1f1f51761059618f72c4ad782cc8350576852d166c50cafe4a60c69e7188f44f

Analysis

max time kernel
228s
max time network
221s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250619-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250619-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
15/07/2025, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
907cff1b76b2e2e44fa6bb41e6b0502733592fee7c18bb9873b9ae2b88bf941c.msi
Size 1.5MB
Sample250715-2twfeazzcx
SHA256 907cff1b76b2e2e44fa6bb41e6b0502733592fee7c18bb9873b9ae2b88bf941c
MD5 4ad791d3aef14562e74d7e756fccd828
SHA1 39a006a7c7cb7be765ef6a508d28e1f244707f12
SHA512 b5f59797e5d21007df17d987200a38ef917250af5cc0be880ac2fcb41911a743d60b2973c200c9252bb23a60e78f14beaf55f68205845a1db63a8a64f2360f08
SSDEEP 49152:YKotURB9xb0mexyBer3rU/eOhPD2ZaWoVYQ:YrURtBWL4/eOsZaWoVP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4428	powershell.exe
872	powershell.exe
4508	powershell.exe
1520	powershell.exe
3812	powershell.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	1832	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e578954.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CBE3BB92-1E80-46F5-BBE7-E41F2C8F209F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8ABB.tmp	msiexec.exe
File created	C:\Windows\Installer\e578956.msi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\e578954.msi	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
4688	LPrKz6y2fG.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1832	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000bc68993246af50fd0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801bc6899320000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050e1000000ffffffff000000000700010000e84101bc689932000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71bc68993200000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000bc68993200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4236	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133970936739530221"	chrome.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5552	reg.exe
3160	reg.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2524	msiexec.exe
2524	msiexec.exe
4428	powershell.exe
4428	powershell.exe
4428	powershell.exe
872	powershell.exe
872	powershell.exe
872	powershell.exe
4508	powershell.exe
4508	powershell.exe
4508	powershell.exe
3812	powershell.exe
3812	powershell.exe
3812	powershell.exe
1520	powershell.exe
1520	powershell.exe
1520	powershell.exe
4508	powershell.exe
4508	powershell.exe
4508	powershell.exe
4508	powershell.exe
4508	powershell.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
4508	powershell.exe
4828	chrome.exe
4828	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1832	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1832	msiexec.exe
Token: SeSecurityPrivilege	2524	msiexec.exe
Token: SeCreateTokenPrivilege	1832	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1832	msiexec.exe
Token: SeLockMemoryPrivilege	1832	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1832	msiexec.exe
Token: SeMachineAccountPrivilege	1832	msiexec.exe
Token: SeTcbPrivilege	1832	msiexec.exe
Token: SeSecurityPrivilege	1832	msiexec.exe
Token: SeTakeOwnershipPrivilege	1832	msiexec.exe
Token: SeLoadDriverPrivilege	1832	msiexec.exe
Token: SeSystemProfilePrivilege	1832	msiexec.exe
Token: SeSystemtimePrivilege	1832	msiexec.exe
Token: SeProfSingleProcessPrivilege	1832	msiexec.exe
Token: SeIncBasePriorityPrivilege	1832	msiexec.exe
Token: SeCreatePagefilePrivilege	1832	msiexec.exe
Token: SeCreatePermanentPrivilege	1832	msiexec.exe
Token: SeBackupPrivilege	1832	msiexec.exe
Token: SeRestorePrivilege	1832	msiexec.exe
Token: SeShutdownPrivilege	1832	msiexec.exe
Token: SeDebugPrivilege	1832	msiexec.exe
Token: SeAuditPrivilege	1832	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1832	msiexec.exe
Token: SeChangeNotifyPrivilege	1832	msiexec.exe
Token: SeRemoteShutdownPrivilege	1832	msiexec.exe
Token: SeUndockPrivilege	1832	msiexec.exe
Token: SeSyncAgentPrivilege	1832	msiexec.exe
Token: SeEnableDelegationPrivilege	1832	msiexec.exe
Token: SeManageVolumePrivilege	1832	msiexec.exe
Token: SeImpersonatePrivilege	1832	msiexec.exe
Token: SeCreateGlobalPrivilege	1832	msiexec.exe
Token: SeBackupPrivilege	2340	vssvc.exe
Token: SeRestorePrivilege	2340	vssvc.exe
Token: SeAuditPrivilege	2340	vssvc.exe
Token: SeBackupPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe
Token: SeTakeOwnershipPrivilege	2524	msiexec.exe
Token: SeRestorePrivilege	2524	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1832	msiexec.exe
1832	msiexec.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe
5376	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 5008	2524	msiexec.exe	94
PID 2524 wrote to memory of 5008	2524	msiexec.exe	94
PID 2524 wrote to memory of 4428	2524	msiexec.exe	96
PID 2524 wrote to memory of 4428	2524	msiexec.exe	96
PID 4428 wrote to memory of 3864	4428	powershell.exe	98
PID 4428 wrote to memory of 3864	4428	powershell.exe	98
PID 2524 wrote to memory of 872	2524	msiexec.exe	100
PID 2524 wrote to memory of 872	2524	msiexec.exe	100
PID 3864 wrote to memory of 4236	3864	cmd.exe	102
PID 3864 wrote to memory of 4236	3864	cmd.exe	102
PID 872 wrote to memory of 3796	872	powershell.exe	103
PID 872 wrote to memory of 3796	872	powershell.exe	103
PID 3796 wrote to memory of 4508	3796	cmd.exe	105
PID 3796 wrote to memory of 4508	3796	cmd.exe	105
PID 3864 wrote to memory of 3812	3864	cmd.exe	106
PID 3864 wrote to memory of 3812	3864	cmd.exe	106
PID 3864 wrote to memory of 1520	3864	cmd.exe	107
PID 3864 wrote to memory of 1520	3864	cmd.exe	107
PID 3864 wrote to memory of 4688	3864	cmd.exe	109
PID 3864 wrote to memory of 4688	3864	cmd.exe	109
PID 4508 wrote to memory of 5552	4508	powershell.exe	112
PID 4508 wrote to memory of 5552	4508	powershell.exe	112
PID 4508 wrote to memory of 3160	4508	powershell.exe	113
PID 4508 wrote to memory of 3160	4508	powershell.exe	113
PID 4508 wrote to memory of 2388	4508	powershell.exe	114
PID 4508 wrote to memory of 2388	4508	powershell.exe	114
PID 4508 wrote to memory of 1584	4508	powershell.exe	116
PID 4508 wrote to memory of 1584	4508	powershell.exe	116
PID 4508 wrote to memory of 4392	4508	powershell.exe	118
PID 4508 wrote to memory of 4392	4508	powershell.exe	118
PID 4508 wrote to memory of 5376	4508	powershell.exe	120
PID 4508 wrote to memory of 5376	4508	powershell.exe	120
PID 5376 wrote to memory of 3740	5376	chrome.exe	121
PID 5376 wrote to memory of 3740	5376	chrome.exe	121
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123
PID 5376 wrote to memory of 868	5376	chrome.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\907cff1b76b2e2e44fa6bb41e6b0502733592fee7c18bb9873b9ae2b88bf941c.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1832

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath "C:\Users\Admin\AppData\Local\._50068de2f1f9\\setup.cmd" -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\._50068de2f1f9\setup.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\system32\timeout.exe
      timeout /t 10 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\._50068de2f1f9\kmkuQJXow2F6RJy.zip' -DestinationPath 'C:\\Users\\Public\\Documents/Zc7jKCHpaL' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& 'C:\Users\Admin\AppData\Local\Temp\start_process.ps1'; Remove-Item 'C:\Users\Admin\AppData\Local\Temp\start_process.ps1'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1520
  - - C:\Users\Public\Documents\Zc7jKCHpaL\LPrKz6y2fG.exe
      "LPrKz6y2fG.exe"
      4⤵
      Executes dropped EXE
      PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "Start-Process -FilePath "C:\Users\Admin\AppData\Local\._50068de2f1f9\\register.cmd" -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\._50068de2f1f9\register.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\._50068de2f1f9\atalhos.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4508
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add HKCU\Software\Google\Chrome\NativeMessagingHosts\com.yourcompany.monitoringapp /ve /d C:\\Users\\Public\\Documents\Zc7jKCHpaL\com.yourcompany.monitoringapp.json /f
        5⤵
        Modifies registry key
        
        PID:5552
    - - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add HKCU\Software\Microsoft\Edge\NativeMessagingHosts\com.yourcompany.monitoringapp /ve /d C:\\Users\\Public\\Documents\Zc7jKCHpaL\com.yourcompany.monitoringapp.json /f
        5⤵
        Modifies registry key
        
        PID:3160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:2388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:1584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:4392
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6" --disable-extensions-except="C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6" -no-first-run
        5⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5376
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff9ca71dcf8,0x7ff9ca71dd04,0x7ff9ca71dd10
        6⤵
        
        PID:3740
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2008,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1988 /prefetch:2
        6⤵
        
        PID:868
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1592,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2248 /prefetch:3
        6⤵
        
        PID:4856
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2368,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2536 /prefetch:8
        6⤵
        
        PID:1412
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3228 /prefetch:1
        6⤵
        
        PID:6104
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3248,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3268 /prefetch:1
        6⤵
        
        PID:1904
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4516,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4556 /prefetch:2
        6⤵
        
        PID:2808
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4740,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4692 /prefetch:1
        6⤵
        
        PID:2924
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5396,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5236 /prefetch:8
        6⤵
        
        PID:2428
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5428,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5680 /prefetch:1
        6⤵
        
        PID:5524
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3316,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3276 /prefetch:8
        6⤵
        
        PID:640
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3232,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3480 /prefetch:8
        6⤵
        
        PID:3628
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3396,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3404 /prefetch:8
        6⤵
        
        PID:2012
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3336,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4556 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4828
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4508,i,13704693382432089966,13614598013393702053,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5584 /prefetch:2
        6⤵
        
        PID:4916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:3876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:1896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd" "
        5⤵
        
        PID:3960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e578955.rbs

Path C:\Config.Msi\e578955.rbs
Size 8KB
SHA256 b5cab495e00cd23d7a04543b92d9b8874db16fb6b60fc004f54e078a36025c80
MD5 15c9f745cd78ae50a8f2637e3e29f65c
SHA1 34eabc14ca15eb6dc3a15790727c1b4cd1501545
SHA512 247c98e2ede36617c6dcecd3cbf87181ff1b86219ae331d88f6ddce5d31cb1a6d0dda1ed329a8b44bbf084f79be420660a0d1250754da435c33f51d6853bc2c0
SSDEEP 96:om03JbzkC9k72J+2SDrB2sjAewVE1qUhfmSNCsTl+LqUhfmSNC6jxzX3oTl+Ne/W:9OJbQMM8e519LQIm9LQC4HAo35pEhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Google Chrome.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
Size 2KB
SHA256 4f833b7ee72aa3b70b7d30054def9d284df024554e2c343dcfd52292a99e18eb
MD5 5043d1e93db093272bfb9c8aaed69a88
SHA1 f5ebc46634c160af3f4a08ef1c5c744720bd6140
SHA512 af0513e530cbb7562a7ba20a289793f186b55bb940fe7128cacb5c37f73da99a09197109e9396bd1a119741cc18f2a00d1f5c7b523abe88933746637a24c8d96
MD5 SHA1 SHA512

Submit Download

atalhos.ps1

Path C:\Users\Admin\AppData\Local\._50068de2f1f9\atalhos.ps1
Size 8KB
SHA256 9c5a145aba635371ca2db2c092e3a267290dbf5a476550dc30bbea9f6c4ad775
MD5 6241261f15d386c8695a99b835c81cdc
SHA1 872fd4f91ac000805766023e7d08e56f42d9fb1a
SHA512 aebd575e09bdd39f4c4afc6d36ba052e450e0477c8626462c61a5379b8f0a0fc54b9027d92a9f51a1810f43ff3286ec5a82e8e1cf388367f87c3caa16a24389c
SSDEEP 192:Sqb7HOVcxA1bHKm8ZDJ02SynvwaXs+EihjQhr3Qhah2:114PrkO2
MD5 SHA1 SHA512 SSDEEP

Submit Download

kmkuQJXow2F6RJy.zip

Path C:\Users\Admin\AppData\Local\._50068de2f1f9\kmkuQJXow2F6RJy.zip
Size 1.5MB
SHA256 d77a9fc826b75f32f2dcf853fb2657273de45f967eac55ce3897237e643fba04
MD5 dea7d9eaf316d89428b68bafebfd4265
SHA1 8af9bed3b8db74af06d7cb6e41ec1b9b03bd40a2
SHA512 6af5f91d60037930fc273e00207094d62ffa72f98f6c8ba76e2414fbfb9e323c260f567ab0762299d0d6573195b164514c9fed98eb4ecb913b1c769f18dd3c25
SSDEEP 49152:/j1o6L5Y+LW3ueyyXrarCuCmwn/v0Z3ULe7dq:hTL5YV3D2euCmw0Z3Uuq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\._50068de2f1f9\register.cmd
Size 109B
SHA256 376d912bc209b2d13acd8ba1b2b37fa7854154577bdeb52c5bbd2c7373654268
MD5 9988e4e4cf65c6656926b9b9f67bc0cc
SHA1 9bd11533b8edb5b103cca15516c6e35d6addf94b
SHA512 b3cdd83f5e6fcae3f4d315b1856beae28c595b8b002d29409d9d47aa779c43fec2f5463e607908d0e2e81c976211ef56ff4348cc4caf1bd1d0ce25d910f01f33
MD5 SHA1 SHA512

Submit Download

setup.cmd

Path C:\Users\Admin\AppData\Local\._50068de2f1f9\setup.cmd
Size 715B
SHA256 a9c2782d8985cdece2f634a620da5c2fdf92ddfa20bb4fb83ea1d44c6cc80d4a
MD5 782dc9850a305d99babb1a248c61fb79
SHA1 75c23ff5cae9a12f6d2bf4a5a4fd486619115e53
SHA512 0fe878724cbdffe5310909e391ca42d87adadf624805c4ca562e2d580a48e05c09a51b6ca7ae8c724eab115e71564269fb0f2349ea95190cbbdb8068fbceab35
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 072354a79029c00aacd0c1b12b36ec5d8f2c8665f8abfa33284c0df0e70c1deb
MD5 d8ad5d7bff59bf66f865025187d324f0
SHA1 eb9c431be9e97056966ef9ffb325e05b631fb30f
SHA512 8b01dc1e6ff4c34e8a431d9999d91a630f286074b5847ddce39a2777dea46bb1336a586e804edb85dbf1b187501842a9e339732b92962be06dbd088f229b99c4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 68afbd6e715980171fcff23d667ade1994b82de26b9a7da196349f3cb69a2e69
MD5 e89ea28ddadfe18e5e5b076e42543ce3
SHA1 eafe01f6d6b3be55471766f4af2517e39b83f0b1
SHA512 1f772a8e2b828c2576de2cd024bcbbb7e80d65cd780e0c025c7873c448aa436ea7d8098fb2faf8676629089d03f708432cbc3e21b5b96db67c4f164755fbf55d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 cf1c808c537def2150574b199702c07800c81d90aeaf2d4fb77d719f6ffd5ccd
MD5 4e883be49d96d17662e1953ae8f6f14a
SHA1 c67561dd6cf0105549caab27015362d18d19b016
SHA512 5ed8ada961404b4c97b8e403f11e021b57ddeff19a098a7fba5c29d0f23a70694c0e08506f5eb8b114f80052ab5185ecde068d7944cdcc46994bfd258bb7550e
SSDEEP 192:naYlKz6sHMAt9eYZ8PRp0R7HS+WNS67yT72oAVS9OtVODOakwYOEOMOBjQpQyIsA:naYlKz6sHD9e5XWTcS6+TSoAVz6SaDnT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 154283ce101f22b0b3259e52ab352047d1b41521902c33df6cc5d94113fe982a
MD5 d2e766afcd6547bc3b5d3b6ff2712ed8
SHA1 a89680a57bff8dc6d240a0bd7d8f6a78ef5b67cc
SHA512 f77f0b39f880cae436dad070bb80dbe9aadea103b58b8df43c59f6fa3cba454907b9b2b9445247b7b3a600e3923f8561c9062bb48995277b858dc4d29f94f311
SSDEEP 192:naYlKz6sHMAt9DYZ8PRpW7HS+WNK72oA+S9OtVODOakwYOEOMOkjQpQyIsnA/g4:naYlKz6sHD9D5XWTcKSoA+z6SaDnPkj7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 954284ec33eed4a5422024fe48062bd36dc106db46c9fe8106f61319c551cea1
MD5 d08b9eb598f9cc8c296d69115317b5b0
SHA1 4a413b652eb45c362aff27828fc750a4b37b1225
SHA512 7976dde0a4489772ccb51c7757f4810c54dcbad90784613928deb2839ad556f853356155fd8f0ac04e0f3d0dbc7d3e7fd6843d37713fe6fbdcb7d41e9830dce5
SSDEEP 192:naYlKz6sHMAt9YYZ8PRp0R7HS+WNS67yT72oA+S9OtVODOakwYOEOMOjjQpQyIsA:naYlKz6sHD9Y5XWTcS6+TSoA+z6SaDnZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 60285eb5b871b18a524b9aa798318a29fa14ac50d9616b65ac71633ba4ce7711
MD5 58c8f03431a5c2460c989dc5c2d45e5c
SHA1 b9b1dd99ff9e9bbec97ba472fd3a509662436371
SHA512 d2db80fb02e60b4bae0679eb7af4dbdd72977d2e6a0625799139a3a663a8cf83df8d403adc8b629b12aa15bba601e9b7e9acdd103fc9e94d10d7a561af785743
SSDEEP 384:Lj2J6XljQ7pLuLceiTCXxePkXqKf/pUZNCgVLH2Hf13irUmCa:LOs9Q7pLuL72QxePkXqKf/pUZNCgVLHN
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 0212661f9ddf946fe722ab82f552f45852dcfaf0a69afbf635e8603e711a9397
MD5 dbf6ab164336b6cd0f46d7fe054c6c40
SHA1 938fac1b9c6d9968d0fdc192ff3cf7edaf42a406
SHA512 2876f4da23c4f70448edb9ed0ce5720359cb6e54f5346bdd9879d349f222152279021cb61a6c0b954002778509b0ad5c32a02d2825937485463ef12713abf64b
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe587114.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587114.TMP
Size 72B
SHA256 fe1a4c6b21a4cb7bcc7be15c48c9c0332ba26e53ea1fe880b5b3a010a40f0bb9
MD5 622e185aabdee6570c33229d79602003
SHA1 e711b3ad0a43bba505ca873e6dfe22d8219127f2
SHA512 00ffcf5518954bba98665e2d260c9d9ef1a4323d0914066b56ff412b00ae4e4f934d57e42aba87d2126b023d4b85bc927a40bc72572963aa1585eda746355792
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 170KB
SHA256 a0c375db453069e23ee95dee1c80a632863e6990f6288a54b358433e3df0db9a
MD5 a2fd2cfabf884d1a7c35c11ad271776e
SHA1 1c19bc8f48cfb5856daa60a247835cb44f8faad7
SHA512 8ea25be8a91630dd00fbdb841c0b232dfbaf4d8590dfbcd75599bd083a9a6caa0ee766dfd0a68645d3a594638f4deecd3659d38b06e7c8f1f9c93b412de2892e
SSDEEP 3072:QGXl8ZYIlUFLWZkJ30Mpb6o6EkSSDHKB/GXjM4rTmN5eWvStRNoV8cWK7XF+TwMM:mHMLuSb6ekxDqBWJrTnGfzF+TwM2X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 170KB
SHA256 598d135b871ad96511cf276ab64a3eea4ba3f2aa5aade138c3a69bdc45ef5337
MD5 0a1ef7525dae08f6a90f5f2d88f92602
SHA1 21a0d86e14f173d7cab2651d18792c2ee81a363b
SHA512 6c02723108298a7d0fee1c84cee3e39a4e859619de9cfa9fd21858a8f4234b03ec061da068844b5906f387505c8dcc03272f535b2618ae0cc38d28eba4bebcc1
SSDEEP 3072:TGXl8ZYIlUFLWZkJ30Mpb6o6EkSSDHKB/GXjM4rTmN5eWvStRNoV8cWK7XF+TwMM:hHMLuSb6ekxDqBWJrTnGfzF+TwM2X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 83KB
SHA256 5ac2ac90b209f64febbf5abb52f2dad0cd9c83b4fc6fc95bf67c4c5c0392a4a8
MD5 a8745e361ce763143785bba66994c473
SHA1 4f9b29f923c85e853d0ef731bc18b751d8d8e241
SHA512 c673808de383c15e7bd588ac45cecf8394ab175b4e0318d5c8815ac90753ef8ed91eb27e84ca9db7e519fe9060618b4cf27037815a4d80b5d530cf5b5c74d980
SSDEEP 1536:8SaXj8V43bjn6ldz5eU1vkHzZYiVNoV8cWKNR+K7i9U39SK17W5HvTwMD:/aXjM4rTmN5eWvStRNoV8cWK7XF+TwMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4
MD5 713ad359b75fe6d947468ec1825202b9
SHA1 19dcd19f18a2ad6deb581451aad724bd44a592a4
SHA512 4df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 53419be5dbc9f8bff01d7c21bfdd440a9fd3c4f8c1da6d66167740affa0a225e
MD5 eec4eb6dac03be2db9f40e5d23425fbe
SHA1 625be28c5ca4a85d12b0617396da7abcf4b65631
SHA512 0f76d3c950eb12cdbe98e0a9452f9c4dc419270d61609d090c12aae7a182bb0922b450c03bdbf70ef21f633f71400f5927ce805e2cc021a66440a3c17cddf9b0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 e89f70ec5e94216b6e0919008e67e20f021f6254f7a0c5e925a7d4ed7a4b2a49
MD5 622a400e99c269501031f0d6d892fab0
SHA1 78e63adf19c06a2d5f97b12a9da8f47da227813c
SHA512 4cbdedc74aa008cef2d25e46a29af8daaf9f3385c6e08bc539f3a83c165da02a0bac525be189d7a30350bf43ac26ec1077382f0d302c22492369baa125d0feb3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ydomdlt3.5pe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ydomdlt3.5pe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 68B
SHA256 3e79251982703b6377d91e5be36729f091f39d67d66c348770e4578a18a70216
MD5 633ba60948f602d43aa8b62d670e45db
SHA1 6d8cef307ec9ef673833927750672919b35391eb
SHA512 c1332adc8cf624fea5ac697f28719e34c31b0457effb5029201799b11d67b6bbe477da9dd0d4106860210072b784d871ea8f954c98ffc4a7eea67465ad53c7e6
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 97B
SHA256 84ed177b2fb5744ab627093506d149b30993102546970fc67736c72be1a54b1f
MD5 861626869054b3f482d751059a441f59
SHA1 7115d373b1be65639bfcbe44311104f3a11b0c86
SHA512 6522cc914a8b93e3b263b15f473c25f89fae34c861124670e5e4f355c0cc29ca1351d681ed0e147cc2c053ed3e2f58fa41535ed5a66d60abcbbcd7edfa7ca0d9
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 116B
SHA256 f8484f73199e083cdc998f82ec32ab665ab033e2482af2bd43c184a91d289e59
MD5 2214053e5e67c027622688ab6054e1ac
SHA1 e9d120cb63044ae37a5f1f15be29523ecfd40f2e
SHA512 111a28a638c183ad49871816a5c03a6c2051d9793a26b413341c34e46dcb7c0ff9cabc5f625513ea24cdc7f66575fff14ee5ecbb3f100623080db007749056ab
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 117B
SHA256 c39f5fdb2525cc77617b8e21fa3ec88ae19b695855a38b32ac17fe942c2c6e0a
MD5 f240dc211fd692eaff659efc7f299030
SHA1 2234893704bee26e4d4b7fc1a7bdf5ef34536ffb
SHA512 1059d5e77a2f58b0a640c50af1b8bf9d67845196ba9fbdcbd30c4dde1d0a28c61bf00c6452d46e50c8e7f1d89fbd1d544a34292d9b96329883dddb9d02488dce
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 68B
SHA256 13b48a333fd59adf200e5c32e96c1986c5fac655e4a4118a850b6b3c5399da58
MD5 55150c66ae882236ccbb68df895a9c2a
SHA1 9ce7550b405810fe4c9b0756931257731d700b22
SHA512 f5daa2fb3242a2ac0fc0d81d8d8a22a9b0bc40a5d5588812d1cfe16a9dbbdf0dd530cd11bbc97296ff8476fbbfa3c4dad903a18a859ca8ec0d4fc09540c2033a
MD5 SHA1 SHA512

Submit Download

remove_shortcut.cmd

Path C:\Users\Admin\AppData\Local\Temp\remove_shortcut.cmd
Size 98B
SHA256 39386c6a130c2e67a1cd022002d6e3ede46fd800ad93be23d95e721787e0aa4a
MD5 76be7806b08ef76363b071953ff64de0
SHA1 0c68234d238e9cb78e8a236b266d9f104f1f08a3
SHA512 999c2e7c1f49d2056e6590ae603074f748df1cc9f29a7a18b0a8e952c2a86adb12743a74678d5b7e97d3259e759436cf39e08232522f78dd4d7b2bf23988a3db
MD5 SHA1 SHA512

Submit Download

start_process.ps1

Path C:\Users\Admin\AppData\Local\Temp\start_process.ps1
Size 149B
SHA256 df0ac975e4ac91c169b5042a1a413479e62991e3a9979b5e8ccf4cc7d7d9a1f2
MD5 efcd67bd90a7cc11512353c2666b026c
SHA1 a89a3bda4d56283338fcb13500cf99aa4f3f8cd0
SHA512 a85ed4279d687545d2faf9a616b9bdbb72ab0378c21fee79034c776ef16fbea9a3bdee313889534d54d89b01c9167bb296cbb0ccac5020bd44d1613f60f1e23f
MD5 SHA1 SHA512

Submit Download

bg_d94f45fa.js

Path C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6\bg_d94f45fa.js
Size 81KB
SHA256 ff87a97363631d70abaf085b300fb2396e05cd6cff7f7dda2c45a6b5c8d3115b
MD5 9d82f2a51de178853e9b52df85892cd2
SHA1 63fbdc8707ba14d6ec90d19eb607f32442854bb0
SHA512 bcee120e786fc97ffc2d5c24c5dc5e8bfb99b9a22bcbd203b06d8a7abd22d92e7ac3eb93de262ae9977298d234344e52e4aff67ad3c5594b1fe2d0d8272ffaa8
SSDEEP 768:duMlFmEwJD66zjfXJx9whGLKyKUkpQZ8mLQquoHiSqh5FMCkTXX/ddoORTnPllGM:duKmfmr4OYhX/FRTn+Xlc37Pk5c
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.json

Path C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6\config.json
Size 842B
SHA256 4423eeb4999f056ed45030f7a573d0f383970f2459e3b8cfff949675fbe2b8c1
MD5 b51d2a4de9782a7d46e1eff04d16f18f
SHA1 de2406e1180c44dd28bb825ef648c35154cf79be
SHA512 37fb1f291ff59a36c81f36f25553198c4d672aadb9f29fd7c3f0e0d883b9e5c69735cff4ef8f4da4d0011c7657b042b45f514265152e91f807322762fc1e3268
MD5 SHA1 SHA512

Submit Download

ct_cb4f5a58.js

Path C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6\ct_cb4f5a58.js
Size 614B
SHA256 64f15372e14aaa63e01459ac31be67b4c309444e6f92ef910c87ac66cc0004d0
MD5 f096f0df9d50c543999623bcd090fb97
SHA1 7dbd5c580414fc8c23ed4becdd6b76e94bbe9cf4
SHA512 a5208982576d0cd53fe9ae5bd03fd2e2be0412c451e639856fcaa3ddc0f2a88131e5c0c488b33b91cc14af7370fd9f09b29c78ee6e320a66dd75a830bb4f8497
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Public\Documents\LPrKz6y2fG\3a5OxUe6\manifest.json
Size 1KB
SHA256 8a558b728b8e17d6ae8f67c9586894a2da8124b60dd646a8f8049e10621cc785
MD5 083263084eb6066c93a720f49372bfab
SHA1 e3fb9f1c56b75539faff10fa43a61443d1c4f3b3
SHA512 04446cba484999c529dd10f115cb779eaf485850ebdf1785b0d7cfc291faf871827d1b15257dff1f90adb6509a7c70b4556aca8b459617019c7b494e14636ed7
MD5 SHA1 SHA512

Submit Download

LPrKz6y2fG.exe

Path C:\Users\Public\Documents\Zc7jKCHpaL\LPrKz6y2fG.exe
Size 2.7MB
SHA256 da6b97b245c65193eb231de0314508759a69db35a8f76afc66b4757702a231d0
MD5 6550ea36af6d367e39b948835738f76d
SHA1 006fab2aad27c01f702d60b0210a3dde420fe6e5
SHA512 e13c61292dd7fe724a5f330b7c49f873a070d9234d8b347beb11724c90661e83dbaae4e1a33c9ff7a4864d9407dd97ce4af751aae6c1ee12eaf6eece4a8ec330
SSDEEP 24576:bcbLcNaeaEntLCwviZt0PFaN50tmzb2nMdU8wG1Bjl3mqvkujjmlJWF:bcb+aeUSiZtoFS5r2QZi
MD5 SHA1 SHA512 SSDEEP

Submit Download

LPrKz6y2fG.zip

Path C:\Users\Public\Documents\Zc7jKCHpaL\LPrKz6y2fG.zip
Size 375KB
SHA256 451073f0462ea4d092d48d5e6504bb30a4f1a73d627418263f6846d05b3b8b70
MD5 18b9a611b987b31f8f46d69c0c9022de
SHA1 56dd8b64f96fd7f50f6ebc2d30c54ea8004e12cb
SHA512 769b9cc54cc75b22f3248a8b7910556b4e299970b38b3f1f19fc14b9e1cc3327ab3bc8913cba5328e72f18b2b547c62986c195cf8082316633a98213229b203b
SSDEEP 6144:ZdALoF6sUglCoBPqvLw32lZ1BP8nn8vLfMsHD7woNsxsTZPYQTmYQ8e76PYC5bOf:r4oflzPgS2l524LfMsHD7Gsd/qYJe7tP
MD5 SHA1 SHA512 SSDEEP

Submit Download

e578954.msi

Path C:\Windows\Installer\e578954.msi
Size 1.5MB
SHA256 907cff1b76b2e2e44fa6bb41e6b0502733592fee7c18bb9873b9ae2b88bf941c
MD5 4ad791d3aef14562e74d7e756fccd828
SHA1 39a006a7c7cb7be765ef6a508d28e1f244707f12
SHA512 b5f59797e5d21007df17d987200a38ef917250af5cc0be880ac2fcb41911a743d60b2973c200c9252bb23a60e78f14beaf55f68205845a1db63a8a64f2360f08
SSDEEP 49152:YKotURB9xb0mexyBer3rU/eOhPD2ZaWoVYQ:YrURtBWL4/eOsZaWoVP
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 9ee6c04adebbe1bbaf06e1c71581111a141465e05fb17d606c29347631624d32
MD5 2f52839ae6efd1cf407b2bbf129b8ae8
SHA1 db63513e5b209f42183639c7a8f8948206963fec
SHA512 eebfe504ce53d4735ced32cbc22f748d00346712502b8278570f9f49f27720dfd779ed7628902e7d73a4b465de9e329b1fc3364044a451e22b46924c7b8bba86
SSDEEP 24576:CDEmg3kRdoO/vvTLToKOwp2EysHPnyF8GqINcDGYc/6D2WkHofpM/6hx0j:K6
MD5 SHA1 SHA512 SSDEEP

Submit Download

{d63d5d7d-da78-4c67-af9f-f3de41ca91f8}_OnDiskSnapshotProp

Path \??\Volume{329968bc-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{d63d5d7d-da78-4c67-af9f-f3de41ca91f8}_OnDiskSnapshotProp
Size 6KB
SHA256 4090d2dbb677d65ada7e395a28975390dfcc886d28e25a651f99120f1f4e7cbb
MD5 918a1d1ca78588385f695e95c57a3fbf
SHA1 6b33cf3e627349e102a2fcef6c1ef4be27e63e43
SHA512 ee019cdd7cc3e4b92733e0c1615cc23920ac78f328884660274e852abee6793546ebc9e1fb4507dacb61849d6da1cdeef5b84a2fc25cfd46d54f16068fc594df
SSDEEP 96:FmzlZ0o5AMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:oxSQ1b++ZVmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3812-77-0x000001606E400000-0x000001606E412000-memory.dmp

Download

memory/3812-78-0x000001606BEB0000-0x000001606BEBA000-memory.dmp

Download

memory/4428-31-0x0000025A6FFD0000-0x0000025A6FFF2000-memory.dmp

Download