2cb4ffefb6723657e5ea37b38e7107d8822a7dfc7b9af79b20c0306adf907aac

Resubmissions

09/08/2026, 12:15

260809-pe9m9sac978

09/08/2026, 12:12

260809-pdhhdsem3t8

Analysis

user interaction
yes
max time kernel
125s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
rggffgg.exe
Size 10.7MB
Sample260809-pdhhdsem3t
SHA256 2cb4ffefb6723657e5ea37b38e7107d8822a7dfc7b9af79b20c0306adf907aac
MD5 2e4cb26fd5760bc5895301d151e8ef74
SHA1 a416fb0c4c53941be340b378894c134c191968ff
SHA512 d88abd6ba3d344796ef208696408a6136bbd145a43b780b594c0396bf3737dc91ce898f3f2e6af2aefd0e6f7b633d2305ed0474e0e3d7b46ee47381656aa43a3
SSDEEP 98304:J9YrC8KnSrf1+/MFkte2qx2pumvBh8huTdEh:JgD+s9Oe2arh
TLSH
T132B64943ECA501E9C1ADC575CA2A9616BB713C894B30A3DB5B50F7252F37BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2496	powershell.exe
5780	powershell.exe
5584	powershell.exe
2128	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 3 IoCs

pid	Process
5728	rggffgg.exe
4116	rggffgg.exe
4088	gayniggasex_3960093417.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	gayniggasex_3960093417.exe
File opened (read-only)	\??\N:	gayniggasex_3960093417.exe
File opened (read-only)	\??\A:	gayniggasex_3960093417.exe
File opened (read-only)	\??\D:	gayniggasex_3960093417.exe
File opened (read-only)	\??\L:	gayniggasex_3960093417.exe
File opened (read-only)	\??\O:	gayniggasex_3960093417.exe
File opened (read-only)	\??\Q:	gayniggasex_3960093417.exe
File opened (read-only)	\??\S:	gayniggasex_3960093417.exe
File opened (read-only)	\??\X:	gayniggasex_3960093417.exe
File opened (read-only)	\??\Z:	gayniggasex_3960093417.exe
File opened (read-only)	\??\B:	gayniggasex_3960093417.exe
File opened (read-only)	\??\P:	gayniggasex_3960093417.exe
File opened (read-only)	\??\R:	gayniggasex_3960093417.exe
File opened (read-only)	\??\T:	gayniggasex_3960093417.exe
File opened (read-only)	\??\U:	gayniggasex_3960093417.exe
File opened (read-only)	\??\Y:	gayniggasex_3960093417.exe
File opened (read-only)	\??\H:	gayniggasex_3960093417.exe
File opened (read-only)	\??\I:	gayniggasex_3960093417.exe
File opened (read-only)	\??\K:	gayniggasex_3960093417.exe
File opened (read-only)	\??\M:	gayniggasex_3960093417.exe
File opened (read-only)	\??\V:	gayniggasex_3960093417.exe
File opened (read-only)	\??\W:	gayniggasex_3960093417.exe
File opened (read-only)	\??\G:	gayniggasex_3960093417.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5376	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Temp\death.mp4	gayniggasex_3960093417.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5152	cmd.exe
1208	cmd.exe
3428	cmd.exe
2004	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2228	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2968	taskkill.exe
3832	taskkill.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307511810529730"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{08F4480F-3AA9-4AEA-A19D-0CF6E68E589C}	gayniggasex_3960093417.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2128	powershell.exe
2128	powershell.exe
2496	powershell.exe
2496	powershell.exe
2496	powershell.exe
5780	powershell.exe
5780	powershell.exe
5780	powershell.exe
5584	powershell.exe
5584	powershell.exe
5584	powershell.exe
2876	chrome.exe
2876	chrome.exe
4088	gayniggasex_3960093417.exe
4088	gayniggasex_3960093417.exe
4088	gayniggasex_3960093417.exe
2876	chrome.exe
2876	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	5780	powershell.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe
Token: SeShutdownPrivilege	2876	chrome.exe
Token: SeCreatePagefilePrivilege	2876	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe
2876	chrome.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4444	4584	rggffgg.exe	89
PID 4584 wrote to memory of 5728	4584	rggffgg.exe	92
PID 5728 wrote to memory of 2128	5728	rggffgg.exe	93
PID 5728 wrote to memory of 2496	5728	rggffgg.exe	96
PID 5728 wrote to memory of 5780	5728	rggffgg.exe	99
PID 5728 wrote to memory of 5584	5728	rggffgg.exe	101
PID 2876 wrote to memory of 2800	2876	chrome.exe	104
PID 2876 wrote to memory of 2228	2876	chrome.exe	105
PID 2876 wrote to memory of 2304	2876	chrome.exe	106
PID 2876 wrote to memory of 2304	2876	chrome.exe	106
