hxxp://joyjak[.]st

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
12s
max time network
63s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://joyjak.st
Sample260910-tk427avsas

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
18	api.ipify.org
22	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4476	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335300950342205"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{94F076A2-5AE0-44A7-A44F-8210D4567D13}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	chrome.exe
1540	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe
Token: SeShutdownPrivilege	1540	chrome.exe
Token: SeCreatePagefilePrivilege	1540	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe
1540	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3800	1540	chrome.exe	83
PID 1540 wrote to memory of 1300	1540	chrome.exe	84
PID 1540 wrote to memory of 1300	1540	chrome.exe	84
PID 1540 wrote to memory of 4476	1540	chrome.exe	85
PID 1540 wrote to memory of 3868	1540	chrome.exe	86
PID 1540 wrote to memory of 3868	1540	chrome.exe	86
PID 1540 wrote to memory of 3496	1540	chrome.exe	88
PID 1540 wrote to memory of 3656	1540	chrome.exe	89
PID 1540 wrote to memory of 3496	1540	chrome.exe	88
PID 1540 wrote to memory of 3656	1540	chrome.exe	89
PID 1540 wrote to memory of 4232	1540	chrome.exe	90
PID 1540 wrote to memory of 4232	1540	chrome.exe	90
PID 1540 wrote to memory of 2660	1540	chrome.exe	91
PID 1540 wrote to memory of 2660	1540	chrome.exe	91
PID 1540 wrote to memory of 4392	1540	chrome.exe	92
PID 1540 wrote to memory of 4392	1540	chrome.exe	92
PID 1540 wrote to memory of 3932	1540	chrome.exe	93
PID 1540 wrote to memory of 1580	1540	chrome.exe	94
PID 1540 wrote to memory of 1716	1540	chrome.exe	97
PID 1540 wrote to memory of 3348	1540	chrome.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://joyjak.st
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffac94cc728,0x7ffac94cc734,0x7ffac94cc740
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,4762511670562284979,6195517160894126206,262144 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,10305431999918719399,15182725095044921986,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,7656621974077542787,2502526244591823546,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,14699978272038152761,13325002183230350640,2097152 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3176,i,12592971782443130729,7025516926926890733,2097152 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,5378247351642240031,3509770601079441011,2097152 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,7549973394949185303,2603566962854290546,2097152 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,13410289697826657307,18171939345820111364,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,17715975000131425137,15325006594203630773,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6904,i,12052664297962653275,13153442974388429051,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4960,i,11183896982760409959,13825767578195531396,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6876,i,9675270047437753149,4194544532088873716,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6904,i,13697956683122565457,15844231020812797292,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6960,i,472531365270312831,7106018756337923050,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,779839720895725453,15834966656034662957,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6944,i,14967326111016913267,8433751298610192168,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6972,i,10555794429892137426,12909182747476487897,524288 --field-trial-handle=1940,i,14927339862370759842,8868153490385365283,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:4952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4768

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x31c
1⤵
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4252

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\caption (1).gif"
1⤵
PID:4288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4776

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\poop_virus.gif"
1⤵
PID:3144

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\caption.gif"
1⤵
PID:4856

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\cadocompetition.gif"
1⤵
PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 34618950e0fea4f22974fbe9871df7fe932ce9f96ba9f9f5932f10c6af8bbaa7
MD5 3dd196143c249f9ac5368c44be4cd028
SHA1 38c424e83c3632397c44bc8e33fdaa90b7cf2969
SHA512 9340293c4770b50df206891b194ebca469ebe99c61d8abd5feafe8583a38036d626ca4eb767b34a473040cbcf5ab2e1befa686f3cff7ba5aa88399b180a3f220
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e095e617ce3a1f1e0a85a6624bee2767e6b96152ff4bce79e7aea4544f58fbd3
MD5 63b2a2e316853061667c11c52b40f8d6
SHA1 ca90c2383607cb52b5edc997a36c030f6c10146e
SHA512 5973ef3c071ec3b08f018ba0a7a96b462d82eb9519a6139df539da749bf049e9d84ac9e9ef018e9e4778ef012cf40c528f141c359e3809500f3812633a88c999
TLSH
T17DE022EAD92AEC3B0CFE0B5E14140A46EB5113573A94890B3A3DD21DCFB067E428692C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 5.1MB
SHA256 624a1d8b1d0cc7a225d44c38e21b8a032cf303f8680e4ea37cfee175b9500da2
MD5 4ac83653330893efdcd07077d260c134
SHA1 3ea1b4cfd5cd20bb176870eae0801177cb476408
SHA512 035bca7d2878a304c24cc350b2a0804370d6ddf4bc2cc4e5f98bf60a492c403f40aaf61af2a3442eb7a84ebe3a7f0668611951af13ccccaace4c64925fa5bd7c
SSDEEP 98304:vQdZKJGkbTL9/Ft1fPjnBYQ7f4MFhQTpYamB6:vwZKJGkPR/FXfrnocH6
TLSH
T19E463393880391C0F93E6EFB775283D0179E288C6FF4A269A58B891D785F02456F71ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 22bed4828010a01322e83c7965f125069d978d2c546f2b5e1d0b1302785e7886
MD5 ab2b7ebd77a9af45e45556a268cc4c8a
SHA1 47e368312c187b91fa4f680cf36512346a5af68d
SHA512 6d1b52f3aaa14f2ccb2386990c28eb04adc76b8946ef2b837771aba29796edf57345420969db78ce023b38166cbd356269ecde378ccfea97f3080a661c21b4ab
TLSH
T1BBB012502AE10505CB114BB411C360402264462C5141131386D0C0E4C9273E062374ED
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ebe0ced4d938c99c510c6e7df44c550d82ca3e0b935738b4daa240742c715a54
MD5 3ece813e080ad46f0bb7bb0db786eae6
SHA1 d4920e32c83647c05df39983078dfdd9244dd6f0
SHA512 f22752139e93fac32365b4c4f4f7015ad16c26ceb48b291ee5e9f8c953ee56c0c9ec49fe55f2660384e320fee50fbed65fdd58b0364272d5b942a37e03e71e2f
SSDEEP 192:wRnVNxIzdHxXPdv7upAPRp2ag9Q9Hsb+WNn6JzSg22RVFmRJVyIsnAUge:wRnVbG9dCUX4qwyB2KVqe
TLSH
T19742D52EA914697B8CDBD229F9627B93D7F5103135981E88E6FCC92C1DE75CC2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fa76f850fec430b3f38d7f7bc091f52f1386b2b5d5e60795ed3b60895f9d33c7
MD5 f0e1b47fa9152edb0fc7ab0f8316c826
SHA1 36867b3b59be44f05c7f51afb769cb939cd10892
SHA512 7a4b99c486b641f1e4d18cbae3cf4516d958958b9d3561a04b6f0447f547df3724365e3a3d672759bdb8f6fbe39ec31426dd15b1ec920346d80435f5fce782bb
SSDEEP 192:wRnK6xIzdHxXP/v7upAPRp2YJg9Q9Hsb+WNn6JzfSMwRVFmRJVyIsnAUge:wRnKuG9XCUXKqwyOMQVqe
TLSH
T15F52D52EA914697B8CDBD229F9227BA3D7F5103135941E88E6FCC92C1DE75CC222341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 dd2f60b87c921e0c108510918a4feab66d3dbd4c764762bb5eeb58b6c1cf829c
MD5 8e57cb8bfea0622664b34a683f258fe9
SHA1 7ade466af827577f464ccdeb75e934acd9dae0b2
SHA512 cb689c26a4fa66e4985e12ccda8317926a3b0861560065212cef74a011ca18aa9b68950bce8600ecda9aab4c7dc3d35fecf7385e3d9b44d84b7ed25efc483732
SSDEEP 384:tnjp87KxkXqKf/pUZNCgVLH2HfgsljH7pLuLcSjjeXODpk+ErU3hCHGfYT8+wA:tjp87KxkXqKf/pUZNCgVLH2HfgsBH7pl
TLSH
T1EE7219677C4C8E770F94D5CCD8267B4F9DB5024B65E9886883FA982903D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 436c50f173cf34d5d2211fbb28496cb0abf7dae44f570c6bed6e758875f7d8b8
MD5 dd8bd8003b1cda4901901a7a4d226b95
SHA1 357d1ced7de40a802a678447cb1445161457c45b
SHA512 602da5ddb1dfb352e1076b5084587f404ad732277242de99de0dbb741b73f3c8c0b9dee14cae702317d2872a9dd99b3dca83fa46569ba9bcf1a1dcd6f5e3bda3
TLSH
T193B0128081416901C0570AF0168254C8BB645F11960B170193F0E927D826162C434474
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58941d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58941d.TMP
Size 96B
SHA256 ac09ba722af349c670eea5d72f3ef8ca69ff2ac913d3c169e8ebb76278e760f6
MD5 51789058b00e1424fec0ab1a006cf39f
SHA1 067a46d57a453e44ca1bdcb09c751fb36b860fb6
SHA512 af9370d530235d88a24329e67115ea33239c8bdca0ae2f48d081d1b9b16a8189783ab014ffa424c2e2afd6ba2fe317ed1589d308c479b2b565e6bfd435aa3d9f
TLSH
T1A4B02228C0022302C00203B022E8A0E83030CF20CA030322E2E00A22EE2A23000200A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 22117f3d1cc3b2625ea8ed2f63ab8b0f71d2a7a9ae3d96a60769ccb1b94c0153
MD5 07e7395944cde67b87556914760f1dda
SHA1 b21ab79916b67a778d4b53c6802306d26fb2dff6
SHA512 9dbd46913d0bdf6bfd9c8e8424fee76482d5f653621913c4f948a6b9b923bd5e66d1eb72a1bc6b374743a6e48474a46389057cde84422a9a612a2b9ce9ee9cbc
SSDEEP 3072:tqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:tqfRRVZFX8KZGES4F
TLSH
T10CC302F1A81A992FF792630DC38F2F0FF56EB141D1295A8078DD452F94477842363B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4769a7024d6a4ba010c52a71b2695763cee49c02cec5a18f90888f23f064b779
MD5 6b5db7f5edf6d0ddbb376ae9bc80713c
SHA1 da41ed01eefbf8e074e88bd0ca58ef777e2ad00c
SHA512 2475fed400a446fca95fcb471e09fc9e8396c54669413b5875a853c13befddc733b9165095abe7745f7fd0e01295462efdedf2e92fca99403ef5eee3498e6745
SSDEEP 3072:qqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:qqfRRVZFX8KZGES4F
TLSH
T1CFB312F1A91AC96FF356630DC3CF2F0FF66EB141D12A5A80789D452E98477812323B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 371e0c3c30d8d280f94d37454cf182d53043e1cff47e146cf4252259c3f4f470
MD5 f12ee2876cbb619087df5a17989d1c81
SHA1 47e453e9d790654ee079605676584524ab27e43d
SHA512 e22f116a08577cc8183d044084541bb8226a7329c950d854432efe9714c74bec7a7af8a541d121c6c359d0b318dda06abd328acd85f6212fa930f24d81dcddda
SSDEEP 3072:AqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:AqfRRVZFX8KZGES4F
TLSH
T127C312F1A81AD92FB792630DC38F2F0FF56EB181D1295A8078DD452F94477842363B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caption (1).gif.crdownload

Path C:\Users\Admin\Downloads\caption (1).gif.crdownload
Size 6.4MB
SHA256 b507a54a20f34e583267d273a8eea6f43baf382391cb989c554e4b4bc346aa84
MD5 c92e61050de52f855062cba91dc47585
SHA1 3f0330ef09b2be666940a7cd06b95734348da5d2
SHA512 8d70e67ddc8c6e6b63eb893f8146ef7c66eaf9289c35a7333f0b2a7b0db96553b007b5eb2dcd61c308b9a6d82683610c681ba85e10b65a313ad9bc3b03dabf78
SSDEEP 196608:G7MsSHuccsZaRFpNxAkWa87iwmv2uaa6EBpSgjt:G7Mss5ZSFmkY6OiSgjt
TLSH
T1E76633EEF602020D5435E9E8725A45466C48C68808FD63FA7573B390C3E66BDF5AF788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

poop_virus.gif

Path C:\Users\Admin\Downloads\poop_virus.gif
Size 1.1MB
SHA256 2af83b291c7f2b48a6ace50ea8d0a47fce564a1a358be57332438b7742492dd6
MD5 dbc573088d2e736e7f550a6305db3916
SHA1 edbb2ca3bdcdb4f2ea8cb2c2711b1443dfc4caaa
SHA512 c68cc9addb8ca68036980ca913450d0f9a91286ee0d04706f09236f168324e918962bc94a1e4cff5feecad2c4ebe6a698866ebcdfe21fef8893511908f056b2a
SSDEEP 24576:dYt4P5fdn+wUtlgIPsKmTRFH0CDkNeIrGxNkPanim+:HrUtlUKmPUCDgebxN6I+
TLSH
T1394533E6FE2221056651B3372024F35B12AA6B2A4F601A079F87133DEC2F1F4967BD57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 36e9ede93f02f96a1744916ba3a0857329e34de11f5550ca99d2f71c066f7c2a
MD5 8e7b7a9467cf8fd302a612fa458a8c1d
SHA1 a2e4fc146fb6e018a7473f8bd9730c1dc773058e
SHA512 a4f667eca48d2f7a7d8c31e5374339938d301699c71bd1d5fed822435670cbbee59edd92fa89d97cd9708f5c42c22b8f4b55f2537cfcf69b1b7374a4d190de25
TLSH
T18461BBADC5416C8FD7BB3149CE6210CC1B5FA8E669F244310E3FAA97906E188C3F7846
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 6KB
SHA256 ed2369bbc7db90de18d4409ea687d29b7dbbfa8f52e611e4c86e634a1b26880c
MD5 7272b558fc6bd55e0f752dc96d87db64
SHA1 9bb24d1338191bd0409f1a055ac48e5138dff9fa
SHA512 bb4cccf5171808d9d53f0a82f7b50261c8df4140a3562f931a562249003d3fe0ca1f2d54032f58fd18e34fb26ff713bd44421c257b90ba0dca5d76ceec29c725
SSDEEP 192:0GSmISXSfSweS3RzoURZS3RzoURDS3RzoeRJS3RzoeRRS8HS87ASJS8ZXSmDS/Se:0GSmISXSfSweSlSvSRSJS8HS87ASJS86
TLSH
T149D1CEECC4416C5FE79B3249CF9510ED1B5FA8E669E100710D3FAA96A0AE24CD7F7806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 9KB
SHA256 35053d3d11ffa88c4ae4c19e060de390ae1e7127b4cb807f0cd57703663f512c
MD5 6fcd5c31922e562a1da77a3d08678f0a
SHA1 e99c5783bfb1e877e57160eeffb49f623eebd821
SHA512 7f6272324d852469ab2a85544b8602d25675c7f2462a07ddedfe7e59fd74e26b0ff233a7e6f0ccf11fcf669332b41544a4b3be8a019e69b59126229da441dd24
SSDEEP 192:0GSmISXSfSweS3RzoURZS3RzoURDS3RzoeRJS3RzoeRRS8HS87ASJS8ZXSmDS/Sc:0GSmISXSfSweSlSvSRSJS8HS87ASJS8A
TLSH
T1DC1200E9C4812C4FE79B310ECB9510D91B5FA8D6A9F100314E3FAE96A0AE15CC7F7816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download