Analysis
- user interaction
yes - max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/10/2026, 16:09
Static task
static1
Behavioral task
behavioral1
Sample
NDS_Fling_Script.lua
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
NDS_Fling_Script.lua
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target NDS_Fling_Script.lua
- Size 148B
- Sample261011-tl4stach84
- SHA256 d773d4be435c0599e63ede817faa916d5a5f8046ebd6e86a6fb7304678cf741f
- MD5 9a736bd55fe3bc0817ff08b50d201584
- SHA1 1ee4f01951e84e15a51e152cbde7695edcf22030
- SHA512 a15cc4b3085a3b4197be3d6f68b7c4263287e8707050407fb978f4b8da4fead1b3724c7a31e925c96cefb3bf5dd8e30e68f9c810cba6b17635b5c234a767f4e1
- TLSH T1E9C08CDEAC1096AC1A32E8E0516018489E30000D8420C0B6A2A26908C6B27639462224
- MD5 SHA1 SHA512 TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 149 6108 chrome.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\NDS_Fling_Script.lua NOTEPAD.EXE File opened for modification C:\Windows\System32\NDS_Fling_Script.lua NOTEPAD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5676 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 6108 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies registry class 50 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\lua_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 NOTEPAD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" NOTEPAD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings cmd.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff NOTEPAD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff NOTEPAD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.lua OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\lua_auto_file\shell\open\command OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 NOTEPAD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" NOTEPAD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" NOTEPAD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\lua_auto_file\shell\edit\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\lua_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings NOTEPAD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 NOTEPAD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5a003100000000004b5d4181100053797374656d33320000420009000400efbe874f77484b5d41812e000000b90c00000000010000000000000000000000000000006eb3fd00530079007300740065006d0033003200000018000000 NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\lua_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 NOTEPAD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 NOTEPAD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 NOTEPAD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff NOTEPAD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\lua_auto_file\shell OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\lua_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell NOTEPAD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" NOTEPAD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" NOTEPAD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 NOTEPAD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\.lua\ = "lua_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\lua_auto_file\shell\edit OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff NOTEPAD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 56003100000000002b5df282100057696e646f777300400009000400efbe874f77484b5d41812e000000000600000000010000000000000000000000000000004cd03600570069006e0064006f0077007300000016000000 NOTEPAD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" NOTEPAD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" NOTEPAD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 NOTEPAD.EXE Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 NOTEPAD.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 NOTEPAD.EXE - Opens file in notepad (likely ransom note) 2 IoCs
pid Process 5104 NOTEPAD.EXE 3948 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5108 chrome.exe 5108 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4776 OpenWith.exe - Suspicious behavior: LoadsDriver 10 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 652 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe Token: SeShutdownPrivilege 5108 chrome.exe Token: SeCreatePagefilePrivilege 5108 chrome.exe - Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe 5108 chrome.exe - Suspicious use of SetWindowsHookEx 62 IoCs
pid Process 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 4776 OpenWith.exe 5104 NOTEPAD.EXE - Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4776 wrote to memory of 5104 4776 OpenWith.exe 107 PID 5108 wrote to memory of 2836 5108 chrome.exe 118 PID 5108 wrote to memory of 6108 5108 chrome.exe 120 PID 5108 wrote to memory of 5304 5108 chrome.exe 121 PID 5108 wrote to memory of 5304 5108 chrome.exe 121 PID 5108 wrote to memory of 3288 5108 chrome.exe 122 PID 5108 wrote to memory of 3288 5108 chrome.exe 122 PID 5108 wrote to memory of 5796 5108 chrome.exe 123 PID 5108 wrote to memory of 5188 5108 chrome.exe 124 PID 5108 wrote to memory of 5796 5108 chrome.exe 123 PID 5108 wrote to memory of 5188 5108 chrome.exe 124 PID 5108 wrote to memory of 5664 5108 chrome.exe 125 PID 5108 wrote to memory of 5664 5108 chrome.exe 125 PID 5108 wrote to memory of 2992 5108 chrome.exe 127 PID 5108 wrote to memory of 2992 5108 chrome.exe 127 PID 5108 wrote to memory of 1892 5108 chrome.exe 128 PID 5108 wrote to memory of 3532 5108 chrome.exe 131 PID 5108 wrote to memory of 3532 5108 chrome.exe 131 PID 5108 wrote to memory of 5888 5108 chrome.exe 132 PID 5108 wrote to memory of 5888 5108 chrome.exe 132 PID 5108 wrote to memory of 4256 5108 chrome.exe 133 PID 5108 wrote to memory of 4256 5108 chrome.exe 133 PID 5108 wrote to memory of 1448 5108 chrome.exe 142 PID 5108 wrote to memory of 4956 5108 chrome.exe 143 PID 5108 wrote to memory of 4540 5108 chrome.exe 144
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\NDS_Fling_Script.lua1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:5676
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\NDS_Fling_Script.lua2⤵
- Drops file in System32 directory
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:5104
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Windows\System32\NDS_Fling_Script.lua1⤵
- Opens file in notepad (likely ransom note)
PID:3948
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffebff3c728,0x7ffebff3c734,0x7ffebff3c7402⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,6008949826315561168,12022894849644262539,524288 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
PID:6108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,12457797230416478257,12730351260182812183,262144 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2216 /prefetch:22⤵PID:5304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,5803044631414341852,10618806275763664504,524288 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2404 /prefetch:82⤵PID:3288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,9960235862299303465,5082194532793698174,2097152 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:5796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,6601592284310776141,34278863592755466,2097152 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:5188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3876,i,16104671078279642362,459513301555154256,2097152 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4456 /prefetch:22⤵PID:5664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,4385916341185313564,14827052930886172230,2097152 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,8022372447125124110,2760945498471063300,524288 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5452 /prefetch:82⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5832,i,9713378340924998727,5181572087177010509,2097152 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:12⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3380,i,17526915973521416724,2049005925319355822,2097152 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3444 /prefetch:12⤵PID:5888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6044,i,5515974968927222521,16983171411956764934,2097152 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5972 /prefetch:12⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,1622623556945009356,8656282722404154291,524288 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3472 /prefetch:82⤵PID:1448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,5709374659205761155,17232445613994893960,524288 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3260 /prefetch:82⤵PID:4956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,6403219113513748791,7573932071006863577,524288 --field-trial-handle=2220,i,15782768491844977964,16890754349254228345,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3532 /prefetch:82⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3852