PID 2876 wrote to memory of 1176	2876	chrome.exe	108
PID 2876 wrote to memory of 1176	2876	chrome.exe	108
PID 2876 wrote to memory of 1172	2876	chrome.exe	109
PID 2876 wrote to memory of 1556	2876	chrome.exe	110
PID 2876 wrote to memory of 1172	2876	chrome.exe	109
PID 2876 wrote to memory of 1556	2876	chrome.exe	110
PID 2876 wrote to memory of 4616	2876	chrome.exe	111
PID 2876 wrote to memory of 4616	2876	chrome.exe	111
PID 2876 wrote to memory of 2020	2876	chrome.exe	112
PID 2876 wrote to memory of 2020	2876	chrome.exe	112
PID 2876 wrote to memory of 1624	2876	chrome.exe	113
PID 2876 wrote to memory of 1624	2876	chrome.exe	113
PID 2876 wrote to memory of 3528	2876	chrome.exe	114
PID 2876 wrote to memory of 5368	2876	chrome.exe	115
PID 2876 wrote to memory of 5368	2876	chrome.exe	115
PID 2876 wrote to memory of 5152	2876	chrome.exe	116
PID 2876 wrote to memory of 5152	2876	chrome.exe	116
PID 2876 wrote to memory of 3936	2876	chrome.exe	117
PID 2876 wrote to memory of 3936	2876	chrome.exe	117
PID 2876 wrote to memory of 5384	2876	chrome.exe	118
PID 2876 wrote to memory of 5384	2876	chrome.exe	118
PID 2876 wrote to memory of 2592	2876	chrome.exe	119
PID 2876 wrote to memory of 2592	2876	chrome.exe	119
PID 2876 wrote to memory of 4308	2876	chrome.exe	120
PID 2876 wrote to memory of 4308	2876	chrome.exe	120
PID 2876 wrote to memory of 3828	2876	chrome.exe	122
PID 2876 wrote to memory of 3828	2876	chrome.exe	122
PID 2876 wrote to memory of 5772	2876	chrome.exe	123
PID 2876 wrote to memory of 5772	2876	chrome.exe	123
PID 2876 wrote to memory of 5040	2876	chrome.exe	125
PID 2876 wrote to memory of 5040	2876	chrome.exe	125
PID 2876 wrote to memory of 3352	2876	chrome.exe	126
PID 2876 wrote to memory of 3352	2876	chrome.exe	126
PID 2876 wrote to memory of 4968	2876	chrome.exe	127
PID 2876 wrote to memory of 4968	2876	chrome.exe	127
PID 2876 wrote to memory of 6136	2876	chrome.exe	128
PID 2876 wrote to memory of 4320	2876	chrome.exe	129
PID 2876 wrote to memory of 6136	2876	chrome.exe	128
PID 2876 wrote to memory of 4320	2876	chrome.exe	129
PID 2876 wrote to memory of 2020	2876	chrome.exe	131
PID 2876 wrote to memory of 5284	2876	chrome.exe	132
PID 2876 wrote to memory of 5880	2876	chrome.exe	133
PID 5728 wrote to memory of 2004	5728	rggffgg.exe	134
PID 2004 wrote to memory of 4088	2004	cmd.exe	136
PID 4088 wrote to memory of 5152	4088	gayniggasex_3960093417.exe	137
PID 5152 wrote to memory of 3832	5152	cmd.exe	139
PID 5728 wrote to memory of 1208	5728	rggffgg.exe	140
PID 1208 wrote to memory of 5376	1208	cmd.exe	142
PID 2876 wrote to memory of 1292	2876	chrome.exe	143

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	gayniggasex_3960093417.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\rggffgg.exe
"C:\Users\Admin\AppData\Local\Temp\rggffgg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\system32\schtasks.exe
  schtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\rggffgg_task.xml /TN rggffgg /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4444
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rggffgg.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rggffgg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -NonInteractive -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -NonInteractive -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -NonInteractive -Command "(Get-WmiObject -Query \"select * from Win32_OperatingSystem\").Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -NonInteractive -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5584
- - C:\Windows\system32\cmd.exe
    cmd /C C:\Users\Admin\AppData\Local\Temp\gayniggasex_3960093417.exe
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\gayniggasex_3960093417.exe
      C:\Users\Admin\AppData\Local\Temp\gayniggasex_3960093417.exe
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4088
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k taskkill /f /im explorer.exe && exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5152
      - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        6⤵
        Kills process with taskkill
        
        PID:3832
- - C:\Windows\system32\cmd.exe
    cmd /C "tasklist /FO CSV /NH"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5376
- - C:\Windows\system32\cmd.exe
    cmd /C "taskkill /PID 4088 /F"
    3⤵
    - Executes a command shell one-liner
    PID:3428
  - - C:\Windows\system32\taskkill.exe
      taskkill /PID 4088 /F
      4⤵
      Kills process with taskkill
      PID:2968

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rggffgg.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rggffgg.exe"
1⤵
- Executes dropped EXE
PID:4116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbd0cbc728,0x7ffbd0cbc734,0x7ffbd0cbc740
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,17408622011313702901,2021710764091730654,524288 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,5456944047582196597,5521874882893074546,262144 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,8591242628233331239,1008962183823243590,524288 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,17314022480417336994,18438956109352462245,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3080,i,4031443819610236926,2696110304902437267,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4628,i,1866114056152564529,13596212825459801153,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,11676030987567118362,12573900273512966565,524288 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4920,i,237113271162992395,12553612908126808079,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,15606253292603672871,48354192891575929,524288 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5668,i,15181096906994532483,11056374246484937263,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5712,i,1057097045206357955,6992419853749177138,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6020,i,15243864387591204960,13371309986695425586,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5704,i,16783158786345030363,2936936554597273591,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6224,i,16383923167376246064,7636240529497193839,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6376,i,4899647957646424771,9885019306155803817,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6668,i,7113096373957257777,5598397572284760331,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6784,i,727955314005287567,1955837598033854897,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,8124199887247705671,7956443397491690433,524288 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6720,i,11676936624007280129,987850256527072255,524288 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6712,i,1176173068336284185,15930155666272730083,524288 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5940,i,4395059810626714780,300044329295011175,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5932,i,682405258232746171,16757711652945975689,2097152 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:9
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6864,i,10484433013829686736,11270529449108790600,524288 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6840,i,7634535865570061115,7565590159389147182,524288 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6824,i,17563532606862619085,9870780418186588309,524288 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6172,i,17494911327418953324,11431604119799256833,262144 --field-trial-handle=1844,i,4515070839650540269,8187686436872547403,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:10
  2⤵
  PID:1292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

death.mp4

Path C:\Program Files\Temp\death.mp4
Size 6.1MB
SHA256 2828322236bd17503a3b9df95b07872d55b2f8982d7f94ca11f1ea5e9ef38d23
MD5 7e651857a9b34313e4e97162e770c4d4
SHA1 c51b07240168767d311dc52558bf8753956fe773
SHA512 d33037324d28437d3aa571891d7228972c09862109829caaab1a2008059b19a9ff06b616ffddedce0eb137692c99f0e1cdf42c33bf14b24def9c4959ec97c1a8
SSDEEP 98304:ZOpNuDI7EpVB9nnvhYkrsxNHqgZ6tjp1Z7RdoOI2EjGdVK5z1WtB4pnx2:A6DIq9nvhYjbZAZ9doOaj0x4V0
TLSH
T17C563348DB16E46AE24C973CD9E64711B2F1D081F287C35FA2BA67743E6639C4E538E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ff280b23eb36fec23a25d957dbb2e571ef1f1dd3ca4f7e8f656eafb4637157e4
MD5 000d9d2321a298975aaeea90b526f5a6
SHA1 71fbdeed762f3fa43df695ad48e5dce7fa7a5f96
SHA512 bc91760f5e24a8c33eb5454b20e524b06bc579d6582d490c44e995d8b036d22e65dbc2e3d4f8f284e3210b4cf29871b98999da3265c6d3fde0633936c4d1b941
TLSH
T19BE068A5CD28EC3719FD1B6C20800B86EB60135B2B41890F3A3D900C8FF16BB458AC6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 f8207148c845738a3ba2a68c7a41ec8be68b1728ebb55c56de710f964c86f136
MD5 49db41943a9ad8f78072a16d2d8942c1
SHA1 0a90e51abbe40c3cbdd8aa560e11819e769a6c44
SHA512 92104c5967e1474758cc96e28acadc8cf53ad8aa98d050f308f811c163e8fb0624dda5e2204ba46c490641c083aa3c15eeb2ed76b705138cf41a9f749f2a9c7a
TLSH
T162D0121163A4904FDB5135F2A05739E592205A2405C10BE3C7D9FCDCF9122DB6712482
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 a8504861fddf05f549928132d7b5e185b81eee1ee330e4dfcc5e2a2c516038f4
MD5 f35801d5cd9cc8f8203d209dcfb4b0ec
SHA1 c48224f25102522cd53f06ba66b556a009fbec32
SHA512 01d1adc032ee6f3624d219840d04e633e8e09c8113b8337bf511ece4c642187fc88e7d5bdcfbd533f5ed0e79575f789873d125f710eb1ced297a66a04a8c830b
TLSH
T1D1D0120162A8441BDB4134F2A52738959224AA240AC207E3CBCCBC98F92229A6712842
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2f58499c6e19e3788a19362e2ab08517e53886499bcbd668cff80443fa644fd4
MD5 30654abaaf93285add0a9dc2753590af
SHA1 2305666d12faed23ecaa47906d617218cca036b7
SHA512 1825081d2ebbb98de1b04386454869198a45b4149b2d11e7a74da46cc6e79ebb001c80e65b02909273768b842074e0b3efb4de25c44a845a86493c04a7b6ec18
TLSH
T10F517DB3D3D4DA7DC51166E4DA216E2FCD6D1924122D7C62C8E4AE5B53E2872D20038F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9569c7e8d5cd5ab90ea71eaf2a631ad04978727383d1af70d0a6a2461814a86c
MD5 b1fa2c0be05f90692a90698d59be9850
SHA1 e26686a59860af4cf65daf9e1d4ecb81c473254c
SHA512 fa4f7feac00bd683816672f1eb13791bbb751c7c7e6baa4add9d9b744ac425a12c16576abddadf72880072c3b4af25c6700bf95db1c3808ae3cb89c0828a3bac
SSDEEP 192:iRGXqgk4v7xAPRp2W9SHsb+WNnp/008GX9egVyIsnAUge:iRGXQkIXFEw900fNxe
TLSH
T16A42C61EAA04293B6DDBC22DF9257B93D7F6102635942EC8E7FC892C24E75CC621B117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 823ead3b04409856e1ee62bff227a68b26e54711a53ec8476ad5ec3fe6846561
MD5 58d8f45e7da9261725ec0e179e57964f
SHA1 8653c3bc3e30e570201de115861dae53c4d00a39
SHA512 04518288960edd1adc192f2e73a376b1a0b18bbf2140ab2539be4f06d8c6c81b0754b08baeceb016e10b2cd3ad158df4ec5e136a5eeeab452667b665b56792d7
SSDEEP 192:iRGXqgk8v7xGPRpQW9SHsb+WNnp/0orGX9enVyIsnAUgE:iRGXQoWX3Ew90oKN6E
TLSH
T14852C71EA9042D3B6DDBC62DF9257F93D7F6102225902E88E7FC892C25E76CC621B117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2e2687f4aa4b95b18f7ffdc76040c2909e26499d31c976a671abbef3a3143d47
MD5 88182ec4e608334db1a021f3d458c1f8
SHA1 f246828891e11ab5145b244f46f993de7d97b8bc
SHA512 4d4344898af9aba49cd9f16ba27192bacc99a78e9b44d9de9ba96fb7f3548396368e92a0ded2f253ec144d4d604525f6dfa12d34c980da8341a516b746c203da
SSDEEP 192:iRGXqgk3v7xAPRp2W9SHsb+WNnp/0t8GX9eLVyIsnAUgE:iRGXQfIXFEw90tfNkE
TLSH
T16E42D71EA9042D3BADDBC22DF9257B93D7F6102225902E88E7FC892C24E75CC621B117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5eecb1272a04a9112598c773d8031d192668f6d82b3ef4e6d6d27714c9d373cc
MD5 b43f9ca7e74f52ddb834bba4ec187faa
SHA1 53c97661e8544111af459a66e7101c4c5006443a
SHA512 f68db80bf881abb7ec23d18ed068aa6483745beb9583cdb1ed0bf1bae04bd121e0c7f564be6bc7f6da6af1cbb108aa7f416e84530e3d70ed28cbbe02d7881194
TLSH
T1A8A00264C5D10459CF3943707077394172535C5619524353E7B5085A8A5F1E0432510C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59be84.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59be84.TMP
Size 48B
SHA256 5eec8b259c8f7af819114e2a06cce063a5717946e72052e3e1ad1c6b61ed8b8b
MD5 bfd0f8ef698978a8ecb6436cf64ff8da
SHA1 add461fc5a75a1e187bdb13c6f3ec08a2ea8bc00
SHA512 e1f31c252c62df98c100773bdc10383f06d9f305ba95b3a03c7b6e45c8671477ff0876eb82bab491f39844059bcd27a9d4aba305f6ab4664dff38f536ddb473f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

