njrat | 67666a85c8c55864c51b7b013c525725905bf2d1d4ef7e5fba21ee40460552d6

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ziohjeio.exe
Size 142KB
Sample261026-xtsx3avy5l
SHA256 67666a85c8c55864c51b7b013c525725905bf2d1d4ef7e5fba21ee40460552d6
MD5 b21b2beee43d3f9248a9f7e96b67a47c
SHA1 deea6b3d0dadc33683a07738a15fce6b31b9e327
SHA512 2e7a76e4b78153be9b8ae31390b594c03b187ca06fab3d10192bc936f746d015549c252e21bbe14ef6d13a23fcd48bda58311039f6f2de941675ebf20d47e66a
SSDEEP 3072:JJQMFbWQbxQoMx+DpD0oy+B3HXcw9GdoH/Tol5z:3FXbYkpAK9NrK
TLSH
T148E36D1BA7A570FAD27BC934C9520905EB327C764BA1AADF035449B61E336D0CE3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

victim defense_evasion discovery execution njrat persistence trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

bore.pub:40498

Mutex

81a67b839f4692420d45ee7f4b24f8af

Attributes

reg_key
81a67b839f4692420d45ee7f4b24f8af
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5060	powershell.exe
7	5060	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5060	powershell.exe
5556	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	5060	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3468	zioheio.exe
1592	zioheio.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_zioheio = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zioheio.exe"	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
7	raw.githubusercontent.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
856	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	zioheio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	zioheio.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zioheio.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zioheio.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2652	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5060	powershell.exe
5060	powershell.exe
4460	chrome.exe
4460	chrome.exe
5556	powershell.exe
5556	powershell.exe
5556	powershell.exe
4460	chrome.exe
4460	chrome.exe
2392	chrome.exe
2392	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeIncreaseQuotaPrivilege	5060	powershell.exe
Token: SeSecurityPrivilege	5060	powershell.exe
Token: SeTakeOwnershipPrivilege	5060	powershell.exe
Token: SeLoadDriverPrivilege	5060	powershell.exe
Token: SeSystemProfilePrivilege	5060	powershell.exe
Token: SeSystemtimePrivilege	5060	powershell.exe
Token: SeProfSingleProcessPrivilege	5060	powershell.exe
Token: SeIncBasePriorityPrivilege	5060	powershell.exe
Token: SeCreatePagefilePrivilege	5060	powershell.exe
Token: SeBackupPrivilege	5060	powershell.exe
Token: SeRestorePrivilege	5060	powershell.exe
Token: SeShutdownPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeSystemEnvironmentPrivilege	5060	powershell.exe
Token: SeRemoteShutdownPrivilege	5060	powershell.exe
Token: SeUndockPrivilege	5060	powershell.exe
Token: SeManageVolumePrivilege	5060	powershell.exe
Token: 33	5060	powershell.exe
Token: 34	5060	powershell.exe
Token: 35	5060	powershell.exe
Token: 36	5060	powershell.exe
Token: SeIncreaseQuotaPrivilege	5060	powershell.exe
Token: SeSecurityPrivilege	5060	powershell.exe
Token: SeTakeOwnershipPrivilege	5060	powershell.exe
Token: SeLoadDriverPrivilege	5060	powershell.exe
Token: SeSystemProfilePrivilege	5060	powershell.exe
Token: SeSystemtimePrivilege	5060	powershell.exe
Token: SeProfSingleProcessPrivilege	5060	powershell.exe
Token: SeIncBasePriorityPrivilege	5060	powershell.exe
Token: SeCreatePagefilePrivilege	5060	powershell.exe
Token: SeBackupPrivilege	5060	powershell.exe
Token: SeRestorePrivilege	5060	powershell.exe
Token: SeShutdownPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeSystemEnvironmentPrivilege	5060	powershell.exe
Token: SeRemoteShutdownPrivilege	5060	powershell.exe
Token: SeUndockPrivilege	5060	powershell.exe
Token: SeManageVolumePrivilege	5060	powershell.exe
Token: 33	5060	powershell.exe
Token: 34	5060	powershell.exe
Token: 35	5060	powershell.exe
Token: 36	5060	powershell.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeDebugPrivilege	5556	powershell.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe
Token: SeShutdownPrivilege	4460	chrome.exe
Token: SeCreatePagefilePrivilege	4460	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2400	4460	chrome.exe	94
PID 5060 wrote to memory of 3468	5060	powershell.exe	95
PID 4460 wrote to memory of 2652	4460	chrome.exe	97
PID 4460 wrote to memory of 4576	4460	chrome.exe	98
PID 4460 wrote to memory of 4576	4460	chrome.exe	98
PID 4460 wrote to memory of 2864	4460	chrome.exe	99
PID 4460 wrote to memory of 2864	4460	chrome.exe	99
PID 4460 wrote to memory of 4864	4460	chrome.exe	101
PID 4460 wrote to memory of 4864	4460	chrome.exe	101
PID 4460 wrote to memory of 4700	4460	chrome.exe	102
PID 4460 wrote to memory of 4700	4460	chrome.exe	102
PID 5060 wrote to memory of 5556	5060	powershell.exe	103
PID 4460 wrote to memory of 6128	4460	chrome.exe	105
PID 4460 wrote to memory of 6128	4460	chrome.exe	105
PID 4460 wrote to memory of 1252	4460	chrome.exe	107
PID 4460 wrote to memory of 1252	4460	chrome.exe	107
PID 4460 wrote to memory of 4932	4460	chrome.exe	108
PID 4460 wrote to memory of 1356	4460	chrome.exe	109
PID 4460 wrote to memory of 1356	4460	chrome.exe	109
PID 4460 wrote to memory of 5848	4460	chrome.exe	110
PID 4460 wrote to memory of 5848	4460	chrome.exe	110
PID 5556 wrote to memory of 856	5556	powershell.exe	112
PID 856 wrote to memory of 1184	856	cmd.exe	113
PID 4460 wrote to memory of 2120	4460	chrome.exe	116
PID 4460 wrote to memory of 4644	4460	chrome.exe	117
PID 4460 wrote to memory of 2120	4460	chrome.exe	116
PID 4460 wrote to memory of 1932	4460	chrome.exe	118
PID 4460 wrote to memory of 4644	4460	chrome.exe	117
PID 4460 wrote to memory of 1932	4460	chrome.exe	118
PID 4460 wrote to memory of 4292	4460	chrome.exe	119
PID 4460 wrote to memory of 4292	4460	chrome.exe	119
PID 4460 wrote to memory of 4112	4460	chrome.exe	120
PID 4460 wrote to memory of 4112	4460	chrome.exe	120
PID 4460 wrote to memory of 4760	4460	chrome.exe	121
PID 4460 wrote to memory of 4728	4460	chrome.exe	122
PID 4460 wrote to memory of 3924	4460	chrome.exe	123
PID 4460 wrote to memory of 4760	4460	chrome.exe	121
PID 4460 wrote to memory of 4728	4460	chrome.exe	122
PID 4460 wrote to memory of 3924	4460	chrome.exe	123
PID 4460 wrote to memory of 1744	4460	chrome.exe	124
PID 4460 wrote to memory of 1744	4460	chrome.exe	124
PID 4460 wrote to memory of 3120	4460	chrome.exe	125
PID 4460 wrote to memory of 5956	4460	chrome.exe	126
PID 4460 wrote to memory of 3120	4460	chrome.exe	125
PID 4460 wrote to memory of 5956	4460	chrome.exe	126
PID 4460 wrote to memory of 920	4460	chrome.exe	128
PID 4460 wrote to memory of 4136	4460	chrome.exe	129
PID 4460 wrote to memory of 1792	4460	chrome.exe	130
PID 4460 wrote to memory of 2392	4460	chrome.exe	131

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1184	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ziohjeio.exe
"C:\Users\Admin\AppData\Local\Temp\ziohjeio.exe"
1⤵
PID:3708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sv.ps1"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\zioheio.exe
  "C:\Users\Admin\AppData\Local\Temp\zioheio.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sv2.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c attrib +h +s C:\Users\Admin\AppData\Local\Temp\zioheio.exe
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Windows\System32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\zioheio.exe
      4⤵
      Views/modifies file attributes
      PID:1184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb278cc728,0x7ffb278cc734,0x7ffb278cc740
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1724,i,17361176031647755712,17690051063420565732,524288 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,11733461604850916968,16267581534831705781,262144 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,12270491976895617488,731181618537285874,524288 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,3815218105184504397,13762741348267535087,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,7198243893559075904,17532781067173248745,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4648,i,5058764807388312098,10338459586489395074,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4852,i,10529234348610573258,18102760948814257967,524288 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,4263458166380115025,534186539728457640,524288 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5504,i,11999494244232823317,6399945320112018099,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5516,i,14522800352087277146,17895023146603225145,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5588,i,6331909853744730664,7390558240823779766,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,132018579546779781,8806287327957954638,524288 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5972,i,5978707442602059051,16305564148927700478,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5796,i,14290315261212571737,1065668271924532477,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6312,i,6988851263672814062,1282496607074717614,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,10935542040563079234,18007327384904093860,524288 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5948,i,11711797346912453379,18375031569387134649,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5836,i,12668100935320983613,5598781443464687117,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4772,i,2884393269340685996,1973131231119511400,524288 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6408,i,17204609216064799513,14028548917128201851,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6420,i,12310363795454173226,14056157013790259856,2097152 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:9
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,15523774340864418652,1031126171274102295,524288 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,17248997181313301794,7116161767952245199,524288 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,4264475271245536154,408479140116311017,524288 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5952,i,5825128346425669729,9879586992896642793,262144 --field-trial-handle=2052,i,1214237761793177799,17156686503615498707,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2296

C:\Users\Admin\AppData\Local\Temp\zioheio.exe
C:\Users\Admin\AppData\Local\Temp\zioheio.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

39cd8c15-9f0a-48cf-b658-79e27edd4b4b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\39cd8c15-9f0a-48cf-b658-79e27edd4b4b.tmp
Size 143KB
SHA256 899469d08b3f30f10ad0cbe963a298ce51c86cb8cf1edc9ffec6fb5f85699ebf
MD5 afb509c41f86bc15be4435ed2ab31f88
SHA1 2cfea9f694ab0f853288850228f95614a7bc468f
SHA512 a1daca39909fb114a8ea85932760d5e6c93f1787790d48e7278612e4618ffe3afd6cf66ac281606d794189ba8ff001ae0d38af1930036873ba1167c26c01ef1e
SSDEEP 3072:7QOCAYshYbSJE3+IDC0zaFQ4+BrZ1tbbBIvb7K3nuWEPt:7DVHhYbFusKYrxbyvK3uWEPt
TLSH
T134E3122972147C77A3E78B15E00B3F4BCE6E86D581C180B093896D9B65AB16F1BF2CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e619ca5-58e6-41d1-b8a3-49c0114980a1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3e619ca5-58e6-41d1-b8a3-49c0114980a1.tmp
Size 4KB
SHA256 f011ac24d322a282357d06545aa38e0c117deeeb19a94f3b591bf28b345f0974
MD5 cb1d098917e8283a4329b6d5c5853543
SHA1 77cbe14d9052d037fceacd26cc576d47c2c6249f
SHA512 a7aecb460f4d73d294c59eea209242e6854abbf4e3159daf62980644e2f9053344bcaffd38fad342a2fa131b36206e08c9298fda91c84dc5882c7c6ec5cfb5ae
SSDEEP 96:mC0d+ePqUvKD1H31Luf6NQi4DpniRDotok5oCDPB6bdGyvC74M/jb2Hv4a:mC0VPHKDFQvSDUDZ5Uwl4M/jb2D
TLSH
T104A10931A86858B759B6D9CAB4413A43CFB4A267E921AF44C9DD4F1C11FB0EC1342623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4aca6438-b3e1-4c7b-93d0-c1cffe7283e4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4aca6438-b3e1-4c7b-93d0-c1cffe7283e4.tmp
Size 144KB
SHA256 004dc0831f657bf153d0f1310ff37c73e5325845952ad112fbdff15d4c67ea08
MD5 651f0aa9b238e29bd7859e0af8d1115c
SHA1 6ed08281654fd56eeca0ec85a6f163045f0500cd
SHA512 88b45d4a1f758666e47752c4b2564bb417a3c4f52ff879b199a53ac08e133fc9dcd7855728a6daddd9ef497ef0647b1320f0c69c3be0d4b488295e7a6f045e8f
SSDEEP 3072:kQkuoAYshYbSJE3+IDC0zaFQ4+BrZ1tbbBIvb7K3nuWEPt:kuTHhYbFusKYrxbyvK3uWEPt
TLSH
T131E301397115BC77A3B68B11E0073F0BCE7EC6D781C4847497886D8A52AB19E5BF2C91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5858b964-d3b5-4cbf-b728-6f7b34a7b22b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5858b964-d3b5-4cbf-b728-6f7b34a7b22b.tmp
Size 13KB
SHA256 90bd97e53cdd96ec1bed6cfe1432e57ec77182e8df19034b3a90fe9b72fcd059
MD5 684fb2462601a1403be48f3380b832e0
SHA1 04151934c2a9cf1f62fe6ccf7ebcca25986bb05a
SHA512 cb7232dd1a539f1fc8e2f130ea6d69939cb095bc4913b64366eddc0d30da5faa4c6b2650c1f8efe7732c42917cdcf01f871181157968da31280b48e7769b6fad
SSDEEP 384:IyjE37KxkXqKf/pUZNCgVLH2HfgslWzXODE7+ErU3aOHGEkw7vQ2xIE:ISE37KxkXqKf/pUZNCgVLH2HfgsYbOQ+
TLSH
T13B520A67684C9A3F0FD8DA8DDC266F4FACF5015672680D2852FB9C1903A57CB124A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92168e7d-3281-49e4-8bc2-f8be14db39eb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\92168e7d-3281-49e4-8bc2-f8be14db39eb.tmp
Size 12KB
SHA256 55e8fc59f128068210e6c0209e2d0436139c018f334aaea1e891217390de2624
MD5 74ee4027a04563e4045f34c070cf2ff8
SHA1 0c0121a2c6beddd847e130a23264b9d8eeb81bfd
SHA512 1efde9102d9af193e9a0b63cbbc82315f2a2f7716f6ae03c2a9a7eed66c655dd6f19390f7ca37c4515fdefad3e93b9d5c2499254f83d1f7b2858ad82c7d25868
SSDEEP 192:MRxIDDbrv7ssPRpzF9KHsb+WNnYP0ffuJ5kw7ZH+VyIsnAUgE:MRxI3bTVXRow80fGJ5b12E
TLSH
T1A442B52DAD18697B9CEBD75EF9227B43E6F5202126911F84E6FC8A3C14E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e9007b8-6cf1-4f97-b4dc-9281dfbcff55.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9e9007b8-6cf1-4f97-b4dc-9281dfbcff55.tmp
Size 11KB
SHA256 881cf74ee49604308a95e53f70d82652fb999a3156198757078c74da5fff009f
MD5 00a79dbfc9c2df3052585648cd17b119
SHA1 933d6894caa03bf43fe6a6b5abd5c3f56b367404
SHA512 44dbc6899809ce82cb218f04f611414b99b76e2b4e7d3b8bdef7daaaa6ccf6222b435ebb0309519ae314bdac7c1a3a10dc7d10356465e48b87ccc268634ba95a
SSDEEP 192:MRxIDDbrv7sAPRp2F9KHsb+WNnYP0fYuJ5kw7Z4+VyIsnAUge:MRxI3bTBXOow80fzJ5by2e
TLSH
T11632A42DAE18697B9CEBD71EFA227743E6F5102126951F84E6FC8A3C14E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cf6c68af-f5bf-42af-babc-82582bc89b75.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cf6c68af-f5bf-42af-babc-82582bc89b75.tmp
Size 2KB
SHA256 865bb9b247b7495c42221414ceed8007c68c6c51c667140cea64c89bbaefdedb
MD5 8d9bd6818d17387c8817db91aedf2bea
SHA1 2d590ab87eacdf5bf197a25d771203d3a82c445d
SHA512 dbc7f1044eb4a305d60b001f06385e2d0952cbd3b0e8dae636477681a79b6cd03d39d48ab11101920b4cea40fe643549a42cd5997e0f726bf0fc375f43154336
TLSH
T166517BB7D3D4867DC41196F49A21AE1FCD7E0A28022C3C6688D8EE4B53F2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 56d46cd67e9422dd735589b78dd0a6004ce75aeb703411a9f4a46db6096812b2
MD5 fdfee94f33b688989f3e06ace2f88ec3
SHA1 276a7d8916eedf312cb8549cc7469c8365911211
SHA512 68d6c7a0f30222cacb1e6845a88cefe5d258613e65e3de44f06f67529c95d1bb9fb84b50507a91a1ab9d38309227baf9165894adda655121c80037cf68338daf
TLSH
T1B3A0026651E41819EE14537070610562B762D918195157435D95C8B4896B1E7951510A
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 501511c6e34ba2f3d62369974f32a4a2a38872b293337e6ca3628dc9eee6f606
MD5 7825bcd8c1e6a890b90897e4b4961543
SHA1 03b14f98845f12f772a78381e84cfb5d73d74e26
SHA512 5972947a0209add820a14756a0a7e49b8a04b4c45c3e5938b836a3b63083023bcfe57b27012c7aefdea43675195159d07ec1b16b0ee17d6d0494690a4edd9fca
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

cf0dfc82-b24d-4ed3-a41b-e56dd0812a3d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cf0dfc82-b24d-4ed3-a41b-e56dd0812a3d.tmp
Size 11KB
SHA256 fd66c71751f800dd1a3ce6e2083081454afeb515eeea041edd930ee3bb7ddfcb
MD5 0012239c61e0175c3c81d78ebe6d09e7
SHA1 d7169eb428375bb494d9a21cb2bfad863f501281
SHA512 cb931ceef131300935bc6ab00ccccc6fb4a1e2cb91cee146d4af46b44a2e878bbc16702a6be08fd279f6c9ebd8eac15cc84dab28637b630ae5e6d178ffa51948
SSDEEP 192:MREIDDbrv7sAPRp2F9KHsb+WNnYP0fYuJ5kw7Z4+VyIsnAUge:MREI3bTBXOow80fzJ5by2e
TLSH
T1FA32A42DAE18697B9CEBD71EFA227743E6F5102126951F84E6FC8A3C14E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef0049f3-ef93-4a7a-b0aa-3e53e3f4ee6a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ef0049f3-ef93-4a7a-b0aa-3e53e3f4ee6a.tmp
Size 143KB
SHA256 df1daf8a9add549a2e6d30ae64031da917b65eb768b34194565142cbbd31c8ad
MD5 b7951bae2a384de5ab6c9937fc9f1c72
SHA1 6ad047496b08d1341733a5259cfc0ab56104f2c8
SHA512 049ee207091b52147e1b9f40850e5c1bc80dbc0f378d2c6287c318cb7d32dba84ccdceef1eac1e00993699a3fec8fc7f5d99eb11eecbe82376f845412e900061
SSDEEP 3072:kQOCAYshYbSJE3+IDC0zaFQ4+BrZ1tbbBIvb7K3nuWEPt:kDVHhYbFusKYrxbyvK3uWEPt
TLSH
T11DE3122972147C77A3E78B11E00B3F4BCE6E86C581C180B093896D9B65AB16F1BF2CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

5334a36c-febc-4134-835a-7941ba1d0332.tmp

Path C:\Users\Admin\AppData\Local\Temp\5334a36c-febc-4134-835a-7941ba1d0332.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4ie5cdws.j4c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ie5cdws.j4c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4460_23435082\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

sv.ps1

Path C:\Users\Admin\AppData\Local\Temp\sv.ps1
Size 2KB
SHA256 6ab51fc4231909d90858a7e15f3ef927a3f2a736a73367201be6ebc3a6df8c9e
MD5 98b7160e078122bf5888c0cc33591265
SHA1 9ad6aace96d1b66c19ed91434af98d512913700e
SHA512 89789fc003c4ae400f0a996d999f64b76880ecb7acd834e0694d1ab29f9e571f6740985bd0728bfd33c24206409e31d5b68c4a8fd5c70bf65d6e5c7500adfc1d
TLSH
T1BD51BC42ABF91040F7FB7B446A7E99200E77BC5A8E35DA0D0195990E0AB2F218C70F73
MD5 SHA1 SHA512 TLSH

Submit Download

sv2.ps1

Path C:\Users\Admin\AppData\Local\Temp\sv2.ps1
Size 408B
SHA256 f0b01a70c844ee3d846a4a4904738ad1e97926e04e7333df558fa0f06d9f9576
MD5 71884bd7267aee8fb4cd2b1ad7044087
SHA1 3a12b73344189e1bc306508682fad38d93cdc11e
SHA512 3232124e4da7d6bf84720226be6be25a7ddfae6087b186477687e157094f371f1244f1a1747eb9356e59a7240ab59bd571386dbed00989078e4a7a0b7990f2b4
TLSH
T16EE08603A6FD5000E5F76A4567FE54710E7A7C155D39CA0D11E68A0C0BF0D124D61F63
MD5 SHA1 SHA512 TLSH

Submit Download

zioheio.exe

Path C:\Users\Admin\AppData\Local\Temp\zioheio.exe
Size 54KB
SHA256 0cf3c767234d5bef5f8589878536135eea0f4d95d8fca92e752cd0bf932e63b0
MD5 f48f3493fb9bce89e703b56052bd606b
SHA1 7bbde46e64f08a9e6aad141d7f13d33e237f7973
SHA512 fc41ceca3af0c29229032f7366356a5076b50e136913fc9a48c5b5587adb152b3419bd60d18f8209ab6b9ade6fe0a1b1fb0aeaa60ce3a36eac37bb37a6fdb3d3
SSDEEP 1536:DDAA8DnYNe0J5T6DewsNMDiXExI3pmYmu:T8DnZux6DewsNMDiXExI3pm
TLSH
T1C0431744BFEA4A01E2BD8F7469F555150A34AA23F522EB1F8CD268DB17327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3468-44-0x0000000000D20000-0x0000000000D30000-memory.dmp

Download

memory/3468-45-0x0000000074962000-0x0000000074964000-memory.dmp

Download

memory/3468-445-0x0000000000D20000-0x0000000000D30000-memory.dmp

Download

memory/5060-27-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-26-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-32-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-31-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-30-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-29-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-2-0x00007FFB3235F000-0x00007FFB32360000-memory.dmp

Download

memory/5060-28-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-57-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-33-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-25-0x000001D628DC0000-0x000001D628DCA000-memory.dmp

Download

memory/5060-24-0x000001D628D00000-0x000001D628DB2000-memory.dmp

Download

memory/5060-23-0x000001D628CE0000-0x000001D628CFE000-memory.dmp

Download

memory/5060-16-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-14-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-13-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-12-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-11-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-8-0x00007FFB321D0000-0x00007FFB32B74000-memory.dmp

Download

memory/5060-9-0x000001D628A40000-0x000001D628A62000-memory.dmp

Download