54bad8b7b445a4ce65dfdae52c2ec350f3ac865981792dd1042cbd0326eddf2b

Analysis

user interaction
yes
max time kernel
222s
max time network
238s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/04/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Hashbang.exe
Size 275KB
Sample260425-bb4e7agv3r
SHA256 54bad8b7b445a4ce65dfdae52c2ec350f3ac865981792dd1042cbd0326eddf2b
MD5 bbdb5a492905d9cac7db872f4107636c
SHA1 1f4ed0a9eea707cc0660166009db8dcdec76cb32
SHA512 130a7619dde85343e00feab47e9d0d01c5c75e380692baa327c06ca26cd73f05886976fa9b3bd0bcdddb71cfe4fd053aaaa2534a6bc6d91e8e56bd1d4a2d039c
SSDEEP 3072:dBo/wbCsr47MC7ukb51h4hGFVbDf1QGz9J/R0418PWZ8m1X8BQSarudtEDIhRCLP:31bfkWkbF4Ah1QGz9OrdE9f
TLSH
T164546CC5B7C5ACEBC6054639899B83293738F5D05B839B17193872312E23AD0BEC765B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	Hashbang.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	chrome.exe
Key value queried	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000\Control Panel\International\Geo\Nation	chrome.exe

Executes dropped EXE 5 IoCs

pid	Process
3652	chrome.exe
4416	chrome.exe
2308	chrome.exe
2100	chrome.exe
4184	chrome.exe

Loads dropped DLL 10 IoCs

pid	Process
3652	chrome.exe
3652	chrome.exe
4416	chrome.exe
4416	chrome.exe
2308	chrome.exe
2100	chrome.exe
2308	chrome.exe
4184	chrome.exe
2100	chrome.exe
4184	chrome.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1144	takeown.exe
5376	takeown.exe

Drops desktop.ini file(s) 45 IoCs

description	ioc	Process
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	powershell.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	powershell.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	powershell.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	powershell.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	powershell.exe
File opened for modification	C:\Program Files\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	powershell.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	powershell.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	powershell.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	powershell.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	powershell.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	powershell.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	powershell.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	powershell.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	powershell.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	powershell.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	powershell.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\desktop.ini	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	powershell.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	powershell.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	powershell.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	powershell.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	powershell.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\System32\config\OSDATAùŸT	Hashbang.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Algorithms.dll	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Controls.Ribbon.resources.dll	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml	powershell.exe
File opened for modification	C:\Program Files\Common Files\System\en-US	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll	powershell.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk	powershell.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll	powershell.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll	powershell.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\139.0.3405.125.manifest	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	powershell.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\MSFT_PackageManagementSource.schema.mfl	powershell.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ui-strings.js	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ui-strings.js	powershell.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll	powershell.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar	powershell.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\d3dcompiler_47.dll	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations.png	powershell.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	powershell.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Input.Manipulations.resources.dll	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms	powershell.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-sl	powershell.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.sig	powershell.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe.sig	powershell.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Extensions	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll	powershell.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\desktop_acrobat_logo.png	powershell.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Test-Assertion.ps1	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll	powershell.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll	powershell.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_share_18.svg	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\zh-tw\ui-strings.js	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\main-selector.css	powershell.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	powershell.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLike.ps1	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Formats.Tar.dll	powershell.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBENDF98.CHM	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de	powershell.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js	powershell.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	powershell.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms	powershell.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3436	powershell.exe
4960	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
8	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2592	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215524862422834"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5772	chrome.exe
5772	chrome.exe
3436	powershell.exe
3436	powershell.exe
4960	powershell.exe
4960	powershell.exe
3436	powershell.exe
4960	powershell.exe
5772	chrome.exe
5772	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	Hashbang.exe
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeDebugPrivilege	3436	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 5136	4616	Hashbang.exe	93
PID 5136 wrote to memory of 2592	5136	cmd.exe	94
PID 4616 wrote to memory of 4808	4616	Hashbang.exe	95
PID 4808 wrote to memory of 1144	4808	cmd.exe	96
PID 4808 wrote to memory of 5376	4808	cmd.exe	97
PID 4616 wrote to memory of 5772	4616	Hashbang.exe	98
PID 5772 wrote to memory of 4108	5772	chrome.exe	99
PID 5772 wrote to memory of 2300	5772	chrome.exe	100
PID 5772 wrote to memory of 2300	5772	chrome.exe	100
PID 5772 wrote to memory of 8	5772	chrome.exe	101
PID 5772 wrote to memory of 416	5772	chrome.exe	102
PID 5772 wrote to memory of 416	5772	chrome.exe	102
PID 5772 wrote to memory of 4132	5772	chrome.exe	104
PID 5772 wrote to memory of 4132	5772	chrome.exe	104
PID 5772 wrote to memory of 4120	5772	chrome.exe	105
PID 5772 wrote to memory of 4120	5772	chrome.exe	105
PID 5772 wrote to memory of 5080	5772	chrome.exe	106
PID 5772 wrote to memory of 5080	5772	chrome.exe	106
PID 5772 wrote to memory of 3576	5772	chrome.exe	107
PID 5772 wrote to memory of 3576	5772	chrome.exe	107
PID 5772 wrote to memory of 3268	5772	chrome.exe	108
PID 4616 wrote to memory of 4960	4616	Hashbang.exe	111
PID 4616 wrote to memory of 3436	4616	Hashbang.exe	112
PID 5772 wrote to memory of 3652	5772	chrome.exe	114
PID 5772 wrote to memory of 3652	5772	chrome.exe	114
PID 5772 wrote to memory of 4416	5772	chrome.exe	115
PID 5772 wrote to memory of 4416	5772	chrome.exe	115
PID 5772 wrote to memory of 2308	5772	chrome.exe	117
PID 5772 wrote to memory of 2100	5772	chrome.exe	118
PID 5772 wrote to memory of 4184	5772	chrome.exe	119