abf70723-b09f-4639-a997-27d1e49f9fe4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\abf70723-b09f-4639-a997-27d1e49f9fe4.tmp
Size 11KB
SHA256 4c47278084b7e101de6067922965a67f24611ec38b438ff45c72cebc59f71413
MD5 7600618f86b6f03725a6a6344ea7c173
SHA1 0642e2220a3106a3532dc4bf96e37eb7b232b853
SHA512 5e2fc61072d43020f4e8c388c7c3d4f80823091ad3000771a8aa01600df53a93cba56512473a835c783a503db533697b6d60db692766ef755710e79177456c0b
SSDEEP 192:eG14K6ms7KxkXqK4I40pUZNCgVLHrKHfFKslE88OXzKD/l0+ErUkKN9L6y/kSUK6:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOZ
TLSH
T12F32D727A48D5A3F0FE8D40DDC136F8B6DB5029267780D2496FF9D0803A97CA125A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 a4ca9b675bb3c2ec86c7a1e73c22079acb7fb4cce5a99b98d04be0288b35010a
MD5 e7e0bca6758fda31baf1dae404b24aad
SHA1 00215f7a5398c1869923aedaa616751efff8cdf7
SHA512 f25867e182a110ff2de5a6176872d19669aa7b3e3cb8daba9b7942d10d0f84ec5d2be97775ee8e47552634547973b00758e01639e43b44b7ef5f61bf2a8d6029
SSDEEP 3072:ACrJLf9abAgduDLHffFTjFeYlxEbTCBZceVzFtmxixl:DLfcUgdGLHFHJxGE2eVDmwxl
TLSH
T179C312B7D42FDCBE2195D824F70F1AC67F6A272794E91DA2D684AF0842DF450424F43A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 1716287995484f63bf6d45579e4ff34375785e38f87dab7b2b00537b752690c2
MD5 06adb1d3a4a03c2ae4a6e5d25e99aca0
SHA1 1be770aa6a8ec271fdf48ace1e62f3c3f9eadd57
SHA512 ef56ca6a8cd425b8cd48084b9547ce6129d399e1dd3bf06ad665cb9af40b730f4a2f426ac3254e85bc8433fa8fbc4498433469bbb88893aa61e56002aba28343
SSDEEP 3072:7CrJLf9abAgduDLHffFTjFeYlxEbTCBZceVzFtmxixl:mLfcUgdGLHFHJxGE2eVDmwxl
TLSH
T176C312B7D42FDCBE2195D824F70F1AC67F6A272794E91DA2D684AF0842DF450428F43A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 99b37cf29dc7419a6e15a01e2aea8b9fcadac44d739b441c0f9cc556f3b46b96
MD5 efe2f256f65cd861fd40663d1396a7cc
SHA1 36e7bbf34cbae4c16fd0ee65b6375e07a8a2c680
SHA512 2cadff949f9099df997a1d4215f661a02722bfa7efa5a899d3984da4662cf760e8fd0f9bd23131a8942a5830650db37bb3889d4ca1fd878ac23fcab71e14f3ed
SSDEEP 3072:2CrJLf9abAgduDLHffFTjFeYlxEbTCBZceVzFtmxixl:NLfcUgdGLHFHJxGE2eVDmwxl
TLSH
T1C4C31277D82EDCFE2561CC54F60A1AC66F6E271BC8E93D56D980BF08029F454424F83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 fc1e7ba687a624b92f5dad95753f606ef1de0b07ab0b5bde9355e830fde6ee89
MD5 07c415cdd5d6cd393849e4205d244518
SHA1 7d429df032c083839a04fa2feb1540cc4124690c
SHA512 f43e1bde9f406b694d3b6c902a35d372ad53b3ec1f87eb4212f511393d1ac7cb3d35925460b84cbc9bb988073e361d032f7f9f378dea517a72e386aabfe0d32b
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5W9D+nB6EGyvP/e+0LZPEOLv4a:MC08UR5rYv3eDUDk+Bgae+0LZsOP
TLSH
T167A10973E86E8D7BA976C48571062B47CEB5B07BE521AE94E9EC1F0C01EB0EC1301623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 640KB
SHA256 dcaa332034b8dfcc83a967c6cfce07ffc20c823be5dd2bef39fe4e994e4116b3
MD5 bb35aeaee9a17ffb08d27e4cf460032f
SHA1 409e22ffc016d856a6065eccd6d101f72618a6b3
SHA512 0219bac0792ce54713dfb91ab403ba116c533f2dfa5b5f8957b360f922f418e383d131e3dc1db5fed044a9e3c7e93414225a282aec1bbd3a5bd27a7a31cb550b
SSDEEP 768:Uf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3Q:U69tQeoVYocxYCutFCJGAKt2hZ
TLSH
T1ECD40C3BA470A098DF3C35B1E2AD6B4CBD72641A12E006421F74B57F7A237D8DA0B5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
MD5 9db254dd0cf5e2b1153ff5cde0ed8885
SHA1 de97945a57babdd2498693fbb2b3d8bc548da209
SHA512 a86e71b1b09215d626067d2fab0d7111a5718937c4097b826e77402d32aa3bf64d73a8886104f7b0ae434dcafb9abab4d04d2c053cb65510d611c069d04f7011
TLSH
T19A115733B3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uftrfuw1.zm2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uftrfuw1.zm2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gayniggasex_3960093417.exe

Path C:\Users\Admin\AppData\Local\Temp\gayniggasex_3960093417.exe
Size 12.9MB
SHA256 1929b12184083f573f654188df432a92a40065d92c114662088de6c3e6f49863
MD5 deb4cf51b627dcb9ec40beee3e4345cf
SHA1 a56e5dc1d43734391a6c1b6fe7440f460e0776fc
SHA512 04ff7c2df5f68e35f07586f09a04e278113a9b56b1d4146f978085b7e5e590a1ecc1e2b48c06178dbaa3759523d12f138bf4b021cd515c06715ca83b4558fbf2
SSDEEP 393216:OsJi3gtWLExqLsY9jAaRgHuF07yp4f29sTahwXeVELC5IvmN8jqxAnOlUbSJY/W8:OsJi3gtWLExqLsY9jAaRgHuF07yp4f2c
TLSH
T103D62206374C943AD9AD837DC2A74730A270C6417452DF0B26AD3A64AF9738DAD237F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rggffgg_task.xml

Path C:\Users\Admin\AppData\Local\Temp\rggffgg_task.xml
Size 1KB
SHA256 5794725662d69b17ef83f7671b1f45b506d2667c8ffe8a1c0ff154a1fdbfa79c
MD5 a174ebb474a3d35a031f791a752ceec7
SHA1 05beff9e8332277a379025f87b9f91912b915400
SHA512 e33ca6cf0c488379611a8124dd552850c49e3a2b6015fd55abc71bd36265036bae72f98dd696a81d6331b1906bd72d75f31a5ed41cf00fb62fdc858b3c5275e9
TLSH
T17B2132905C10F22FB56A963ACB921383377EAB690AB14038D8CC4DBC748A1CA711397B
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2876_1605774141\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

rggffgg.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\rggffgg.exe
Size 10.7MB
SHA256 2cb4ffefb6723657e5ea37b38e7107d8822a7dfc7b9af79b20c0306adf907aac
MD5 2e4cb26fd5760bc5895301d151e8ef74
SHA1 a416fb0c4c53941be340b378894c134c191968ff
SHA512 d88abd6ba3d344796ef208696408a6136bbd145a43b780b594c0396bf3737dc91ce898f3f2e6af2aefd0e6f7b633d2305ed0474e0e3d7b46ee47381656aa43a3
SSDEEP 98304:J9YrC8KnSrf1+/MFkte2qx2pumvBh8huTdEh:JgD+s9Oe2arh
TLSH
T132B64943ECA501E9C1ADC575CA2A9616BB713C894B30A3DB5B50F7252F37BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2128-10-0x0000023B7CEB0000-0x0000023B7CED2000-memory.dmp

Download

memory/4088-510-0x0000015941D90000-0x0000015941DE8000-memory.dmp

Download

memory/4088-508-0x0000015941B60000-0x0000015941B74000-memory.dmp

Download

memory/4088-585-0x000001595BD00000-0x000001595BD87000-memory.dmp

Download

memory/4088-503-0x000001593F0B0000-0x000001593FD9C000-memory.dmp

Download

memory/4088-638-0x000001595BD00000-0x000001595BD87000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads