wrote to memory of 3432	5168	chrome.exe	104
PID 5168 wrote to memory of 3432	5168	chrome.exe	104
PID 5168 wrote to memory of 2852	5168	chrome.exe	106
PID 5168 wrote to memory of 1324	5168	chrome.exe	107
PID 5168 wrote to memory of 1052	5168	chrome.exe	108
PID 5168 wrote to memory of 1324	5168	chrome.exe	107
PID 5168 wrote to memory of 1052	5168	chrome.exe	108
PID 5168 wrote to memory of 3800	5168	chrome.exe	122
PID 5168 wrote to memory of 1556	5168	chrome.exe	110
PID 5168 wrote to memory of 3800	5168	chrome.exe	122
PID 5168 wrote to memory of 1556	5168	chrome.exe	110
PID 5168 wrote to memory of 2220	5168	chrome.exe	115
PID 5168 wrote to memory of 3156	5168	chrome.exe	114
PID 5168 wrote to memory of 2220	5168	chrome.exe	115
PID 5168 wrote to memory of 4628	5168	chrome.exe	116
PID 5168 wrote to memory of 3156	5168	chrome.exe	114
PID 5168 wrote to memory of 4628	5168	chrome.exe	116
PID 5168 wrote to memory of 4436	5168	chrome.exe	118
PID 5168 wrote to memory of 4344	5168	chrome.exe	117
PID 5168 wrote to memory of 4436	5168	chrome.exe	118
PID 5168 wrote to memory of 4344	5168	chrome.exe	117
PID 5168 wrote to memory of 3052	5168	chrome.exe	119
PID 5168 wrote to memory of 3052	5168	chrome.exe	119
PID 5168 wrote to memory of 3988	5168	chrome.exe	120
PID 5168 wrote to memory of 3988	5168	chrome.exe	120
PID 5168 wrote to memory of 3800	5168	chrome.exe	122
PID 5168 wrote to memory of 1220	5168	chrome.exe	121
PID 5168 wrote to memory of 3800	5168	chrome.exe	122
PID 5168 wrote to memory of 1220	5168	chrome.exe	121
PID 5168 wrote to memory of 3552	5168	chrome.exe	126
PID 5168 wrote to memory of 1916	5168	chrome.exe	127
PID 5168 wrote to memory of 4304	5168	chrome.exe	128
PID 5808 wrote to memory of 5452	5808	powershell.exe	129
PID 5168 wrote to memory of 3472	5168	chrome.exe	132
PID 5168 wrote to memory of 4592	5168	chrome.exe	133
PID 5168 wrote to memory of 4592	5168	chrome.exe	133

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\t.zip
1⤵
PID:4092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3544

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:4144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x104,0x138,0x7ffa68aac728,0x7ffa68aac734,0x7ffa68aac740
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,2230328934846966999,16556822081504555704,524288 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,4188278591549689678,7448113478992963320,262144 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,279069993104650036,5892463594900666914,524288 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:13
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,11744553296439352090,6227929216337193823,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3364,i,2802327398731753647,15076113349139434593,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4736,i,7689008523326557858,13753867648472165439,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3960,i,10320919241834778150,1934867528226823173,524288 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,17649861307081790158,3111299559996320621,524288 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5532,i,2337026483257437944,17949519439724051271,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5552,i,1422268788531414858,2019256700417969878,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5732,i,5107084239724583830,2348968377281388950,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,1268121526269355012,17738547751535747043,524288 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6256,i,3465505504084617428,11540331498008788155,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,12724862324928703349,8370096219592469848,524288 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5604,i,1026100017846887022,4938507225950425670,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6036,i,10455113481264103263,11053786894229418306,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6200,i,15696951443169919124,2810315640762493789,524288 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6540,i,14620907150245959916,8482864578065262812,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5588,i,8277221910981701124,4777671972730889553,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6576,i,3321560253173945171,14644322890509041700,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:9
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6560,i,6511911649117619280,14444962089245162925,2097152 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6384,i,10198356514757807986,2475349769737336339,524288 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,16274790314710093747,6104731782370822068,524288 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,13449436240887796154,7501966599857587998,524288 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5852,i,8616701696661124736,11678408065040482667,262144 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,3524314204784137822,7256479661295588545,524288 --field-trial-handle=2024,i,7029442774153952082,13065940600520884787,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
  2⤵
  PID:4592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1976

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Users\Admin\desktop\t\t\idk.exe
  "C:\Users\Admin\desktop\t\t\idk.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5452

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\t\t\injection_log.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:2848

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39e7055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

8327d424-39e9-4029-af8b-651c1e4f4e0b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8327d424-39e9-4029-af8b-651c1e4f4e0b.tmp
Size 2KB
SHA256 e8bb2cf2d100b460f94050f86213d212e8628e93699a6b76915e9b793e2982a6
MD5 e9e3c58d0128767eac752b47840fc968
SHA1 5e5e2eb82e56b451f25c0a10634099e45cbe4b00
SHA512 0a39aa02f0bdd1cec098a9bd4b1f282cdd53ea0ff8721ee00b48b70247bfc1669460abdab3e5a441cc718ddf691ddffe99c3acf680aef88fb99421a35e0bc5e0
TLSH
T1DA5189F3C7E49A7D851156E49A21AF2FCD3E0A28121C3C66C9D4EE5B53E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e2dc2a2c1a08cbf7ee23b03b9cea6f76ce965a1cb2cb1ec24d9115f9f7c53f8f
MD5 ace522f61e8ac8680ed8d7eed2404986
SHA1 23622b1bfe858889bd4376394a029a9ef5a44ca8
SHA512 0bbf4e255428644b3f4b32a0279c1cf6038b670a61eda92c9808b2c459706fc8ff8c22d4cc7327537f216d2d787402d7eded5485cd96ecc84829b3d0b5f69021
TLSH
T1DA5179F7C3D49A7D841156F59A256E1FCD3E0A28122C3C62C9D4EE5B53E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 425ed8366bb389d5f5ec52a2c78eed48b4a7200bd85c5894d3b640c992f4c664
MD5 baa68ac1b117df4128970a3e7f446b83
SHA1 716e3398c42432d9d20780e6ce4d028b9f34cb56
SHA512 e166222e5d65db4e49eafeb39569ebc18457452dc4d15e74ecf6cfea79daad16e90d3470a38149abc0198929c345f3b693a18a6e5cb234e9145b6c9a1c2cc422
TLSH
T167F050E7B77970A310B946BF5D04780659B2B83546C078E4CF56427CA0C24F70B01447
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6da5e9fc81b3008a4a5cc43a71136b0589fefcb0ec960fc13539d86f49c882d5
MD5 724e066d84a52b4e3fa6f9c680095a25
SHA1 47559502de96c000be6f883e90828b6ddeef8396
SHA512 42249ccb0694d7aa34ef9ad71032aa97d8e96b58cb5b9bd1c292123579874dfc0a4bc1abf029d4d3279406bde2a957ef07c5754d0a128f465d0c8e21ccafbec2
SSDEEP 192:oRo/fKYv7zAPRp2Q9NLHsb+WNng/0cqCokwQNVyIsnAUge:oRo/iECXD3wo0vBwbe
TLSH
T13F32C72EBE10797B6DDAD229F9217753DBFA102171902E84E7FC896C18EB5CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 02379b90678a28083dd482ddc83b88ddfa6ead56f5dbc90bd13db3b96b130998
MD5 24e6c5a781e28a8e0fa10ef19cb75101
SHA1 6cf70302a10dc125fe29f6fbf0da4f37dd77889f
SHA512 585167f74934ea2dbf65db0684fb9f8ac5013fcae3871de4fd5e8561453ee577f84c723ba3b98e90260274a1699ddd064f5f0fea851eaa985b6e16755a1954e2
SSDEEP 192:oRo/fKYv7zrPRpPQ9NLHsb+WNng/08qCokwlNVyIsnAUgE:oRo/iEzXY3wo0PBFbE
TLSH
T15142C82EBD10797B6DDAD619F9217B53DBF9102171A02E84E7FC892C14EB6CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5769453478aa3d090269fb9bb548320f9ccef0ede14993b5c45e98a366f77e46
MD5 4c361f36d001cfcc1c1a02ebf918275d
SHA1 1525d8d6f62a67635291e325dc50d8914562a810
SHA512 23f004fe61240fd1121aca9d0687f5a39a8314126d1ddb29ba2c47755ed2d926c4fc5eabd102709a61d8ef554b2385d3356b70dc89ac57f46c9e917d68ad5faf
SSDEEP 192:oRo/QKYv7zrPRpPQ9NLHsb+WNng/08qCokwlNVyIsnAUgE:oRo/FEzXY3wo0PBFbE
TLSH
T1BD42B82EBD10797B6DDAD619F9217B53DBF9102161A02E84E7FC896C18EB6CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 b99021400d9b75b5ba50d7c4d56b882c8b7284468b252486578acb260a1abd39
MD5 55bb93077d613781b59b3b0f58096bdd
SHA1 09c0a886fb2e78890ef3d7f990b3c97fb9803a6a
SHA512 7248246b2f54898d9f3b1ec194212854c90194b3fe61159c0beaa3f6aa9a4d90587298cb23a7919b7b56063afbec597685f430ece96737c5c952413b771e91b1
SSDEEP 384:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xXODyh+ErU3eFHGAIEzHZa6:Z7wX7KxkXqKf/pUZNCgVLH2HfgsGVOuj
TLSH
T145521867648D9A7B0FD8D64DDC17BF4FADB5024766684D2492FA9C0803A87CF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 1ff4ba3d6a91c1e3045f4d6b498cd97f560df950e4e8626a72cae3763278e91d
MD5 807e42d670fc9cabb340d2360aa4e025
SHA1 7dc38a861721ff0189d8c8691d8e76d9e03d8ee1
SHA512 ee6f2e2c664fee68e27a1e3b6baad8e70f00082b82c534eb44c43bfc4550a1dd54663a4a09d505fa6c7a49eaab6246d4fead51dc3d66075e897315be32a4297d
TLSH
T185A0021181E00C11DD408A70B06266413797D8251D664383EC925948AD6B2CC4222108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5d44.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a5d44.TMP
Size 48B
SHA256 035a2620df9ef50ee3aefc1d8aea6285079c8b1373ea575e115eaf168772fe80
MD5 35c14aace617aa36a1d440151953a9e7
SHA1 c0cfc0b3401335c6e6d76b1c26a802254b24add9
SHA512 a3359aeb36bb7d6f132f06b08ba682d8cb22b96cb4c48dfaabeaa759fcdf28f91c0eaabcfbb1a78b2150af5e53ce9d22a8656016c299bf44129c9fc83fadd87e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 eb6ad1027776e950fb6267d638d443183d988385fd898d982a0162749dc4e9ed
MD5 78df7567bc84162ccc814d74c03d9257
SHA1 6b2261c8aee71fe30a0ef11bb03f715b79a610f0
SHA512 eba7eb2ea8ea79cc30db6cde560802afd84467e113dd57353fe717f2bd9f16173f9d90c5bf1a191111a9bb95ec46a7987ac85c436791eac5b7300046fba97ca4
SSDEEP 3072:2tCXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIh:2tFhxNPRW2PYddqmY7U52Fc
TLSH
T189C3123078A92E784C5AEC1C314B3C2A9EF6EFECA4E87EC8F4586E0E155FC549963454
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 fa5e5e16344e4427cf57d7c8c150706d99df286b9919d8963171d239ec6cc056
MD5 c0ec87ed2cd9405d2654d38feb9a822e
SHA1 d4a128b2831eebf061ef6de60da2aa7d54dd0339
SHA512 92b967aa757c1bd37e30ed0c904d5d6cd2ef2bf28a476fb56a24a4ca836c24d5b1b84d108c1905b1f48a0a2ac796f2ae4afe7de14d859a3901d86a681437eb8a
SSDEEP 3072:SQXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIh:SDhxNPRW2PYddqmY7U52Fc
TLSH
T101C3121078F96EB84C4AEC1C324B3C2AAFEA9DE860E83FC5E5959F0E195BC506173954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c9f728c536ddc3e31d4438a5a3146bd0f9d8f86afca54acfbc72f5db6d3e93d5
MD5 f05b024a1d0a90470cb272d345cc628d
SHA1 8ab6c66fcfca2a50a09df0ded82ff95b3eb0133a
SHA512 2e6fe1c2b61e8e3e1f65ae7748053a781e632674a74b98cf799b77a8c3c065ddbe6f90a7bc4d7e61840b5a238597526b7deeb529ad05fc95f6ea402a211d32c4
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5lqD7B6WGyvUU+IsbL/Mmv4a:BC0qDHUgvIdaDUDmFCI+IsbL/N
TLSH
T182A11931B46D5D776A76D949F8662E43CEB4602BE931BE44D9DE0E0C21E70EC1302613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 9704ae10fcc691f5be40223a02e5fb9cf09ccb658292af21afacd6c477872bdb
MD5 58939bb5c4c767c2489b635d042e52f3
SHA1 e6105e0e8498bbebdae641d92c0af37996b18d69
SHA512 88ed9ad64087ff7159435772a788b27b9528a3c701b2f8d82be09b1134054d65202854dccbab2578d55e97f06523ead5212c631657c05d96a18708777513fb5c
SSDEEP 3072:StCXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIh:StFhxNPRW2PYddqmY7U52Fc
TLSH
T1A1C3123078A92E784C5AEC1C314B3C2A9EF6EFECA4E87EC8F4585E0E155FC549963494
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 383f543f615f3e8fc6de7a9496852aea80053dedf570481d755c8c5092032e39
MD5 a506b43adfe77560b921fdb1cd276465
SHA1 5825be8d3e659375e27e128f74ce3b4047a03cc3
SHA512 077a0645e9f03bc9fa80aeb28a0a46ac865a8cb65ce209308b42cb42c9f328fbaa912eaf665f6ceaf48d62c75d6e1ef25f15e1f4df100342b4aa1270a63c2668
SSDEEP 3072:tQXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIh:tDhxNPRW2PYddqmY7U52Fc
TLSH
T1BCC3121078F96EB80C4AEC1C324B3C2EAFEA9DE860E83FC5E5959F0E195BC506173954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5168_952107301\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

injection_log.txt

Path C:\Users\Admin\Desktop\t\t\injection_log.txt
Size 52B
SHA256 8233fbf86b95a5b0a0d3998414f6ee6d0b5c4c3cf4a84053dfeba788a83fa573
MD5 878fbfcef0883c213ade46bb63a7eb40
SHA1 d2e03f316c3774570271455f88f5ddd38b4b8ca0
SHA512 5c09cd8e10925f40e440559fa259ee3d4c2b7a5273733a80486a3c92b09bfb51a11a414132f72d3c29dbfa55ae87c356e72ca16edf859cae7a070d79cdd788b1
TLSH
T1999002585516525C07CD54915155505598B889614D1126A01D15C12C1925248589585A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5808-488-0x0000000005E40000-0x0000000005E62000-memory.dmp

Download

memory/5808-506-0x0000000007180000-0x00000000071A2000-memory.dmp

Download

memory/5808-507-0x0000000008430000-0x00000000089EA000-memory.dmp

Download

memory/5808-504-0x0000000007DD0000-0x0000000007E66000-memory.dmp

Download

memory/5808-505-0x0000000007130000-0x000000000714A000-memory.dmp

Download

memory/5808-495-0x0000000006C10000-0x0000000006C5C000-memory.dmp

Download

memory/5808-494-0x0000000006BD0000-0x0000000006BEE000-memory.dmp

Download

memory/5808-493-0x0000000006740000-0x0000000006A9B000-memory.dmp

Download

memory/5808-489-0x0000000006630000-0x0000000006696000-memory.dmp

Download

memory/5808-490-0x00000000066A0000-0x0000000006706000-memory.dmp

Download

memory/5808-487-0x0000000005FE0000-0x000000000662A000-memory.dmp

Download

memory/5808-486-0x0000000005910000-0x0000000005946000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads