Overview
overview
5Static
static
5luajit-decomp025.rar
windows10-2004-x64
3luajit-decomp025.rar
windows11-21h2-x64
1luajit-dec...ew.vbs
windows10-2004-x64
1luajit-dec...ew.vbs
windows11-21h2-x64
1luajit-dec...ew.exe
windows10-2004-x64
5luajit-dec...ew.exe
windows11-21h2-x64
5out.exe
windows10-2004-x64
out.exe
windows11-21h2-x64
3luajit-dec...le.bat
windows10-2004-x64
5luajit-dec...le.bat
windows11-21h2-x64
5luajit-dec.../bc.js
windows10-2004-x64
3luajit-dec.../bc.js
windows11-21h2-x64
3luajit-dec...ve.bat
windows10-2004-x64
1luajit-dec...ve.bat
windows11-21h2-x64
1luajit-dec...rm.lua
windows10-2004-x64
3luajit-dec...rm.lua
windows11-21h2-x64
3luajit-dec...ps.lua
windows10-2004-x64
3luajit-dec...ps.lua
windows11-21h2-x64
3luajit-dec...el.lua
windows10-2004-x64
3luajit-dec...el.lua
windows11-21h2-x64
3luajit-dec...ppc.js
windows10-2004-x64
3luajit-dec...ppc.js
windows11-21h2-x64
3luajit-dec...64.lua
windows10-2004-x64
3luajit-dec...64.lua
windows11-21h2-x64
3luajit-dec...x86.js
windows10-2004-x64
3luajit-dec...x86.js
windows11-21h2-x64
3luajit-dec...mp.bat
windows10-2004-x64
1luajit-dec...mp.bat
windows11-21h2-x64
1luajit-dec.../v.lua
windows10-2004-x64
3luajit-dec.../v.lua
windows11-21h2-x64
3luajit-dec...ef.lua
windows10-2004-x64
3luajit-dec...ef.lua
windows11-21h2-x64
3Analysis
- geolocation tags
cacanadananorth-americatoronto - user interaction
yes - max time kernel
98s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/04/2026, 01:32
Behavioral task
behavioral1
Sample
luajit-decomp025.rar
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
900 seconds
Behavioral task
behavioral2
Sample
luajit-decomp025.rar
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
luajit-decomp025/decoder_new.vbs
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
luajit-decomp025/decoder_new.vbs
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
luajit-decomp025/decoder_new.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral6
Sample
luajit-decomp025/decoder_new.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
900 seconds
Behavioral task
behavioral7
Sample
out.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
out.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral9
Sample
luajit-decomp025/decompile.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral10
Sample
luajit-decomp025/decompile.bat
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral11
Sample
luajit-decomp025/jit/bc.js
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral12
Sample
luajit-decomp025/jit/bc.js
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral13
Sample
luajit-decomp025/jit/bcsave.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
luajit-decomp025/jit/bcsave.bat
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
luajit-decomp025/jit/dis_arm.lua
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral16
Sample
luajit-decomp025/jit/dis_arm.lua
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral17
Sample
luajit-decomp025/jit/dis_mips.lua
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral18
Sample
luajit-decomp025/jit/dis_mips.lua
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral19
Sample
luajit-decomp025/jit/dis_mipsel.lua
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral20
Sample
luajit-decomp025/jit/dis_mipsel.lua
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral21
Sample
luajit-decomp025/jit/dis_ppc.js
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral22
Sample
luajit-decomp025/jit/dis_ppc.js
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral23
Sample
luajit-decomp025/jit/dis_x64.lua
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral24
Sample
luajit-decomp025/jit/dis_x64.lua
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral25
Sample
luajit-decomp025/jit/dis_x86.js
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral26
Sample
luajit-decomp025/jit/dis_x86.js
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral27
Sample
luajit-decomp025/jit/dump.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
luajit-decomp025/jit/dump.bat
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral29
Sample
luajit-decomp025/jit/v.lua
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral30
Sample
luajit-decomp025/jit/v.lua
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral31
Sample
luajit-decomp025/jit/vmdef.lua
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral32
Sample
luajit-decomp025/jit/vmdef.lua
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
900 seconds
General
- Target luajit-decomp025.rar
- Size 688KB
- Sample260418-byb98aev9x
- SHA256 428d1ef405ad81554913603a8b0b961cd8dd916b70f6bc06e9ea17aa65a0e67d
- MD5 e00dbb8c27ed5bbaacdc564e98447922
- SHA1 3606cea8207a9ea026e27eaf28c631215427ba4b
- SHA512 ecb56ebe0dda8d04c18b6a97184c66e3a535138011a69dd91d805bca5dc21b2323eeea23242e21dd92a0508eeb8338c1cfb5c1a75eae6436d88a4c470c0f5841
- SSDEEP 12288:XIu6WJgZ5pwE4QWaq6Gwm+5jquWHHRdl9xlBZyvVUHn08r:X6eapwwWPw5Za19x7ZCVY5
- TLSH T103E4232D3E593293345400F7B8ABD140C942251B7475A9D338799CDAE1B1FF29982FAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 616 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209496653313386" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1924 chrome.exe 1924 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3832 7zFM.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3832 7zFM.exe Token: 35 3832 7zFM.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe Token: SeShutdownPrivilege 1924 chrome.exe Token: SeCreatePagefilePrivilege 1924 chrome.exe - Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 3832 7zFM.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2872 1924 chrome.exe 100 PID 1924 wrote to memory of 616 1924 chrome.exe 101 PID 1924 wrote to memory of 1416 1924 chrome.exe 102 PID 1924 wrote to memory of 1416 1924 chrome.exe 102 PID 1924 wrote to memory of 980 1924 chrome.exe 104 PID 1924 wrote to memory of 980 1924 chrome.exe 104 PID 1924 wrote to memory of 2388 1924 chrome.exe 105 PID 1924 wrote to memory of 2388 1924 chrome.exe 105 PID 1924 wrote to memory of 1976 1924 chrome.exe 106 PID 1924 wrote to memory of 1976 1924 chrome.exe 106 PID 1924 wrote to memory of 4140 1924 chrome.exe 107 PID 1924 wrote to memory of 4140 1924 chrome.exe 107 PID 1924 wrote to memory of 3644 1924 chrome.exe 108 PID 1924 wrote to memory of 3644 1924 chrome.exe 108 PID 1924 wrote to memory of 896 1924 chrome.exe 109 PID 1924 wrote to memory of 4868 1924 chrome.exe 111 PID 1924 wrote to memory of 2348 1924 chrome.exe 112 PID 1924 wrote to memory of 2868 1924 chrome.exe 113
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\luajit-decomp025.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3832
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1740
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff7f87c728,0x7fff7f87c734,0x7fff7f87c7402⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,11722093136442605707,14478373739176623394,524288 --field-trial-handle=2072,i,15731718591517384716,7713320291874633969,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2188 /prefetch:32⤵
- System Time Discovery
PID:616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,13817158466662219779,8588235101448399582,262144 --field-trial-handle=2072,i,15731718591517384716,7713320291874633969,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:1416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,2492498524396638475,14205052507798637524,524288 --field-trial-handle=2072,i,15731718591517384716,7713320291874633969,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2592 /prefetch:82⤵PID:980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,1936481770763712057,5150349658189818342,2097152 --field-trial-handle=2072,i,15731718591517384716,7713320291874633969,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,2227393803938190946,13908735945755501853,2097152 --field-trial-handle=2072,i,15731718591517384716,7713320291874633969,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,6138991587431071207,16143362883335492931,2097152 --field-trial-handle=2072,i,15731718591517384716,7713320291874633969,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4468 /prefetch:22⤵PID:4140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,17358711656695544670,340326784530245452,2097152 --field-trial-handle=2072,i,15731718591517384716,7713320291874633969,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:3644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,10624915649470651265,14226256493480109776,524288 --field-trial-handle=2072,i,15731718591517384716,7713320291874633969,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5568 /prefetch:82⤵PID:896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,17758823941326364666,18415518124665631643,524288 --field-trial-handle=2072,i,15731718591517384716,7713320291874633969,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5908 /prefetch:82⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,12819023356752993921,1484564606162800831,524288 --field-trial-handle=2072,i,15731718591517384716,7713320291874633969,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6008 /prefetch:82⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6112,i,6684547507624170593,3269939359441056985,524288 --field-trial-handle=2072,i,15731718591517384716,7713320291874633969,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6056 /prefetch:82⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4832
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4788
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 6bfcd3890b852f6b5457ded17f95b348a99a8a8e0c2d01d250cdb5bc62f3a4be
- MD5 da554476d93a1f2ade6df767fb30132e
- SHA1 65b20ac98411ee66696e1d498c7a5d37e696bf6c
- SHA512 63b0bafbea3e8f5e624978b855d9d9923c6c6ba028e7ebb90f50e1ea5cd0f4edb072b169a38abccaca733c251695643a20e7da60f00b3627b1f46b5454ddd70e
- TLSH T1FBE02BB6C821E83F09FD175860554787EB50235A6BC0484F3A3E820D8FF47360A96C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 463d91137ce68320a07f51027aa6ba32233d7b9ec3809112519a95aa5a2d7965
- MD5 59b8ee079ad2b9b380a2595cbafcf4d6
- SHA1 c124c109f676b3fd86d0025e216a9c162be0dec6
- SHA512 55198044cc0f4ed2d8839342a11b0c533e5c99b916add2c9e4485fb9ce2e69b378fcc9464ac6062020a8580c8e13dc777512f23d0f1f8b3e09fc7a33e4d6618d
- TLSH T1FF518EF7D3E4997D851196E49A116E1FCE7D0A14032C3C66C9E4AF0F53E2872E21178E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 711da6654aebdab5f63230b3e5b5b51350f6f80411374013b4c426737b13fed1
- MD5 ec94a0e0a10aa46240805209a2e02a57
- SHA1 26c5e06dcb3a4b1a8b5ca57e06c04f74b7cd423e
- SHA512 981c5e966400af0ec1cca259c7aea0f420d47d8a48e7691e2fee31d164a0c45bb42160d68e3a79d0272a051d1c8e26c0d03d2e5e06c5cba86b4582699eb2fba3
- TLSH T1B3F09EA7D779B467747E85672E02B80928B2A43503603CF5CF6A832CB1899F31F03013
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 480e2761e2085dc829000d33b849072f9dfabafe4ae981c06059f4103afea05b
- MD5 2fed37158b59b4f772ed7f1548c346cd
- SHA1 92fc6a57b6aeb493458f3c750e849fa30fc6cad5
- SHA512 9602c517a380d977ff372897b473ccf230fa630b2741c579ecbfc49bad4a273c59f2c8c6c27548c45a6f749d0f885d575d5028360859d10ab8d2b03328e13a6d
- SSDEEP 192:DRZ46LojA5SAv7CMhAPRp2u93Hsb+WNnOt0FAKcGSOPyIsnAUgraJ:DRZ4Mscx8XZxwA0KKle
- TLSH T1D852D62EA914693F9CE7D32AFD227B07DBF5202160852E84E6FCCA2C15E79CD6217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 604768672355e892c7e6c1b5e589e2ab7f56d12a3e3d353c4abe44578def8f15
- MD5 acd386cab1822bc931a2fef08117d34d
- SHA1 e35948f907dfe3dc7bfda877ef97fc4c33d8de3d
- SHA512 09d40a2c032397a6d8172df999bca2e9bfc4d524aaa082e008cd24cc09c14133cdd844a8e6938f2afa44049123ff2c0b66ac83f670b2cf07c17d76b506fc4e39
- SSDEEP 192:DRi46LojA5S3v7CMhAPRp2u93Hsb+WNnOt06AKcGSMVyIsnAUgtaJ:DRi4Msfx8XZxwA0HKl8
- TLSH T1EA42D72EA914653F9CE7C32AFD227B07DBF5202160852E84E6FCCA2C14E75CD6117817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
- MD5 d8cfe36a6891342c51bc518f22217e71
- SHA1 73290bff0114201260216b0cb931cd9bda0228c8
- SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
- SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
- TLSH T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 b37c1908b08d5f772c2f98d5123fcc64df9c08db7e123751f11f4d1c51b5d93e
- MD5 54fb164c456ec257e15ac097932c321f
- SHA1 288a47ae3c96415860cc59c611952732a19279e8
- SHA512 a5b73208fd28dbdc24b8b9a0e48b50b4f4db06c75a82de041b9b9de9b58314f1905958cb77849d30616704fe7cf6c6a9bdede42f03e3cfb9101ce93db8fa5923
- TLSH T168B01210C4039501C54342B0168A44C831245F249706130193F46A71D8262A34038261
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5913ec.TMP
- Size 96B
- SHA256 70c242241f181a943ca88fa53a9dda80ecb317c01a0d9cddfb91f26908a36faf
- MD5 6c8e0fc0b92f4e06692ee2efeb837d25
- SHA1 7d603f214aa21914b0afd327be9e0b636a9ead0e
- SHA512 9a83cc0a1e2dd95ed103a8783374c5c293ea757beeb85ccec38fac7ac59b3f5217908c29b060f9b47f9521f4b532af7061a26f87e9597fb1c62518691e8a0b5e
- TLSH T12CB00299D102A2D6C143C3F035E699D97260EF29C6139B12DAE41A6ADC29B71852E260
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 0c9a4085ba8c96315763aa88178156a75b5469ed0d5c727ab1d232fdc5220a60
- MD5 f9ac7b83c71bbfb87278f7ae12431d10
- SHA1 ccfec9c613f6117a9fce810b97e900ff3a21161a
- SHA512 9f319febf7672b460c4d4653f274acb69cdcd8f5e4791d9eaa97e806143bafafa14529b99bf21263e6ddecbd1542a8a1cfaf1fa407d863880fe2a2e340262c8f
- SSDEEP 1536:ip/1cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:a13Qw/xLANk0mUW5GmRntSFCjEENL
- TLSH T1F09302BA4E2646E7997D4A8176AE7909CE12534D705FB9CC325C638C61D02C82F72F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 193KB
- SHA256 20eb860e25935a49601a00d0f76b1aa7c2fad3db248945492a47d1fc9ee20ddd
- MD5 a7f7761544f748b19b0575068b7e1c2a
- SHA1 e70dd67cad3d7e5601441b505e5cfb3992f2a087
- SHA512 915b81f57a7077124254668e29cb75851c9d2aa977e15da22fe2f292c731618a1600468c781c4b966e8482f75eb424acd2ad8349083a9b2374207abe6a7649b9
- SSDEEP 6144:wbFRRMZlUVpJcMnpSorOk0HOGm/SFyEEX:KDDFnpxrOjuGdF2X
- TLSH T17A14121BCB1D1EFA99BA04A6F54F14054F138B6971EFB2C972AD271C31896486F53C23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 193KB
- SHA256 ce1560d6e24a05ee988e7e3de017053755f5d053f149a8fd3a0f321e885750b1
- MD5 ce6250c9b280517e221c3aef49340400
- SHA1 33d2f67ed4eebe8c9061dda40a8f29874f3d16c5
- SHA512 91f79c025affc31f4c0efa78e1379f67b5f2133942cef4550a5aa95b448d666a079b795709f06e5f251f79897b396a2d7c33d6cc40d132ee5673598053ed7635
- SSDEEP 6144:XbFRRMZlUVpJcMnpSorOk0HOGm/SFyEEX:PDDFnpxrOjuGdF2X
- TLSH T13214121BCB1D1EFA99BA04A6F54F14054F138B6971EFB2C932AD271C31996486F53C23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 47c93b264c18f3c4f4ec554a9f4372e9b3ac12e20283b7eee7a65dbeb44e36d5
- MD5 dca935e02bfba6d20e1db8d56c816c6b
- SHA1 f77c7f4000029a92235dc441fd0f61063308ec8a
- SHA512 1d3314a16a844e19faf7e0a843e3b6af01367cb0ff517e3b71cfd2c6e97a5fe22921cc94e4c0d679ea8631d44f849c02727ac08a153a669911a13ee86ac852ce
- SSDEEP 3:MsEllllkEthXllkl2zEklzUll:/M/xT02znol
- TLSH T1CD4404047FC0444FC5D050304015C3F40371F4100511574374D10D37DCC55400C34500
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\AssertMount.xlt
- Size 358KB
- SHA256 33d1827e0801b001a9e84a32501e36af4eada5ae34865c6179f0315ae955ab5f
- MD5 689c051d25648c614ec0f18124f2958d
- SHA1 982724e2d237e3a3ef96e9171e1f77099f87b883
- SHA512 23d7cada1273ba4c697cd04f55d06eb72f87a376f7b41de8adc2464b686a748e143fe82aecd81d9dc43f2891e77cf80789a67a421f365dac44d70a0d3545e6b4
- SSDEEP 6144:KY2ZOWrx/x2Xc3azzItiTNECc/KHTwBopMSqjwdnKZvMPH072OoiGJL0:z2s8x/xUcKHIaNo/KHcopMgKOPHbOoW
- TLSH T1297423A70FDB75D77C8E81EC27365B0E01213D6A7A0652255698FE830808B66EF5EB70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\ConfirmGet.ps1
- Size 406KB
- SHA256 bc58e9764e75099ee190b88582196e873f1baee063cc937249c5674de69233ae
- MD5 999110246846f26223dfe2e5a9c9bca2
- SHA1 681362014fe026fc35dd6412b64853d038920eba
- SHA512 36cd14e4236164e1650e1dd56cb444fb7431a822c0a02227bb09077939b423400aee917f06abf49c73ecab6929df15a346798a3c35a72665b2506b72898cf4f0
- SSDEEP 6144:V9HYb1Nuzl9CFu5AYnLqinbweEFha8vs+22qejqt4iWo795NpqqfUqGd58Mgk0qZ:VSmz7yUAYGReEQ8ZoEyld8qGdF0A
- TLSH T10294233EA5126FBC0EBA06F2948525347D69E0AF3E1E0A4951F59EF52262D03C7F8DD0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\DenyProtect.mp2v
- Size 907KB
- SHA256 60bc3afde6913ae89f550535cca562655bf47869fa209e7545e8ddf29f74be32
- MD5 15a83b4dc4dd193a7fd404eacc16b3cb
- SHA1 fdb61d9caab1697ec2fd33d1a506973c69f64545
- SHA512 c43ef0512576e66f9d819ef15ae89bfe0b8fc18784970ed7d5da66ecac114c36f1ed1e96a48c487d51cc5b402e56781c90f68c7fab68495ca8220295adef9aee
- SSDEEP 24576:AiMQysgXgTXKp6N5OxZEYh8N0DK0fjuaiBSD2GiUSIVK+A:TzWGONEYaeJ7uat2GiwVK+A
- TLSH T1711533C11B08A9C8BB4D876C731912B7EBCD56B77D0DCD586CBB860561BB6BA6C302D0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\DismountRestore.hta
- Size 812KB
- SHA256 7adfa62b43bd2b6b36c491bea4fe608554043c86822a0fd5615b02fb6c9a7088
- MD5 ec1632b7e0cf7adbac9bf2c6fba7932a
- SHA1 a1cdcb594fde72d3d13cdfd70b67734ffa463c59
- SHA512 17e295b40d943fd935108cb4df875d443b445d1a98a3119368e2eac23696c69e8e737b8cf8774eaea1483e2ba4bb74ab7ef5537d88bcbb7c586471c39d4504d1
- SSDEEP 12288:gDTn/bKsdqr9nZncuKGsbv1Qu7HpZxP4Vs3b3seqmHGMc2gisCStv6bK5hTzKCE8:gDT/byrJsbKCTB3YvmHahiQnsvmMi
- TLSH T1A30533F482BFD2708A8D680D8D2A506CFE0E4865D7848D09D97EB8C1957C9F3DE876D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\EditSend.xht
- Size 453KB
- SHA256 4b528f85cf7801d60d906517e77fc2318a985ae09337c3498c3fd5d3ebec18c0
- MD5 85d1afb5f2d10d21549bb6a86dd3bdf6
- SHA1 b46cf77769b8d9616b9839ac6965edbdf4287d66
- SHA512 b1be8da29591ca064023facd3a485088d5fcd89d09394a597c6496799f8668ace5f21c7293b40618b591bf5f47e2213b88e5e015517f5333a59f1a4c460ffd83
- SSDEEP 12288:E6FNsXxlf8vNeSFgKmVRsIZDzMOgxJvCIZsMIWTYgihd:EIsB1gN3lqMT3vSWEgihd
- TLSH T13FA423BBE8E6E4063E14C705E10F2A9A64DF457CCF9985E51BE0284F1C71B82291AD7F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\EnableNew.jpeg
- Size 740KB
- SHA256 08c10f7834a0a17229958769d60b1d68dd0eefa44f91e4e0c581ab02db5d6e61
- MD5 91bf9405bfc38ba6b7f53f0a8cad4942
- SHA1 9c896ba8e120bdba6b0319451b81f9d8555d76f7
- SHA512 3186b4d5f13cf17da8e9f2ce664990d79bc2c9ade2e2a86870d47c2c8f3fd8f77d5cc9cacc078b6d4abb7aa0fa4910504029d1adc85b2041d35a64f25ba7960e
- SSDEEP 12288:xd7J2tioANlxwKAnmshzQLGjMAJmS7Hhx9DuKzMjap10Sbl20lHjL1TVOSj5wRMc:37J1lZAnmRLGUSv96KMqrZ20lHjL1TVK
- TLSH T149F423DC90B1B2660CBAB5D3EEEDC2907F52248497CF036C51E93E23ADE76052125E5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\EnableOptimize.TS
- Size 382KB
- SHA256 55e60a6a9f0e392e532945d9e96a16b47446a6f9821b340706f54903c4c259f6
- MD5 f4fda52fd7f5e0548017babf41b902ea
- SHA1 98f2b3714fcb532384963f7f1c8f88e2f7a5006d
- SHA512 0c9f8dd29bb9f026ae6e12559b27590bab83f35e1e04584b46f00f61a163ab84103d8e2203c8ec555cfbc98e4d3cce63db6d856b224795c96e225e557e099db7
- SSDEEP 6144:ku6WY+VJlfdyZh085eqM+FxbKzhsGLTGUPMeHc3b2xHkAhNVKvtyemdZNV:kBWr3lfUZht5xRPIhseeeqrsVKvtKdZf
- TLSH T1FE8423B89FB265D26F87BEC99022241608C4235E73E1ED7713A4F476738CB266F34916
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\JoinMount.jtx
- Size 955KB
- SHA256 c321abfe10b95a6992e20b7b81391c19f84a0c36166f6135af77f9769556c8f0
- MD5 697ab5169a15318efc8a09f7e9f074e7
- SHA1 0d81221b1f5fc9f8b8500341d099c18176a13e18
- SHA512 95454f628477fc3b9863b1fe16f283377816576afae94a762d0305e4330f55ba0eaf304e7c4afdc805be59b416bed8dc02acdbc2c84a61d85bcdd6ae1de7e076
- SSDEEP 12288:ktuBVMpg2Y4VAkdeeRhQ1ThgbYtptZAl21fU7SNu5WwG5qHLnbYIm0a/7Q0tkXkH:k0/WY4VzhkKMtpj1fUGIEwG58LmJUZYl
- TLSH T153253316A39CB7BD3521DF00E89C0688D54BF57C1A6F2E8FF0626C61C96114687E8A7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\MergeUnprotect.xsl
- Size 716KB
- SHA256 ab1cc3c651acda59d4ce1048fd816cccf7eeca1ad6f566c5f535589b5ce527d1
- MD5 b68fc8eb15a1a395f15457aa4e26dacf
- SHA1 8a6f22dbcdca27a0536d8c786d198b4b67f856c4
- SHA512 f68dc2a9e5d5c070c37b2e118e3c9f1e4b97b27875a92449291825f401d2001e2850e9cc2e6feabd9389799514215909a451337209a8e1fa9282edec9267426f
- SSDEEP 12288:qanWWja7uzI0t+JG0XYkXEE0314spyB/dF+c3+EphsacOuV3DVfSb3Ii7wnP:7tjX00t+XYk3gy0yB/j+grph9cOe63Iz
- TLSH T18CF42333D4E7E4A99A0BE61B99B86B2307CAF4B5591C1DC05942BE93D884FB943C13C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\MoveShow.dwfx
- Size 884KB
- SHA256 4517320ee6df2a8e73b71d48b280c4f5dfac219158e1475d566340be0d6583f5
- MD5 1b1169db70796df90a773c92802bd57c
- SHA1 2fea30523967cf7140bc24456f4303a0fc0bc867
- SHA512 3b1a53a9e3930179d797b608a7276b60651205e68ba97d78755fffe4ed7ede340226acf0b55ac3d02ff33bc9d36f33af0dc2c3d6972c485f146eb3c1cdef10c5
- SSDEEP 12288:PDt4N5KFdPC7HHg8an8L+yKgVxrJqhdy19GRE3S52nEUUbaKW2pa9jUk0BLgtReR:LtPPKrHgMqyEn09Gmy2nLUbHM9KZgqek
- TLSH T1C0153335960F8E091B5BFEDAF61214AF407175BAC39189DCE04833C85F2D2F4AA27879
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\MoveStart.easmx
- Size 860KB
- SHA256 35f25b847075d4ec20cad32efcca12e49de93a4963dcd8337f96ac7abaa02abe
- MD5 7f61b520b9614114303582a3606673f4
- SHA1 a9cc375b4bbcc1f35d6a0133500be298c74d84b6
- SHA512 10e00b25347a7063935b7243cce13092fc2f717a7e1ff74cd5af55eb1a845d692d2db1b53f1da577e041ab7056b90e487f228e8c321ec36699637d5fcbb65888
- SSDEEP 24576:TvJqg2r10BQhqtHXSguhvaFCfF7XY7XtVa:Thg10yqtigPFRDtVa
- TLSH T19015333EBC7EA14EFB6615C130BD550A9A33735CB8292631247938E5E89684B72DE438
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\OpenUnregister.wma
- Size 669KB
- SHA256 40a5fd55205a4a4583d8af802609030e7daafd7c51c9ae87256811b94bca8094
- MD5 27befd999b72e11649349a9e1986a8a1
- SHA1 992ecacb6dd8235369505f67139fd8726f830317
- SHA512 acfd749d748eba7b472bc9b84076e9b0207d609be585d9b95827d3be2bbdeee6963101bc0773952a71ca9d876e3668b16b0f52a685ef871d6d6c404aad18480c
- SSDEEP 12288:uDk8K2V8oB0Gx3wzbcfceqgn4JFtj1F2nr+NmkjgX1QIz1ZNZ:uDkB2V1iocjgn4JvL2NTlQIz1ZD
- TLSH T19AE423C967F2FF4160377F96ED40E673B545B02441F8E3D01E16BB0E8598DA82927A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\PopSplit.odt
- Size 788KB
- SHA256 e188dd6162b01cfc9cbc61d8c3ae769b8e98f3f1a81375320f108a4714e0779e
- MD5 e992ba6f0b8ffb9f430033cb71d7393a
- SHA1 cf5a3e3cb4704a7e4efa62383f70046d09d69a16
- SHA512 8ef8c0a76f9571e25d1351fe98f836e22b4a72e38dcf8d28b8e2ddd1c76fc997b46c69135b6815fae7ce98b6a3557e7fbafd0f5978c5beeb6be6781745c655be
- SSDEEP 24576:DJzLyYM23veYr+gS32TLxkIiMx0iXW79ZhFi:DJ2Ej+z2TLxkIpx479ZhFi
- TLSH T1BA053361E67D879443042F63E340847BCA594C9FE6CDFE3591CB8F5858E216AA28FB0D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\ProtectInvoke.jpg
- Size 979KB
- SHA256 68a3b4611c428fc00dc8c367d929b2317033e7d9722ca1bc252d6653712646b6
- MD5 e1958cd408fb06b1c731a0608d9e8222
- SHA1 ffbdb0fdda91a3ab8d8a75b97c9be067ba9b6fac
- SHA512 22e65ea54bbe3d34a5965aae0f90f025375e9fab7df98383ff6482d36d8913bdd47506c667c728a7c4df2d9b65ce992e051935dd2ee067a5a4ec532bdc7cda2a
- SSDEEP 24576:lVSbjGXBHnJ7hO062GYqQP/aVtFoBjuf2NjtYZVcGa:nSb6XpJNO06gBKVtuBSf2NOVja
- TLSH T1792533A2788C58D4C7800EEBF09C06E9615476F74F1DF052776FE8AA502D772C399AA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\ReceiveEnable.ini
- Size 836KB
- SHA256 ea3af27e800f6b4fecbbb931764861ffe3b97d9ede310a4bb85485307b00610e
- MD5 77d56ab6d88d8fa994dd24d0132bff17
- SHA1 356ffd2bdaa41417df18b9e7e7ccdf045d47b453
- SHA512 1838f670fd2b7e7f7b326786a9cbaff6a3464b96235bf70aa4a35b239e8741fd3008c1d4bb4f9ce42ed90b641ee3304384e8b7e2ba41b3671e189a805c0c1ff5
- SSDEEP 24576:R6vR7d8Vcz+De4E/2ZStD3oLzeygIZvbC:svR7df8e4E/zD3oPeyDzC
- TLSH T16005339DA70648E71BF3B0E070281DC7AC3F621552DE981495BF2CF19161E790DBEA8B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RegisterEdit.wpl
- Size 1003KB
- SHA256 de9b4cb7623fa5670507eaa6d86fc32733e9e221512646ab5a80132050510ddf
- MD5 500b235d710f1f812229e27755832793
- SHA1 4a2cd9bb85adb37b2ae0d71be9301b90c1fae3a4
- SHA512 95ec0a42faff5529ec7d40ac66ecb72fb6868986b3dc8e707c7efbe5df38a5c02f9009f0c7f17930f3f5ba1137b9ada44310b599fa7a1a5c00fc97243928033f
- SSDEEP 24576:KcD2GvIIqzdTDf2MvHK+8z0kGD9LvKX3gMrUX+vngnezsU:KU2GIbdTDuGq7z0zCX3gAUsnr
- TLSH T15325339B7703D78FD0E9812D201EDA80E791F6EA92151FB9DE24AEBC918532C3273135
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RegisterProtect.emz
- Size 692KB
- SHA256 e93e73b74efc79f25fff24e117254f773e01f0a60ece12d798f8018af7177f2d
- MD5 7df384e4a676875c01ff5bb77a29ddd2
- SHA1 7cb531534dee9535e26296c1b816f15541c94eaf
- SHA512 21548addd4744ea1f66b44bac68e9fa3a5b4ff410f1e33c96093c1e91a1e2614ea4e58ef385c1ce225ea8a43ba15415e099dd4fe06798027049ca4e98308d233
- SSDEEP 12288:eZy3ldFHIFOzArwuhkFJwO91kwSTyOcx9Qo1TzNiXm7QPOCp1AuyTrSi:eYldp8RK92wBOcxW8zN90XAuyTrSi
- TLSH T1FEE423DDCA84BA8F2039AC97D72E5EA9B4DEE2D8D4167C24167D81379C02346307735B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RemoveSet.ocx
- Size 764KB
- SHA256 419e130dfef09136836dee767db886d417f7cb0ef8baeb1ed45d6a0e9699aefe
- MD5 3fa15aa9ff92c3198d093b2503e1cf6d
- SHA1 4d1f59a5322fc9cf736595cbc9d6a51b6a609539
- SHA512 3129aa84f93e188bd4f5ee699014d3f3de9080b54c2b429214e1c85b8ff53b574e7bc29c6b8d8b5679d3d01e9fc156f529001315c3c0d9d2d749a09d91032b8f
- SSDEEP 12288:B6GZQhDzKPy2PYIuMjH65kVd4WfJaC84L6VxS7522Dl86iLfwnvTIgkB:E2QdeP9f65Idt8f4N22p86Aw05
- TLSH T1DBF4331BE7EE8F5298E559BA7574D1FC80CADB3D2416B14E121878801FA23B11E7CE4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RenameLock.pptm
- Size 1.4MB
- SHA256 c408e9b71f22fb57e3a18590b130bb57a5bcc62906eedccd012b62aaaa8ff417
- MD5 7398b49a8a5221b6d19b2d2b6b30517a
- SHA1 52b2b84d555d287fa1b90e93f5fcaaab43b881d0
- SHA512 eecf5f2b1d5cbc7b4d23372e6b8dbb15aa4edf6c481e657f6191bebfbdf76b5a9a6c9dc82f6f2bd31d7d646e0783c540db975f5b3432f9dd6347573aebfc6411
- SSDEEP 24576:lZeID3PlUhJfT2fOqxjKfVPYfrmCsoTwUTNu8wJx8syu/bK8TM:Xv7PanT2fOqxjyermjytLwj4u/bA
- TLSH T1676533E121AADBE125373C642A1FC5602B9DC67DF5442C03553A8EABF7283506EECB5C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RenameRepair.M2TS
- Size 597KB
- SHA256 afa486627472255dfef9ffd18af9da3506b21ece01fbd974e663209f06046f8a
- MD5 37006dd00886b8dd14ac29d86a6566d6
- SHA1 50514408764def337860a128bd59eceefeb496aa
- SHA512 bba48a612b2445947947eee3b2b2f1024bc4abb98bad1c3c9f9741eacc95c3d954a2ee4a4f97673f20dafb830e2ec0089d74a1716914f0ed31991710a3b459dd
- SSDEEP 12288:WCmbL5ZHjtGR1RngDvbidhtXKb7bhp4ln6Cn0yvwtMAD7qc:W/ZZDtGRPgbUSHbhpxVy2lP5
- TLSH T103D423CCAD24CE3E10996EF9C7DD214605B49EB675BE343E12BD3860A369E0FE521C58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RestartClear.tiff
- Size 621KB
- SHA256 50d24274dd00409f5e22cd8802ac3573a6fe499110abee9edefe8321e300ad3a
- MD5 6d4b3f142b340ce5d9785ddeb37e3ab5
- SHA1 b795665e58740ff9de05e3468c37ed837344e770
- SHA512 785070a27f23079e4ee132a11d81dc3e773b5e66a60a70c43ccb955b66a1a9bdba5f60415b5e533832d7d01dfa4f33dbab374ffc2ae6a9650f4ba8634b8f3ca3
- SSDEEP 12288:b+Aj2k6Z6hBhUO5qlTJqmys0jDC8gcdQ7iQ4BN3qpG9WuPt56oTZ6zgIii/K:b+k6ZEhUOasFs0XC8gN7aN3r9nF8kqgt
- TLSH T1B8D4330D1C55E409B33466C3506C81B8FAB7F8231685A2BD7BDA73F66DFD2748CA9680
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\RestoreConnect.wvx
- Size 645KB
- SHA256 28474fba84c6871c9bc917927aea69dbc71bf6dcec5c8963efce29e2c44def76
- MD5 94d30a5fb7bc52915ad9f52f53d06202
- SHA1 e3365255795472fdb184e15c8cb6c73a238cf7c3
- SHA512 1d100515e58fa63d77df81a5c0dc127d05c1feefb8151e03115381e781c1cca572de24d9000525eed922054b9c9e8edf19dbf0189dbbb70b7d6f9e90f4c8b067
- SSDEEP 12288:ufdJT/a24pjrAYJt+Dj7MAwT5GkZr+2NVzb55R+fn0NHZWCEqKSAvC8Rg3JA5:wv/afrAQE7BwT5RZr+2Nlb7Uf05Z1bVW
- TLSH T158E423404272EA16F257C0AB7C6FA95BE4A567DE39C27C6C70406CF7BD9DD8388E5220
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\ResumeUndo.xlsm
- Size 477KB
- SHA256 603cd24bd379ce843e31ecc7db6502e77501942db88c6cb5804463601bf696c0
- MD5 b141ebe3d1b20278b2b85fd2dcf448c3
- SHA1 722094ece1772e98deb22f88401dd5a99fc5d7e4
- SHA512 e89eb45080be0a296e1b54a72fee3782bac51a72d503de3b61ae7a54defee5b50b01ce27fafaac971e9473596f30c7a6ce993ec03e34d5a482beeb11ea9f5bcd
- SSDEEP 12288:ePV+1ItlL3d681+685nRfXc+7uGtd1bvC:MVN3681+lnRfM+7uGtdg
- TLSH T114A423609CA4C62E1325910A711BFF3F71DFA940A08704CDD77FD7DA6226F07279AA82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\SetStart.vdw
- Size 501KB
- SHA256 e4e7e9c32714dace990e6ebe642532712e7732d80c031d91ae40a7679fb25464
- MD5 fa0c9f4bc8e22c197444a2a3a4000cee
- SHA1 1e98917c177ec65fd8f0348a221a1080aab9e8b4
- SHA512 79698410f11db1b576f0685bf1484e9233efc76811805a84027271891c7852e5199c77f68a6835554f73627dd84a0f7c6bd502e24718309c45661cfd2909bc88
- SSDEEP 12288:YxopfcIo5acQ5WXerKRLhhfbLiziLygOprygQXyzy8X4w+:UopfA5mlrKLhhPiWLyg+wXyzy8Xg
- TLSH T1B8B423130EB993BFB7D043B1D7A53B526BB738917F2320FAA94019F7F49181AE140599
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\SplitSwitch.3gpp
- Size 1.0MB
- SHA256 b3c19b571b7d739b4ba6194d0307cca395be1f7620a06c234e54e78fadb00d64
- MD5 c6c83a5877f4f1faa79b125bff6e630b
- SHA1 b3eb56c50e36faac57cd1ef7bedfd14ff357b991
- SHA512 aee9ef2c184b93eea80ea7a21a4d1adf5f73bfe19e4171db0731572674e492e70aae69785c1a4a935f85a3e45ef247b1f54e39e29463aac14e431a3a1567275e
- SSDEEP 24576:r1I/82jg9GJSAyZ5EGZvusX/EztzYH+wBw9MA:r1I/8xPHZvuwoVYc5
- TLSH T12C2533EF76E9223049B58A3D427F7878EE2EE95BB4CB04EB7761D094513F64005092FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\SubmitShow.asf
- Size 549KB
- SHA256 f097c22b7399d43f9c9b83be213fe21c3279406ec1bda0cce236c38026b52289
- MD5 930b7b8d1be3a7ceb6e3ab9f9d85bfec
- SHA1 4d8a573e2b5f44c308e52f508dfdecf08b3e91a1
- SHA512 bb0f1e87912dcd9b1662ae6334cd78266eb9606ddaeecb20e4638aa82d9179dbe452ebb059148f2341959115c8953871592420462017be94a464acd1110a37cd
- SSDEEP 12288:5FCf0TIlma28wM06FEaucjsDKqKvcY1dSFg9XUInIcx7ORPG:5xIlT25QsD8FdSFgDnIdPG
- TLSH T121C4231BC16E31312D843769E1E5D4EC295D03EAC6BE207F67B03AEC096BB3287895D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\SuspendRequest.mov
- Size 573KB
- SHA256 5bac13601a8bb260abe60ad0379afeab623acd55760f18419b5390c293077dc8
- MD5 158dbe628d7d93f47cceaf17f278fd56
- SHA1 5ceaab300d4edddcb73f46bf837b6ec5d100103d
- SHA512 d8a0c759bbb956b0b654e1a55ea846f71d9edde0c17ffeb2770060712170891cc727567578bf312ef4e8be56cf7b4297bea7b701af15a0905d80dc0429930b31
- SSDEEP 12288:yjfYb88fTF2x92v/bEdSWIYLB52cuX28xz/bkGX6Qg+bjDCbC9OY:yzYb88fIW3+S5XcumU/UQgDC4Y
- TLSH T12FC4334B6443739ABCB15BE8060442FF6A0F67462512BAF0BD6443F3253D9D0E9F2AE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\SwitchPop.mpg
- Size 430KB
- SHA256 2c60fcc1fa8a9b718b24aa253dca2821f40dd9b1ed7ea55ac2001cf1c639e4f4
- MD5 d6cd55f38717e429f9fa7d9b8d3d5766
- SHA1 5582c4f4f8bce6cde7e134a4af7bbe287323b298
- SHA512 fc305d1aeaabbdedf991caa980f5a820deb38de316c080fdad1b98aa8cdf710197b7a2e1c9c42f8fb695a165318e1ae8eeaf3c4f390682d6f4ac7beb9ba2d0f6
- SSDEEP 12288:c114I4oRnYt3hXWb70v4gMo4zTRzk6O1YKwfjA:c11FpOtRa61CTxkh1YXk
- TLSH T16C94236D444D4C169A49CDD2CB4EF9DC0CAD798EE9C3C4E3AAA53D1C4E6D8190B3E983
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\UndoHide.wvx
- Size 931KB
- SHA256 aaf4ca01548ff4b0861e344d3e6349e89022fe2478083be281bdaaea4867e4f6
- MD5 6bb288165bf1b4c395b6577b1cacc9e4
- SHA1 d583f2415f2f6f6a5cca9f39d1fc58da03ed5e51
- SHA512 8ca893c7d75a7477569f0bd8c806886ea811652bdcb51928391826d251539c014e3c751e5024f926412bb4b9078a7ebfd23065aef31be730530964228a15e35c
- SSDEEP 24576:DOYETj4J32DJszRTTXdBFOLVFS0HeSvMfKAaL7WLKTg2qSj7KXz:DO3/1l6VX8Li0+3xx2qSc
- TLSH T16C15330C226E576F1B5D9036AAF28F56E08FB83FD3E3590A9C793804F74C7498349954
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\UpdateImport.tif
- Size 525KB
- SHA256 9d820121118e72f9175979f72fbe47337a9eebb6f0c0006bf5f447f3cef3ce91
- MD5 0fed6464fa7a45b68728c53886593a96
- SHA1 535ea2ac902a5dddb61d3213b4a4cadeea18cb5d
- SHA512 442ccb5c8a61d92294115a84c3c3563a6f598a7953718ea7035dc2c82e60d924ccd0928e1330cb0095a4d0803a2a86a6cd4be08648f39e649589be677e76659d
- SSDEEP 12288:o3s6VFomAAN1uo0klzFtC+MFPnrzylkE66t/pHqk:WroA/dlFHMZK2EPtpHH
- TLSH T1B3B423F80688385C84F52BD1E05BC95A67F225496EE319DD8B20DEF6324D7C48E3C66B
- MD5 SHA1 SHA512 SSDEEP TLSH