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5596
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\28e8018e-e204-449a-a256-a6c6f45f82c6.tmp
- Size 130KB
- SHA256 986ff80be8603f7c81a4aa0ec771785ef8f4f3707cb34a2992ceb75fa96fbb92
- MD5 f43f9f9401d601aa8c975b58b875b47e
- SHA1 301a242fd5f65e8131ab6133bb7e4972759703a8
- SHA512 59f47ff03c69b047698c93eee3a045a96edfc7c7eb0b49f7525625b99cb296a4ab942ed08a7c3a385aebad8520beb51462a246eb82b3954bfc6687d4a665bbb7
- SSDEEP 3072:Ur+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Ur+hFD+7t56OD9ZfSApprB
- TLSH T160D31232AA91D8BBC9BC6141B157A300DE76ACED45DE3A09444A5F8EE05FD4C07B3A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\416944a0-bedf-4f80-9ebd-9049d35ca6fb.tmp
- Size 414B
- SHA256 110506a1d6e6929a7ddc4183d7f2d3ce0b00ca2393f0f5267b3dfb3d1e363f46
- MD5 c800f7e5ff660eab483f7eb1fc6f8c6e
- SHA1 ce8ceb06ae93d5b228c8f738bff2ae782f4fad4e
- SHA512 6523cd37c4bc36a698e3924ded9ee3d1a608b0ca8dbc5cc83d5b91676e989b20aea6752b76e94fb7527116cfb321d2088a402924c4897a61b9c5030c5db44ed9
- TLSH T1E6E02BF6C962BD371AFD2B1D50508B87EA4513573750980B3A3D450DCF74AB6428591C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\66b0fac6-d2f0-4adf-b703-a2ae8e975785.tmp
- Size 13KB
- SHA256 5afb7b4eb1ff3957e611d9eb2c1d7d9729b7de3b8d853693c44263e01ae50825
- MD5 5a1f8ac10d2e7bc955644f8df1b0bddd
- SHA1 21f20c8fceaae7f4e4782336bbf3c02800892908
- SHA512 231e1ff550ff8643798a5c03865d0eb90e39368f8cc97bc147ed3a6ea6265d8237d210eab9fa42db5709e224d40cfc3bfe9041a3789b0eff5746dd085b3be960
- SSDEEP 192:FRQRg2cBzRLpj25wwv7GpAPRp2Dk796Hsb+WNnu14IH2l62qFiVVkwgVyIsnAUg8:FmRg2mzR/sCUXjswYD2I2qFuVE8
- TLSH T13052932EBA147A7B5CDBE229F9517B27D3F6102524943E84E6FC883C14E75DC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\710d5790-3cff-4b0c-880e-19643bc09d82.tmp
- Size 12KB
- SHA256 95ac4f3ad3f48f74069df795e964ff8def076ad454abecfd253079ccc79ca921
- MD5 9b41b73375d15b82499481ad2c3d868f
- SHA1 5912ce03e12d5a9bd1294f145dae6c827782308a
- SHA512 15d4f79ff2ebe31ac2517e366b60a69061a73a2b2bdf140fa43cc5f9991307fc2b57cacec08793f044055e4ff399d7732339a11014815f7910acf0c16b3e71dc
- SSDEEP 192:FRQRgORLpj25wwv7GpAPRp2DDY96Hsb+WNnu14IH2l62qFiVVkwgVyIsnAUgtaJ:FmRgOR/sCUXpswYD2I2qFuVE8
- TLSH T1D252A32ABE147A7B6CDBE229FA517B27D3F6102524943E80E6FC883C14E75DC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\94332d16-1271-4978-a5ec-5d2c832266c8.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
- Size 346KB
- SHA256 a1ceb3df9fb44cafac57aa6814112f415b31d062f45029b84330a4c8b6ee2223
- MD5 807f8ed795ff77a6c52f008ff70e789e
- SHA1 d2c5b378d4c9e95c777a2b2767248cc4ad57eb05
- SHA512 9ab714adadd47d5e4124250693f0bc2366fb520fa9148d5980bc80be30880fe9d42b57c815be020acbbdaff434bd0209888b1050bb269ea06030c9dd97638703
- SSDEEP 6144:gK5i8M8Z3iE2CPijzOflx7Dcya48kFcUl0hFvpBuEHAWwuIySTPxtBJyS4Nmir+R:gKA83iEF7nFzlk5uZuIySTDBJyJLrFiT
- TLSH T1707423104324319ED4DF2DBD4C016ACABAF2899E18D3E6DD0CB1F1E69257C1FA626B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
- Size 123KB
- SHA256 3e8def8613402b499a20e2975598b9f4e86c3fa0c197201e1ab5856c96fb6b15
- MD5 8e6c9a2471c6ff388ed2cb8a924788c0
- SHA1 0c52e7b14ac56ee7ad2518711fbf1871774541ad
- SHA512 1611a1e7b8e5c363a3c57867c569c38e12df91296428e381233e99427e14016886ef0d6bd767a2b130f773f261f130f1b918520f961e9ccfb701fbda22b29bfb
- SSDEEP 3072:dBHk3Gy4RBVRVEvnyi8ilerRUj9qUS+IOZ32xCVrrfqKxm8:d50GyWBXmvnyvil6RUjPZ32xCBlm8
- TLSH T11DC312513ADE4453021CA83B5CC456B636E1BF9A5C829849D6BB07511083FFFA2AEDF2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
- Size 451KB
- SHA256 602f2e98b9e53f226d183d75b39bd4ea187701b894be71d306898cf49302bc11
- MD5 73fa936539570d55b25739dd24247bd0
- SHA1 4167c9937e33e27586f400a3d9d3d52f04abd177
- SHA512 fa3d11b23cef283e0dc19eada6110973364ae618437035f57da2616e5b159ee94bc7d768766eb4e550ba89ca0d31082c7513c3f8ee17d902ac672b6edd2723f8
- SSDEEP 12288:5Ig8SCShDapMe+11oakQkN4jlhvYCYUS7t3Ixi80qU6Pv3:5IcCShOv7J+lhvYCHWfq3
- TLSH T142A423DC8B36CCFDB11061C0A128B9ED548CD6ED5B6AA915F060B7F656CF38687E84E0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\afbe6c9a-dbe2-47a7-9de9-1d26ef2dbb64.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 4eba6d0fec222f9c8129a2d1aa63ff6b68d66c003dd76bdf26bf819df3ec2ec1
- MD5 8eff52e526eac0a0a69865c04393b41d
- SHA1 260124a739a4e8333d97298e85143fa605038d4b
- SHA512 5fda4dc56dae375c78cc63d7b8f67dac0085639c6116732d315c79706b7d2c26a9aea8d8d5be4ee3d73e90ee0572444954f3203c0b520e5934a8f9c31c777c9e
- TLSH T176B01209C0822301C40103B011A0D85833A4AF39D2122385C9F00E528871150401711C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 83c1de1f6042d7669259f32e8150c4ff4dc6b5a717fcd797e04005b7cc827fce
- MD5 705ef69c81066b031a6f304384b95f58
- SHA1 bac86001a7f5c0061d9ff7627eb8333a15ffa9b0
- SHA512 acd385434801ecb1e8cf826c2deb6b61bdfec2d13a7bf0219c5464facc4fbd1cf19c2a7ae65479659b0a3886dd2a0a2f916801874c185a78493cb2dc06aafcda
- TLSH T123B02230C003B223C08203F02A888ACC3020FF28C2832A22A3E00A2BEC38A200020230
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
- Size 96B
- SHA256 23a65cbf9ce6aa9a5279b501b1dc4d0c9f99b659396a1ea76ab2eeb8e469f228
- MD5 76a982ff80673740705a28c3fb83809a
- SHA1 2c2568d8a585f108142d6b5362c766539e66d4e6
- SHA512 fa4e3df60f74ae8652f9a1abceb2444b4e53ee773227369ec36e89a29d61e59e8c6d58245b9dae32cd15cfce548486ed746a1f47a17daf1fc9296966d49178e8
- TLSH T159B022080B028082C80ACF3002E028C0FB3B0CA823C3800322E880A0CF333028F02230
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b340b433-643b-4c0c-a0d9-329f1c041dad.tmp
- Size 13KB
- SHA256 453d1efd045cfac7c173dbb7637fc3ad10e5c63c92e623ae55e4f0b8ac099bf0
- MD5 11a7752309b5fda01eb5d8b66f083078
- SHA1 58b4d97d5ae96688a4415fff78771c6f80d4e2e6
- SHA512 3ebae8f780e78ccf8a3281ea2c10311483ffeb520c48c130da3b471b107afecaa451e715e5ea13be61c0ec800ac20f20d1b0d3073e81c489ca5b4d1a5d19d463
- SSDEEP 192:FRQRg2cBzJLpj25wwv7GpAPRp2DkmA96Hsb+WNFUu1leF+IH2v62qFiVVkwwVyI6:FmRg2mzJ/sCUXvswp+x2C2qFuVUe
- TLSH T16252932EBA147A7B6CDBE229F9527B27D3F5102624843E80E6FC893C15E75DC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d3a17b1d-e6fa-46e7-bb60-dda31754d24a.tmp
- Size 17KB
- SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
- MD5 ef2f6beced6ed991eb5f4b124485b70c
- SHA1 13ae98461b417e18835295fc68f98db326a5bad0
- SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
- SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
- TLSH T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e05dc726-ce18-403b-9a52-6fbb74f83c59.tmp
- Size 268KB
- SHA256 2f0b10529bf4abc10f14725399594f1afe9f42e6ade19a8a21552c714b4ec65f
- MD5 c20d96fcb3f93c5c5f2f567bba7ccb49
- SHA1 e6db9951d450e41c66bfe7917638ff08bcf1075e
- SHA512 4438a1d855fc28f5d50cd911a7816ae7a3a21f09d2d2c62a476dd6e2ad113740c6ed5ae33ba0880323999678b00f6d25780b4944d61927e4d6cd4b9cab487b70
- SSDEEP 6144:w7VQGSGkEZ2rJDyOqrKjbY+hFD+7t56OD9ZfSApprL:DxxJr9bYyFSXD9ZfS4t
- TLSH T1C64422236D868DB38DFE6245C1FBA705C9B579F789D9694640528F8B624FC4A0333E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\d6cbaaf0-6dd4-42e7-9a7d-f744e24e6315.tmp
- Size 15KB
- SHA256 ff9f863d13955040b3d3606f72ea7fb360bb2521c5c2279f7bdbbc5f4541e126
- MD5 3fd3a64a341ae4d58475483c16a4c19c
- SHA1 ce300d0caf3d8f2b7a3286d5da4c9be70f0618e5
- SHA512 e58dd995bee38417f8c5df8598e3df01843765b4710e1a17cf0a5b67178847da91b4158e2e99ea14b392d233d3861dfbd605bd257c6ce00438408bac55f144fb
- SSDEEP 192:nLcAuo39NYCqZI0rQuELeJPZMQ+H9+TmsxEpZwH+7mhV2WyCFEFMuBc:LPYjbrQLL+RFmsxEpCe7mUMuu
- TLSH T1F7624403B62AF57FC85D473205F681656C7B0171BA5B6E7282F480780EA54A46D2FECF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\NDS_Fling_Script.lua
- Size 148B
- SHA256 d773d4be435c0599e63ede817faa916d5a5f8046ebd6e86a6fb7304678cf741f
- MD5 9a736bd55fe3bc0817ff08b50d201584
- SHA1 1ee4f01951e84e15a51e152cbde7695edcf22030
- SHA512 a15cc4b3085a3b4197be3d6f68b7c4263287e8707050407fb978f4b8da4fead1b3724c7a31e925c96cefb3bf5dd8e30e68f9c810cba6b17635b5c234a767f4e1
- TLSH T1E9C08CDEAC1096AC1A32E8E0516018489E30000D8420C0B6A2A26908C6B27639462224
- MD5 SHA1 SHA512 TLSH