hxxps://www[.]hitmanpro[.]com/en-us/downloads

Analysis

user interaction
yes
max time kernel
104s
max time network
117s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.hitmanpro.com/en-us/downloads
Sample260415-qf5alshw71

Score

8^/10

defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
22	4076	chrome.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\hitmanpro37.sys	HitmanPro_x64.exe
File opened for modification	C:\Windows\system32\drivers\hitmanpro37.sys	HitmanPro_x64.exe

Executes dropped EXE 5 IoCs

pid	Process
1336	HitmanPro_x64.exe
2356	hmpsched.exe
3684	HitmanPro_x64.exe
1904	hmpsched.exe
3156	HitmanPro_x64.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\hitmanpro37	HitmanPro_x64.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\hitmanpro37.sys	HitmanPro_x64.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	41	185.228.168.9	3156	HitmanPro_x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	HitmanPro_x64.exe
File opened (read-only)	\??\F:	HitmanPro_x64.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\HitmanPro\HitmanPro.exe	HitmanPro_x64.exe
File opened for modification	C:\Program Files\HitmanPro\HitmanPro.exe	HitmanPro_x64.exe
File created	C:\Program Files\HitmanPro\hmpsched.exe	HitmanPro_x64.exe
File opened for modification	C:\Program Files\HitmanPro\hmpsched.exe	HitmanPro_x64.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\HitmanPro_x64.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4076	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207324184986034"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Modifies system certificate store 2 TTPs 9 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438	HitmanPro_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438\Blob = 0f00000001000000300000003f13d09d3d9c0e34359655f0e5825a21518c69617ac82a5c65d17cfe8e8958df5d328ac40821fb5116703b7601e9abfb0b000000010000005c0000005300650063007400690067006f0020005000750062006c006900630020005300650072007600650072002000410075007400680065006e007400690063006100740069006f006e00200052006f006f0074002000520034003600000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c06200000001000000200000007bb647a62aeeac88bf257aa522d01ffea395e0ab45c73f93f65654ec38f25a06090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000005673586495f9921ab0122a046279a140158821491d00000001000000100000001e1771e068b859b9d2e89ea3a6db0e28030000000100000014000000ad98f9f3e47d753b65d482b3a45217bb6ef5e43820000000010000008e0500003082058a30820372a0030201020210758dfd8bae7c0700faa925a7e1c7ad14300d06092a864886f70d01010c0500305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a028202010093bed5365275d80123a01c474249ee63b6b721fdc495d5482b267c145310da79fd2bb72da4d42cfaea32dd49c2b9bd0f483d7b5a9854af9e5d31744f07fc5021dda4cf684f1b12636d25994c2a99f3483061fa817c1ea7084adc3e2b1c1f184c71aa358cadf86ee83b4ad9e59402d6898413aa6dc84f33cc5096379233dc5f88e79f54d948f09843d666fd9f173843c501510bd7e3230f145d5b14e74bbeddf4c8da0337d1d639a121513083b06dd7304e965b91f07024abbf458164430dbd213a2f3ce99e0dcb20b54227ccda6f9bee64309039cd9365812131b52350333722e338edf83130cc45fe62f9d15d32794287df6acc5619404dceaabbf9b5764994f127f891a583e506b3630e80dce0125580a63b66b439872dc8f0d0d114e9e40d4d0ef65d5772c53b1c47569de2d5fb81618ccc4d8090345bb7d71475dcd804489fc0c12888b4e91ccaa7b1f156b77b494c59e52015a8840229fa3894699a49068fcd1f791417120c837ade1fb197eef9977828a4c84492e97d2605a658729b7913d8115faec538623468b286308ef890619e326cf50736cda24c6eec8a36edf2e699154470c37cbc9c39c0b4e16bf783252357d91280e549f0750fef8deb1c9b5428b4213cfc7c0affef7b6b75ff8b1da01905abfaf82b8142e838babbfbaafd3de0f3cadf4e979729edf31856e9a596acbdc39098b2e0f9a2d4a647437c6dcf0203010001a3423040301d0603551d0e041604145673586495f9921ab0122a046279a14015882149300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201002f5c993cfc065e8c942e70ead232318db4f051d5bc0af3649f075ed5c17368647aa2b90ee8f95d852da83745aa28f496055060a9497e9fe29936291344476a9d55203cd89bf10332bada40a173ea83a1b744a60e99019be4bc7fbe13947ecaa61e7680363d84068b3326656dca7e9efe1f8c58387b1a83b10fbc1711bbe606cc63fa81f2814cda0b106ba1fad528a5cf064016ff7b7d185e3912a4539e7e324210a62191a91c4e177c84bc9f8cd1e8dfe651b936473f90b9c7bc02dc5b1c4f0e48c125839c0a3f9eb10333121a27acf7226c24d10141f85803fe2568221f9a5a3c7c6c9e7548f381f166676e4c82c0eeba570e18ef2e9af712d8a06be905a5a1e968f8bc4c3f121e45e852c0a3bf122779b9cc313cc3f63a221603a0c98f66a45ba24dd6812506e976a4000a3ecbcd359be0e138cb6053862842411c4457e8a8adab45e32510bcdb3e6541fb1ba6970febb97479f91ebc1d570d47afc32f9f8746a7eb265a0f5663b562606e00fbe3271122e7fe998f34f5b9e8c39172bdd8c31eb92ef2914451d057cd0c34d54821bfdb13f166254352d2702236cd9fc41c7520ad637263060f0e27ced26a0dbcb5391ae9d1767ad15ce4e749492d553768f01a3a983e54178754e9a62750897b202f3fffbfa18b4a4798ff2b7b493ec32946601842ab3329bac029b91389d3888a39413bc9fda6ed1ff46063dfd22d55018b	HitmanPro_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438\Blob = 190000000100000010000000d21153f3125a7dbce915d41563f733f4030000000100000014000000ad98f9f3e47d753b65d482b3a45217bb6ef5e4381d00000001000000100000001e1771e068b859b9d2e89ea3a6db0e281400000001000000140000005673586495f9921ab0122a046279a14015882149090000000100000016000000301406082b0601050507030206082b060105050703016200000001000000200000007bb647a62aeeac88bf257aa522d01ffea395e0ab45c73f93f65654ec38f25a0653000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c00b000000010000005c0000005300650063007400690067006f0020005000750062006c006900630020005300650072007600650072002000410075007400680065006e007400690063006100740069006f006e00200052006f006f007400200052003400360000000f00000001000000300000003f13d09d3d9c0e34359655f0e5825a21518c69617ac82a5c65d17cfe8e8958df5d328ac40821fb5116703b7601e9abfb20000000010000008e0500003082058a30820372a0030201020210758dfd8bae7c0700faa925a7e1c7ad14300d06092a864886f70d01010c0500305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a028202010093bed5365275d80123a01c474249ee63b6b721fdc495d5482b267c145310da79fd2bb72da4d42cfaea32dd49c2b9bd0f483d7b5a9854af9e5d31744f07fc5021dda4cf684f1b12636d25994c2a99f3483061fa817c1ea7084adc3e2b1c1f184c71aa358cadf86ee83b4ad9e59402d6898413aa6dc84f33cc5096379233dc5f88e79f54d948f09843d666fd9f173843c501510bd7e3230f145d5b14e74bbeddf4c8da0337d1d639a121513083b06dd7304e965b91f07024abbf458164430dbd213a2f3ce99e0dcb20b54227ccda6f9bee64309039cd9365812131b52350333722e338edf83130cc45fe62f9d15d32794287df6acc5619404dceaabbf9b5764994f127f891a583e506b3630e80dce0125580a63b66b439872dc8f0d0d114e9e40d4d0ef65d5772c53b1c47569de2d5fb81618ccc4d8090345bb7d71475dcd804489fc0c12888b4e91ccaa7b1f156b77b494c59e52015a8840229fa3894699a49068fcd1f791417120c837ade1fb197eef9977828a4c84492e97d2605a658729b7913d8115faec538623468b286308ef890619e326cf50736cda24c6eec8a36edf2e699154470c37cbc9c39c0b4e16bf783252357d91280e549f0750fef8deb1c9b5428b4213cfc7c0affef7b6b75ff8b1da01905abfaf82b8142e838babbfbaafd3de0f3cadf4e979729edf31856e9a596acbdc39098b2e0f9a2d4a647437c6dcf0203010001a3423040301d0603551d0e041604145673586495f9921ab0122a046279a14015882149300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201002f5c993cfc065e8c942e70ead232318db4f051d5bc0af3649f075ed5c17368647aa2b90ee8f95d852da83745aa28f496055060a9497e9fe29936291344476a9d55203cd89bf10332bada40a173ea83a1b744a60e99019be4bc7fbe13947ecaa61e7680363d84068b3326656dca7e9efe1f8c58387b1a83b10fbc1711bbe606cc63fa81f2814cda0b106ba1fad528a5cf064016ff7b7d185e3912a4539e7e324210a62191a91c4e177c84bc9f8cd1e8dfe651b936473f90b9c7bc02dc5b1c4f0e48c125839c0a3f9eb10333121a27acf7226c24d10141f85803fe2568221f9a5a3c7c6c9e7548f381f166676e4c82c0eeba570e18ef2e9af712d8a06be905a5a1e968f8bc4c3f121e45e852c0a3bf122779b9cc313cc3f63a221603a0c98f66a45ba24dd6812506e976a4000a3ecbcd359be0e138cb6053862842411c4457e8a8adab45e32510bcdb3e6541fb1ba6970febb97479f91ebc1d570d47afc32f9f8746a7eb265a0f5663b562606e00fbe3271122e7fe998f34f5b9e8c39172bdd8c31eb92ef2914451d057cd0c34d54821bfdb13f166254352d2702236cd9fc41c7520ad637263060f0e27ced26a0dbcb5391ae9d1767ad15ce4e749492d553768f01a3a983e54178754e9a62750897b202f3fffbfa18b4a4798ff2b7b493ec32946601842ab3329bac029b91389d3888a39413bc9fda6ed1ff46063dfd22d55018b	HitmanPro_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	HitmanPro_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	HitmanPro_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42267f000000010000000c000000300a06082b060105050703037e00000001000000080000000000e4add325dc010300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	HitmanPro_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee47e00000001000000080000000000e4add325dc017f000000010000000c000000300a06082b060105050703031d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	HitmanPro_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	HitmanPro_x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	HitmanPro_x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\HitmanPro_x64.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2608	chrome.exe
2608	chrome.exe
1336	HitmanPro_x64.exe
1336	HitmanPro_x64.exe
1336	HitmanPro_x64.exe
1336	HitmanPro_x64.exe
1336	HitmanPro_x64.exe
1336	HitmanPro_x64.exe
1336	HitmanPro_x64.exe
1336	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
2608	chrome.exe
2608	chrome.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe

Suspicious behavior: LoadsDriver 12 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe
Token: SeShutdownPrivilege	2608	chrome.exe
Token: SeCreatePagefilePrivilege	2608	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
1336	HitmanPro_x64.exe
1336	HitmanPro_x64.exe
3156	HitmanPro_x64.exe
3156	HitmanPro_x64.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
2608	chrome.exe
1336	HitmanPro_x64.exe
1336	HitmanPro_x64.exe
3156	HitmanPro_x64.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3652	2608	chrome.exe	79
PID 2608 wrote to memory of 4384	2608	chrome.exe	80
PID 2608 wrote to memory of 4384	2608	chrome.exe	80
PID 2608 wrote to memory of 4076	2608	chrome.exe	81
PID 2608 wrote to memory of 1592	2608	chrome.exe	82
PID 2608 wrote to memory of 1592	2608	chrome.exe	82
PID 2608 wrote to memory of 1756	2608	chrome.exe	83
PID 2608 wrote to memory of 3132	2608	chrome.exe	84
PID 2608 wrote to memory of 1756	2608	chrome.exe	83
PID 2608 wrote to memory of 3132	2608	chrome.exe	84
PID 2608 wrote to memory of 4112	2608	chrome.exe	86
PID 2608 wrote to memory of 4112	2608	chrome.exe	86
PID 2608 wrote to memory of 4408	2608	chrome.exe	88
PID 2608 wrote to memory of 1084	2608	chrome.exe	90
PID 2608 wrote to memory of 1084	2608	chrome.exe	90
PID 2608 wrote to memory of 400	2608	chrome.exe	91
PID 2608 wrote to memory of 4508	2608	chrome.exe	94
PID 2608 wrote to memory of 4736	2608	chrome.exe	95
PID 2608 wrote to memory of 4356	2608	chrome.exe	96
PID 1336 wrote to memory of 3684	1336	HitmanPro_x64.exe	100
PID 3684 wrote to memory of 3156	3684	HitmanPro_x64.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.hitmanpro.com/en-us/downloads
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc492bc728,0x7ffc492bc734,0x7ffc492bc740
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,672379319705493623,922477756900502166,262144 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1436,i,6174234819773733848,13462514316971608717,524288 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,5516883140035818777,15057680569825533200,524288 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,13915392806442653024,4100580097491774132,2097152 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,16352654939623440114,2994045123884454255,2097152 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4228,i,8384312138390730716,14091002973845284540,2097152 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4224 /prefetch:9
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5268,i,6118318239573505970,7308926864893500558,524288 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5508,i,4031073214963648529,6431700506478713999,2097152 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3192,i,4052118213835794062,14250525477591077159,524288 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6576,i,14673692051800095542,4820973375103732079,524288 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6572,i,13717842748577138746,15693606299596984336,524288 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6624 /prefetch:14
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6652,i,12484683906033520866,16240790680403180125,524288 --field-trial-handle=1888,i,15848632257839928976,2547265937702406328,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6676 /prefetch:14
  2⤵
  PID:4356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:732

C:\Users\Admin\Downloads\HitmanPro_x64.exe
"C:\Users\Admin\Downloads\HitmanPro_x64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe" /update:"C:\Users\Admin\Downloads\HitmanPro_x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Users\Admin\Downloads\HitmanPro_x64.exe
    "C:\Users\Admin\Downloads\HitmanPro_x64.exe" /updated:"C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Impair Defenses: Safe Mode Boot
    - Unexpected DNS network traffic destination
    - Enumerates connected drives
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3156

C:\Program Files\HitmanPro\hmpsched.exe
"C:\Program Files\HitmanPro\hmpsched.exe"
1⤵
- Executes dropped EXE
PID:2356

C:\Program Files\HitmanPro\hmpsched.exe
"C:\Program Files\HitmanPro\hmpsched.exe"
1⤵
- Executes dropped EXE
PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hmpsched.exe

Path C:\Program Files\HitmanPro\hmpsched.exe
Size 151KB
SHA256 b2b50833a1275b6f5df8239ad88a6279b8c939f21e541da53cf1edaa22b7c53c
MD5 9a7dca9d602bedf990df2feb79b6ca2f
SHA1 7efb99475e37a3aa40465c15af14452925e5225f
SHA512 bff77fac5f93593ae23a439bd1148545d738e781c9cd10309510c5eb0e38a7a0d40f022fc14c50c9b09a490d0de5f974da0f19a08a601104416ff01c82e4da54
SSDEEP 3072:d+edj92yP4TeYf88NGkgTdcEIUTDKFT/NN/yPpvsl42im:7sTtf8e/SdcEP/KFBsS46
TLSH
T113E35A5773E430F9D4A79678CDA24A42E77278760B30978F1328466A1F236D1AE3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hmpsched.exe

Path C:\Program Files\HitmanPro\hmpsched.exe
Size 151KB
SHA256 a11f91bbe7eaa260ba5d60b475612f26302ddc47b726a3e6b48282c98bfbad92
MD5 785b92d66b6be29802db78798d758d87
SHA1 5ebd8d7c531da4b41f4bac0b322c4d5864b4f651
SHA512 e851ff30e40b34bbe73cc3ad1b4f71616cf86b90d64fd08a3eda039ccb2e9d9f7d30d58689fe430c803d19fcc62d7eb14587917dca7b45759c3c4554d843ce87
SSDEEP 3072:j+edj92yP4TeYf88NGkgTdcEIUTDKFTjNNlyPpvsl4mAS:9sTtf8e/SdcEP/KFdKS4g
TLSH
T1C0E36A5773E430F9D4A79778CDA24A42E77278720B70978F1728466A1F232D1AE3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HitmanPro.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\HitmanPro.lnk
Size 1KB
SHA256 b443c083703a99f48f66f75133165efbf1540bb73b52d01f14d9b23facc50ea3
MD5 8271d884e2d764c6b6131655c59130ff
SHA1 2898a6472a2e9d29e0891ce6fe4727a9bbd60d73
SHA512 2cab2e5bacf21ba4818f8fbd498a13ee163dd7dcc40d30d84c1a76f0f589ca41f23c20bacee244c69fe120227c5d46634e45c71ffbf2178ed62cc7c110bc0ec7
TLSH
T112413B340FAF2727E7B3923576621F214533FC07E778AF5B449A82880879544693EF66
MD5 SHA1 SHA512 TLSH

Submit Download

Remove HitmanPro 3.8.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\Remove HitmanPro 3.8.lnk
Size 1KB
SHA256 98acffd1fab1c3ddead301028ef04450b9b060680a2fab8cab5089ffbd082253
MD5 acd77f904738520abb6c0edda7910c4f
SHA1 82c1ad035aea225fd1fc65d3e68d408ecaa89073
SHA512 0aaa3fa1437ae0b9914b22411e68de4edb25a36ff75413b203170ed8865f349ca518c5e489b564d3bc35e23576da8b9262c4493b9e0f9ba1cc6a59232536411c
TLSH
T1F0416B340FAF2727E7B3863976621F204633BC02E774AF2B48C982880879544596EF66
MD5 SHA1 SHA512 TLSH

Submit Download

616AD1AB067CFD351D6C0EF6F3E12F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
Size 1KB
SHA256 291f3bdb7022011041f4061ff54b5d9d36eceadc061fa3c2528452e76c4c58a6
MD5 3d879c523acb3b9e7f0d0dadde352a5d
SHA1 e5a3225e1d136de78971f10e24740ef140abdbd9
SHA512 4c5fb3ce4f75981fc31d0cf0284d07ececdfd307976f751b0551da8b8e806bdf8784d51942b4ed78247cc4bd452e07732e73cc3c17cee8acfabd095552a4b1ba
TLSH
T1C61146590404267396496D70D9CADC7B6DF5A38682D5C847D740C9C248B3FC92FC90F5
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 050bfb4a0623d7970e76d7b2d7684f41a9d41b311232fafb16f1bdbbbea97695
MD5 3463f67b4afecf42eecc9bc8897d7fa1
SHA1 54561d595325e243b106bf2b71d3308eac49c1e8
SHA512 28a1979480b481b5b3dc15fbe14e4d6308b9bb6c4bc73029c73a0d33e33bebbbbedca0d49c4a944bc02cd90911a6c461a5f569b20792784b82a705a932fcbe19
TLSH
T1A401602F90983A3069168C84D2FCF2A02179D5F59DE8010F5A68838F54ECB206DE38B2
MD5 SHA1 SHA512 TLSH

Submit Download

616AD1AB067CFD351D6C0EF6F3E12F40

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
Size 252B
SHA256 bb7177d7ad757a4344d7c452e9e68baf81e0231ca00b626605cfdd6572f9ec5c
MD5 764f8540d45ab7b94c5be89cb26a6ac9
SHA1 36411d348b1b0ceeda8204dbcda6593bb058e7ce
SHA512 b167a75871bd12560d16c00e40d33aaabfe24d24ffbe371ec1b8883652d3a877a99b97b95c0e4b650e464a96298d0f4580164f64cfd97eb3ad8e0fde6d6b9a1b
TLSH
T143D02220ABF44332F144373ABF3151C6FB38BA31B42ACB8506E2080E2C21F500C30A0B
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 afbb0b37923f67ba12de2877603675e9f0596ee6183163973dd2f7edd729ac26
MD5 4abef7cd7b5d43a30c9737877cfb48ab
SHA1 4d56f42f7acf5c8034498d61c22d8b739a3d0418
SHA512 5a26c7fbb2d4846925033526488b32f0ccdac6e646e2472200689bea7f4418e80088e92073bcc8b45231932d52419caeaa69e6e378badb1ea6c58d3f3d277981
TLSH
T154E06F2C26EBA40EF0A0A93282EEE0B24D99F302104096BA15A0030CBB52F00AD20AB0
MD5 SHA1 SHA512 TLSH

Submit Download

0d36199d-90cc-4bcb-814e-779197b5f85d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0d36199d-90cc-4bcb-814e-779197b5f85d.tmp
Size 12KB
SHA256 83447e74f7d23f00433eeb8ba1d8e7cf7440ff13a7ffd87b29d76058393b76c2
MD5 28b0c42f4885196730230250d3baef58
SHA1 3e7a64e2fdffcda7bed4d0ebf1c6f08899827d64
SHA512 081e6baa5e6857fbda5d328d5e4c8947362c4ec4f8585a5ecaf6295bce9b909233c1991f1b555beec945d43c46b98db84032dd89606796a69c4c9a7f0eed1c8b
SSDEEP 192:2R7/YrsdgkE3Lv7ApAPRp2x09qHsb+WNn9pGP927DkmL2iwqVyIsnAUge:2R7/M+ezsUXZ4w742nkmL2ile
TLSH
T12842D73AB918693B5CCBC329FD61BB47E7F6102120D01E88E6FC8A2C15E79CD6127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fc631fdd4a5016d0c8fcedf209e04619c2eaa5e2165e3f9b4106db507b10e931
MD5 da413ecbb8b4c1070f95122a53b2df71
SHA1 5aae42df61eed72eee200aacbd813ac4efeb66a1
SHA512 609c437a1b90b94969e69b768bd11f20f1982178e0645988def5e1f83ff3d607b0a8ad7944f436b07d20e7b5281f34d69f5178e8cca5b86b1823873602791676
TLSH
T1F1E0E5E9E921DC271CFE076960544A46E720139627418A8F3A3C81084FB066B459685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 613231c956fbee1f819d49f28dfaaf0d6fa41400fe7ee0751babfac8da376494
MD5 586df957f50f637e36bc03d970914422
SHA1 280ef25beacbe9485b7f8121b0b1541b0442ce7c
SHA512 bc66021913501002d98779c2853f1aae7e7d446bb0ff04c99fbad3fdc6f39cd0ce8d86fbc9da6afffa95143662444ddf86a4150ce2324b9e59ec660777cabef6
TLSH
T1D5D0221CC0C4C532EFA06534E7E24D1333302AF51043D30F81C0500D85ABED61C21381
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 be5974f0343b987b28fa211c5110ef66821366af4c2f4f2f5d28e99de43d1d9d
MD5 8cd50b9a76a122847e7481ac5d14a516
SHA1 80e7731aba301b9e32ac216c9c5a5a5e815670c9
SHA512 583cb7c0236c8675e9a25543f3fce44df9c5d0b0db3f1a8d5545b108431826dcb1df12687d930fb743dbafef130240f8a340589d0254ecaa671d3f0482fdaf6e
SSDEEP 96:XPareMaZ6+JRNjYGQzqebukeUfEoWsQYcMBS:XParLaZfNjPQzjakDMohS7
TLSH
T1D492094FDF142A04E2A9017CB4EA08483E6F011D13B7ED589E7858F3AD424A7F242777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a4ba016ab5623e7366f49836e9c3487cd4a8046dcdf85ab282bcf3b1e139eea3
MD5 9ddcc89236dcdb0227b8aa34ec562445
SHA1 5c71ebf3a7d59b2519712ea37a31612ec14b7288
SHA512 96f19f4dbc58fbc5497155880744d1c5c2909dc5a105ec57dc1bc66c3d4c499782a434e54c99c47ff1d90f77cc33ca283c29038835a60afa6c8203c6c761831e
SSDEEP 192:2R7/YrsdgkE3Lv7ApePRpcx09qHsb+WNn9pGP92WeDkmL2iwRkVyIsnAUgE:2R7/M+ezsCX74w742WmkmL2iygE
TLSH
T16152D73AB918693B6CCBC329F961BB57E7F5102221D01E88E7FC8A2C15E79CD6127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d91be7759b962079642c21816d311da74dd38633b49b6e714aa79af91966fda9
MD5 d0b71f2c7501b2211d166411bf1315fe
SHA1 08e6ed095c1a6fd6ef6eb7b5003b5f293a13e727
SHA512 b10aa617a038a85b4b4c9d5fd3df402b802e7977c67ee4986ca037cc67f685ce00067f2566477c942a46bf3969103b7510f2ae36ecb5bc10c62c54ce6715fd09
SSDEEP 192:2R2/YrsdgkE3zv7ApAPRp2x09qHsb+WNn9pGP927DkmL2iwqVyIsnAUge:2R2/M+eLsUXZ4w742nkmL2ile
TLSH
T14542D62AB918A93B5CCBC329FD61BB47E7F6102121D41E88E6FC8A2C15E79CD6127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 02fa3748cc960b0ed806669146286ae61d8f8c37c72e1c20fff625c9b568d7c5
MD5 e1d791f76039330e35fa0e1827d639ea
SHA1 a37e7b6749565fdef84e626eb8e8ab5cfd1eaf09
SHA512 4cd2d4ec371de591ed8fc49a3c9c69bf2d80c0d8879044f55af268ee4a35e216538e529304db502c0dc2822c3e20cfadd9949c623d30489800bbc0cdffa3ddcc
SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLuLcifklXODqt+ErU3sjHG9TDWxSal2:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pU
TLSH
T1B672E8676C0C9D7B0F94C58CD8267E4FADB9024B65ED886483FA582A03D5BDF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1ea59cee0475c75ff910b63f983a1c82b78847a29edae4aef629edda838323cf
MD5 9df7cbda84412deacb4138724117d1e1
SHA1 c7cdebe4437549f87fa416b2df6f5fc8926444d3
SHA512 bc4d4239d38339e2cb440f597bd9aca2b9a4807613d3f2e3186158f37a56779584b1d7011c703d913d3ec2231ce66e7ad7943e767f967dfc12275c055dd826ca
TLSH
T141B012108002A541C48702F01282088C35689F108705130153E46B71DCAA5B14424250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587fe9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587fe9.TMP
Size 96B
SHA256 3703ed422863049cb50d53534c9ae4332cda74cfe1342c7968e49be8158d0c84
MD5 33b6bac91bf8ee4df898d4df64bc25f9
SHA1 a7ce47bc4751211d8764cb61f36875858fae791a
SHA512 45153605f09d999f23325f02bb8586befb78784475b08f158540fdb5fdae6952695e44dc38e9118ef1764b043ded2d9f61fc914cad9be611380c58cdcbb10bd1
TLSH
T12DB02200CA02A202C00203B0288080E83220EF32EB03022382E00B32CC28A308C202F0
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 efeade0cf921c0b9bc29e830ce52e8326d97d7f30270acd65ea8ca2d5c8319a6
MD5 ff2df6ca1d26d8a4278538eea4b2bcbb
SHA1 5e88a3045c00b936351c7ce97c49531e1fbd004d
SHA512 1be3beeb8983df132674b9b6951d5cdb3d3fe90dcf726bdaf8c28152ca8874868c2097e105f6110022b112a490c9a08f6ade960bba2af5a8657f27751e74f84e
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O7pX6eq4VumjPBwkLl:jeuvBnhJsueMEGvIW1DcP2O1fVumdn5
TLSH
T1A2D3854B3A743002EDE59A722CE0547B5E3CB16D4F55A5D428B620588EF2923A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 3a63ea7853b4dba32c27b36e4570ad1136d4fab0f3c45c1e937e2ce4f82f97c4
MD5 c5962950e69f5dd95f7735b9688235dc
SHA1 f1bc15ffb828c14bdb2fa7ad1bd7e8c14cac8115
SHA512 924d86f6bf23924ad7e11d214476194fdb23ad561f3d62132dc0c058e7cf629f2e3a34229666478f96cfae54a34253b024e145ef5c8fafba63d3ec631230a2ef
SSDEEP 1536:iwwyP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:m4++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T15E9302B9981E7D7913AAD6D6E0079C9D4CE38CCE1518657C30C7AF0E14BA393A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 f6bd9c8f59ebb54dba5356d48717f7602af917d9b4ef99be29bd1c5766cfe0ae
MD5 943c8acb7ea9c797c9ce3851e71721b7
SHA1 e1128ecb0359d482382aa30888152ea26009fc3f
SHA512 37fad6a767c4fbf2f1ef3e98df6d79d24bcbbdadf36759da880629f74681e7175a244c1c8dc9f61f3ca16499dd5c041cbef7a1b463f66c70c8d1ea0d2c3bb873
SSDEEP 1536:hZdP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:9++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T1FA9302BA591E7D39636AC396D0079CAC8CE3DCCE1514557C30C7AB1E18BA393A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 1de0658656b3b5f967f83c62f577bc9a4fdb56e72465fd1a83e332589f67261f
MD5 08f682511919b06355406410e6e6f447
SHA1 8bd601f4d655b36c73a6071dd3a06387abed6c23
SHA512 37e3587dcfc8adcfd33edaf4cce5ac5b4ae06a620941f6894f3609a7b4de9d72c48f3621e85a8a8c50aa15abbe986a10aef0eafd5cf6d2626ede12afd804e2de
SSDEEP 1536:iwqpP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:G++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T13C9302BA981E7D3523ABD3A6E0079CAD4CE39CCE1514557C31C76F0E14BA393A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 08bdf19edb7c863872e2878d208cb70190fd053fefa4fa0673f4fa67ee13f2ee
MD5 cb49b0177abfb0b3f954bb931da50067
SHA1 8eceea4fe457c08929421829eeb207aa98198232
SHA512 bfcbeb953fc845ecaa60b590d6183bce203011b48f0929ceb98c9206810111e6827cbabd7c0487d8212092034ba3a099e05dd329f0e7b3bd621177d9a4121656
SSDEEP 1536:1wqpP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:X++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T11F9302BA981E7D3523ABD3A6E0079CAD4CE38CCE1514557C31C76F0E14BA393A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HitmanPro_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe
Size 14.0MB
SHA256 76cf297cfe3f64e872d8994d5ba758a42000f50b70c1f757076d61a67d667bd9
MD5 de4bcdd57d1d6f3dd5114146549dea75
SHA1 e331322b5e1e050ef9cadaadbf3a4cb2e4451ef8
SHA512 89a8507c841395cb060a894c2bd384a296efe708266a7284869f19ed532441aff71a591add05258282251ea4e5b900a6f9489774836ffd2bde32dd99fc5cea96
SSDEEP 196608:slfrWaowXpUwjWBiex0biN58NKmw6yimq5tTuS9J3O6JfY9beKSL/JI:4fiaowXpUpEv25MJFjrTuSne6JFtJI
TLSH
T1EAE6BE0377F90194E1B396389AB24162EA73BC554B38C6EF11A6524E5F73EE08D39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HitmanPro_x64.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\HitmanPro_x64.exe:Zone.Identifier
Size 138B
SHA256 d6dde3c044386452b8988bb6844129170c8ac8f4a30ffe5fbbc48df086069ef4
MD5 3299b4785c373f733d03cc972509a1fd
SHA1 3d7ffab5f12547909f78fd786067844b5ea807b6
SHA512 7b8fa36c7f2c7ff324d4ef3619c6ad0195241bd5e35f08295d3630243ae080018875a5c03803e2b03553647ab0bc92524e1d5c9f6d5ec8a16478cc61d98ea296
TLSH
T1B1C02BA3CC02C0100B2426C431ACDD0DB10B31000DE2C38CFC7000CB6840060C1D4313
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 695223.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 695223.crdownload
Size 13.6MB
SHA256 221ede5696634b6f2be0bfa6a5ea531bf93d78b7113facf34185ce305891d66c
MD5 0cdabd52f745074bd258c99e68876117
SHA1 8913cd6a807e3807c697b1be4a8014712805fd1e
SHA512 65ac5603863f0799b2ee2f0560f0d11013b1c906236bdd0ba11467ff2bb9bd95a86f7cb6e7374347265559cf34b2d9ba6563f14f2c729fa586d38ac5dbcb7505
SSDEEP 393216:eQ/xyp42nAF69025MJFjrTuSne6Jw7N/S3L:H/I902ufjrCq1
TLSH
T107E6BE0377F90194F1B396389AB24152EA73BC554B38C6EF11AA524E4F73EE19D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HitmanPro.lnk

Path C:\Users\Public\Desktop\HitmanPro.lnk
Size 1KB
SHA256 97499d2c076a2e2b88780e22296041f159df4981e62331e841c72dd0ffd03b82
MD5 79c148ca94531c95c8712686ad09f2ed
SHA1 7060b18a25ffe9137a7b06e9e8d1b14de1e752db
SHA512 1905c9db1ac70e3e559bc3d57a155e311023ed3e2ae5054152b680acc8094e0171351d8ba47eadc1173d5f62ef34fa055fe230740c7d8717f273279c84089563
TLSH
T10B415E340FAF2627F7B7973576621F214533FC02E778AF5B488982880879544692EF66
MD5 SHA1 SHA512 TLSH

Submit Download

hitmanpro37.sys

Path C:\Windows\System32\drivers\hitmanpro37.sys
Size 42KB
SHA256 f8a4a64a75f3a00d814b1274373e33ac4e57022b1c68607d6ec82d79cf9fe988
MD5 58f7b8d18a1536f9a059757f8bb140f5
SHA1 6174c69d9c26ee0c0d9d1442af5672572f3127d1
SHA512 7150ee837d7288c55182ec07e7d1bee92cc5616a671ab3d3d018e88f99d1f077baeddf15a53e9b8a15deaae57ec9c0cdcc1c9945dfa07c8a86e187e6fad9b257
SSDEEP 768:aGlu0gKkAWiHxwL8aqTwry8IllhVhSfnXtuFY23VPi9zM3K:PpWiHAqkGtuXoFY2lmzr
TLSH
T1E8132966B6A85498DBABC035D2B5DA63A9B530FD236147FF0520CA452F237D0B73931C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/732-137-0x000001FF3EB60000-0x000001FF3EC7E000-memory.dmp

Download

memory/1336-195-0x000001D7B0900000-0x000001D7B0A1E000-memory.dmp

Download

memory/1336-194-0x000001D7B0900000-0x000001D7B0A1E000-memory.dmp

Download

memory/1336-196-0x000001D7B2E00000-0x000001D7B2E0C000-memory.dmp

Download

memory/1336-162-0x000001D7B0900000-0x000001D7B0A1E000-memory.dmp

Download

memory/1336-163-0x000001D7B2E00000-0x000001D7B2E0C000-memory.dmp

Download

memory/3156-231-0x000001CA391D0000-0x000001CA391DA000-memory.dmp

Download

memory/3156-230-0x000001CA37950000-0x000001CA37A6E000-memory.dmp

Download

memory/3156-264-0x000001CA37950000-0x000001CA37A6E000-memory.dmp

Download