hxxps://prodkeys[.]io/switch-firmware-download/

Analysis

user interaction
yes
max time kernel
67s
max time network
100s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/10/2026, 17:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://prodkeys.io/switch-firmware-download/
Sample261017-wbn1qaxtcs

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3512	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3353145205-3618084634-580274525-1000\{C6FE7B18-FEAE-4E82-9ED6-D859166C5945}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe
Token: SeShutdownPrivilege	4848	chrome.exe
Token: SeCreatePagefilePrivilege	4848	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe
4848	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4836	4848	chrome.exe	83
PID 4848 wrote to memory of 1208	4848	chrome.exe	84
PID 4848 wrote to memory of 1208	4848	chrome.exe	84
PID 4848 wrote to memory of 3512	4848	chrome.exe	85
PID 4848 wrote to memory of 1340	4848	chrome.exe	86
PID 4848 wrote to memory of 1340	4848	chrome.exe	86
PID 4848 wrote to memory of 5808	4848	chrome.exe	88
PID 4848 wrote to memory of 5808	4848	chrome.exe	88
PID 4848 wrote to memory of 3140	4848	chrome.exe	89
PID 4848 wrote to memory of 3140	4848	chrome.exe	89
PID 4848 wrote to memory of 3120	4848	chrome.exe	90
PID 4848 wrote to memory of 3120	4848	chrome.exe	90
PID 4848 wrote to memory of 6116	4848	chrome.exe	91
PID 4848 wrote to memory of 6116	4848	chrome.exe	91
PID 4848 wrote to memory of 5320	4848	chrome.exe	94
PID 4848 wrote to memory of 4024	4848	chrome.exe	95
PID 4848 wrote to memory of 5320	4848	chrome.exe	94
PID 4848 wrote to memory of 236	4848	chrome.exe	98
PID 4848 wrote to memory of 4624	4848	chrome.exe	101
PID 4848 wrote to memory of 4624	4848	chrome.exe	101
PID 4848 wrote to memory of 5752	4848	chrome.exe	102
PID 4848 wrote to memory of 5752	4848	chrome.exe	102
PID 4848 wrote to memory of 4576	4848	chrome.exe	105
PID 4848 wrote to memory of 4576	4848	chrome.exe	105
PID 4848 wrote to memory of 4300	4848	chrome.exe	107
PID 4848 wrote to memory of 4308	4848	chrome.exe	108
PID 4848 wrote to memory of 1924	4848	chrome.exe	109
PID 4848 wrote to memory of 5444	4848	chrome.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://prodkeys.io/switch-firmware-download/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff945b0c728,0x7ff945b0c734,0x7ff945b0c740
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,8558171544106268812,15489119295681846906,262144 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,12238042875782565474,10682870633993410683,524288 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1608 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,7952560267352143185,923206852446876207,524288 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2056 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,1098229867978494448,2302744172865403583,2097152 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,14632741926439696168,11718576407568198939,2097152 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4136,i,5308406053102557066,2316290607577318739,2097152 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5220,i,11676446449152849337,4908430467917788742,2097152 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,7216979364578488707,9952219806360899848,524288 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,3641409139832246134,5222205266548267467,524288 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,8295088198345650066,17268997773555549490,524288 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6160,i,16634699331545243489,2993508332453395358,2097152 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6412,i,17556457140937526537,3064482995091359281,2097152 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6296,i,7123733458700621774,5537508796080981972,2097152 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,12116950300641463981,10034482731675914941,524288 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1740,i,17079722354338695073,15854267390058518962,524288 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,2809398088346214788,17796558614253578331,524288 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,6181487905220000083,15403034687598796580,524288 --field-trial-handle=1940,i,4290988473543177257,16507103161164325297,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:5444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2a91e82d-433a-45c7-a0f2-095974e52466.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2a91e82d-433a-45c7-a0f2-095974e52466.tmp
Size 132KB
SHA256 15c173f78149d179133a6a69474d5895fa5d584120acc569717449c5fb1afeb6
MD5 349f3de695735d1c11a8e36fa7cce4a7
SHA1 a354548abd08ad38ed8faf8a85f9298deb2a3c67
SHA512 1c479adad0996b7bd0a6fe92d8200419d9120e719acd4c048be2b66d34233e4ab4a774ecf72b22a005a166088dc6f816b8fab50314256046117c1c17ce6490f0
SSDEEP 3072:eIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz5:ePtbmf1K49XLWbEPi4NTKlLz5
TLSH
T1C0D302213D05BCB4A9EEDB61A1901A16DAB8C94F953D3FE65CDE3F4806A36D9C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b582d49-1019-497d-83ab-432a34fea50f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6b582d49-1019-497d-83ab-432a34fea50f.tmp
Size 132KB
SHA256 fc48bbce5e1872a5b73ff6c08ebec7f96877f6e0ec7b14772f6ea442b490854d
MD5 1cc4b3a39ca5416e666951e5e8b00738
SHA1 9c4f35cc8f62f8dd12c6694c2cf365330160bfa2
SHA512 78bf38fe1b9b50d79b29c3b7eb44f0a11a8e156064e14995fdc79170e02e97e46336ea0aa9362d6274fd08f27bc35bc8b596a9e04e558daa99de439002a1c499
SSDEEP 3072:pIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz5:VPtbmf1K49XLWbEPi4NTKlLz5
TLSH
T1E1D302213D05BCB4A9DEDB61A1501A16DAB8C94F953D3FE65CDE3F4806A36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b7059e6-1c9b-4536-a17b-a3576841b85c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0b7059e6-1c9b-4536-a17b-a3576841b85c.tmp
Size 17KB
SHA256 97bc66b4f155b0c7d1c1155ae8d3954a623213984f10f23f42e9e1fb19904a17
MD5 2be92c7643ba48fb4aa831b67bdf1af3
SHA1 79be648a0d33bdda874579b35bc4130d1a99c838
SHA512 807a577b54aae138829b44e4a6f8d45c0e84793dd9d5979325f6c50c10138ab57dbf6926083a46c29ed6ca492c7a21eb9c9bcc6ee1ce6172001f1ab91694f4d2
SSDEEP 384:KkjuF7KxkXqKf/pUZNCgVLH2HfgslxH7pLuLceSsNXODuF+ErU38jHGPQB7IYjL:KouF7KxkXqKf/pUZNCgVLH2HfgszH7p6
TLSH
T109721A67BC4C9E7B0F94C68CC8177E4FACB5025B65E9886482FA982603D5BCF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2eb504b7-99c8-4722-b142-c5075dc98b62.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2eb504b7-99c8-4722-b142-c5075dc98b62.tmp
Size 12KB
SHA256 2125550e2d9bf69011625e76007d088eea9ae65830eb6c547a9d33fac40b9be0
MD5 9871e72c46bfce79b6adec83bd88be33
SHA1 50f6e170fccefbae5198869ef18c8973c873f767
SHA512 612c7d6b176d4987b852d9ddb537c4cacac529b78fd88d1e1075924fd2b0fc78fb384ae35aa163d95247fb6462679b8212904d867a52b28a1db1a9f4c7fd15f1
SSDEEP 192:ARddZrSLjV1av7QpAPRp2rlR9DHsb+WNnSZf1W2Bw2RHj3aIT2VyIsnAUge:ARddNS/28UXgdw602G2RHDate
TLSH
T1FE42A62DED10797B5CD6C22AFA657793D7FA102135D42E84E6FC892C25E7ACC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78871643-2fab-4806-a51b-0f54f536cb0d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\78871643-2fab-4806-a51b-0f54f536cb0d.tmp
Size 414B
SHA256 07caa6762cfffcd636ad0e68de3100d0bee0d06e3d4caa5512552bee090368cc
MD5 dab458d0dede78974a8d88404502bc9f
SHA1 c09b78e0c1cb8da5675f538689231c57b4668712
SHA512 e28b4f62d6d95a1f2e0846a06e6a314be0d39550055a2f92ef241556183e77d984dc1abc52bf2e304694f4a53a922e30c25cd62916ee46c4e447ce4d082eae8a
TLSH
T1DBE02B9AC831EC2714FD071860D28B4AE60113272AC1994F7B3CC11C8FF16770196D5C
MD5 SHA1 SHA512 TLSH

Submit Download

9e10f9d2-b02d-4307-bc6b-46f1b5045459.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9e10f9d2-b02d-4307-bc6b-46f1b5045459.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 346KB
SHA256 12d9d79dfebc7af3bc8f51865b297aae3799b2fa2ce9d188b5741e85350062ff
MD5 a34ac27ab2e9ba9da6a4d1430444fe6b
SHA1 358cb9f7f84a731f77a3f1dd0e4057659a29a224
SHA512 1a2185d4ff72d4d8a759938f1a042d6dac394e83c405382b596e7df04822d6698568be11f51d7b6e26a7bdf4bbde0775ce72f379d28dd66d908a00205d88b264
SSDEEP 6144:5JterkJiB53lK9lud6XRJs4GqwCXjiKjvZbJ7qVZQf/C2v4gOcpv6kWWNbe:5ebsk6zGqVZt70Qy2v4gth6F
TLSH
T19E7423452F6F760DA5489B60BDDA36A24C665B7C460178FC9213C6BE8609FF9D2CE0CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 5175f32165f0010a073eb340776591483f3f181dbfc7f98654052db376897f79
MD5 0b3010581c43439bd70faffdcfdabf3d
SHA1 48a7160e4321d0f1c25cb7746ab754ec62fcbdf0
SHA512 a789514976e9727fbc37af906a41ff4df794279ba4f5a8f0cd1c312939f9e153f9cf7e46d6992894d0d64d5b73718d18cbe93e6b3a27a05f3c063f8571e06b22
TLSH
T122119C50E2E10289CFF4E93FFF714D16A7E14929B55A0B9B4253FCE4E1976E0A066280
MD5 SHA1 SHA512 TLSH

Submit Download

13e233d4-3de6-46e5-86f3-0e51802dfd0a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\13e233d4-3de6-46e5-86f3-0e51802dfd0a.tmp
Size 9KB
SHA256 5f6dad5951b4a8c4e61aec20a9438137eb183f2da9b5eb55afec2a0da5a725f7
MD5 9129dc1351121c659b723d756ea0ef46
SHA1 be1d920c916c84cdb9deee8dbb70cdadf4938465
SHA512 77e0ae7375286c58161cd38445b4ce798eb1e34120712f2602f88884dec51df1a8fb78ad60f8bf3a1e599374bcb57ede2a6612d9f41324ad9f8232b9e441e476
SSDEEP 192:DPybJ4P/FsJtJuJ72laaEdIf4NQaAbGM0QsEVshO76ZX3XIHPnGMMPZwP8pFmt/g:DPyN4P/FItJuJ72laaEdIf4NQaAbGM05
TLSH
T11A2270FBC3E8862D881155F8A6146D2BCD6D2A18433C3C6688E6BE1B73F1971E24574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d65ce02d-31f9-4928-bb5c-a2419d6c4439.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d65ce02d-31f9-4928-bb5c-a2419d6c4439.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 7d7f607bc0039cae0b25f5b46cb72a9877be0776bfddb41fed94e262735ad99d
MD5 63d835bb4372d40e8b3a64c6ae21ccb7
SHA1 edd7bfb8c235964a8380b3e1b77dd46966c47a77
SHA512 8c4e1ab954bcc1e56d83ae2929fd519534322fa89ced6d5577e283ac796c3aeaa375eef4452fc0acacc9dce14023e4436da9d05a9b82d9a21cb726b8a4f3dd7b
TLSH
T168B0120584819702C08202B41271248832F49F11E605170181F42D11C836561911B06A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 ff891fe6d36f82082e667f6775b9e3ee7d32fc644633f656e94b45cd4d2ef12d
MD5 a6233a387a178ec1b7004b043416fa64
SHA1 5565cfadbb2f38c1ddadd1e1df7e34f15c0fdd5e
SHA512 9e16daf319b6730e89b4676f3e8f0bd6f2a6d3f910126cd35dfa284dffca5d328c15167e12fa6695a0e91406193d766713ce0ca9219a34f350ae2501956ad3b5
TLSH
T166B00255D1026213C0C267B065A5A5D87362DF25DB435212A2E01B7AED396B145251B0
MD5 SHA1 SHA512 TLSH

Submit Download

dacfb961-e80e-4ec1-b6fe-7632c9d2e903.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\dacfb961-e80e-4ec1-b6fe-7632c9d2e903.tmp
Size 172KB
SHA256 fb9723b1112a85000a1d8019729c05dacb5c601a9aa5abd76017f9d05e79b661
MD5 afc2539d655304654a547b1f8e22533f
SHA1 8b438c52404748e64b762e589aa3b7d4b8eea508
SHA512 82973ce8e0d889514a80a96c3cae8aa8fed2e49d14aa391c4739b875b4b4ff331ed1e50b4e78ad01ff0ae92abca5955a9ea0450a70baedc4bbb22c69e0da857e
SSDEEP 3072:NZ48ZJBT0LKfR3fjIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZL1:M8ZJHfRPLPtbmf1K49XLWbEPi4NTKlL1
TLSH
T17C0412307D15B87895EDE722E1611A2599F5C80F9A3A3EFA58ED3E9C05E39D9C308C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff253562-34e9-4d20-a620-9b2ab3dc9109.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ff253562-34e9-4d20-a620-9b2ab3dc9109.tmp
Size 131KB
SHA256 7ff45c827dcb10dc0486094b00549e1f5cd97661b13b8b3c8518f168b9ca0145
MD5 fe33ae8ce0e4c882bbb3f50efd893b17
SHA1 71dc69b482d153a33fe0f3340cff722f0bf62d6d
SHA512 e0543b0c5f27267c76e8e531ca3d9b0d257136a8f39892d545cf7d16c85e7f5ed5eb4cddc82cb3cce683b753df2634c85a457e26826778c8e0e495b201c21ec9
SSDEEP 3072:AIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz5:cPtbmf1K49XLWbEPi4NTKlLz5
TLSH
T1FED312217D01BCB8A9AEDB21A1901A15EAB8D94F953D3FE61CDE3F8C05A36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9487b79-9658-44ac-b057-6111ee8ce1bf.tmp

Path C:\Users\Admin\Downloads\e9487b79-9658-44ac-b057-6111ee8ce1bf.tmp
Size 4KB
SHA256 9bcfae2faffcb0280e6672e9786e79736f02f9e05327cba0aa6ad5ee42dd242e
MD5 b55796b8cf9af71dc6241a2d613fd573
SHA1 d6efe3372c67fb668b7cc83cd3ac864428d5c4a4
SHA512 ec7f00e084520658a4e6ad84213604664c77de444aadc80fd331cbcf15a2df57e48c9d9600d1396c15fa4558926dc351a04dc8f3ddfc041fa5c586b768dd286a
SSDEEP 96:mvY3Qvt2jFFIFPNVHvAejyFmeCSDrBS3RlmBFpUgj2ONIFJ:mvYNXIFPbA3FmeTDrBSBlm2gC0IFJ
TLSH
T1F8A17D2563EB5C104369AD03F72BACCBC03C7B57468D61DA7DB4EAD614499371C61382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download