C:\Users\Admin\AppData\Local\Temp\Hashbang.exe
"C:\Users\Admin\AppData\Local\Temp\Hashbang.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\config\* /r /d y & takeown /f C:\Program*\ /r /d y &
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\config\* /r /d y
    3⤵
    - Modifies file permissions
    PID:1144
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Program*\ /r /d y
    3⤵
    - Modifies file permissions
    PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffcd22ac728,0x7ffcd22ac734,0x7ffcd22ac740
    3⤵
    PID:4108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,1681168440739541982,17397905380266652154,262144 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:2300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,207261598787834329,17193244414698304588,524288 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - System Time Discovery
    PID:8
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,10782346533469858575,12653946869375025262,524288 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2312 /prefetch:8
    3⤵
    PID:416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,14838184025693369015,5697185946603033342,2097152 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:4132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,4834920788829068177,2255398156601793056,2097152 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,15315205014652596577,7841495615130601039,2097152 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4464 /prefetch:2
    3⤵
    PID:5080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,9466236496079038759,8913818177715564425,2097152 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4704 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,381063091075208222,10617168231407991055,524288 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5412 /prefetch:8
    3⤵
    PID:3268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5436,i,12405443556104859820,6063695075068421674,2097152 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5756 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3208,i,16531908751831735065,1114820491090593092,2097152 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3936,i,17825417064436943856,11104024882017005684,524288 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3392 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3304,i,7511541200725772022,5947385289470678528,524288 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3268,i,4631250683077713772,10638222399469074289,524288 --field-trial-handle=1988,i,15328990007435546565,12781799258390558314,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3692 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command "Remove-Item -Recurse -Force -ErrorAction SilentlyContinue C:\Users\*\*"
  2⤵
  - Drops desktop.ini file(s)
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Remove-Item -Recurse -Force -ErrorAction SilentlyContinue C:\Program*\*"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3436

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c8 0x3d4
1⤵
PID:4724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome_elf.dll

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_elf.dll
Size 1.6MB
SHA256 8b0e9474c4f5f5bbb499004bfd06c797655aeba56fcd18d1d77f007dd8ebab08
MD5 4a08777a9ceb86eda1e8e70452bb83bf
SHA1 1f1a02ee1b66c011e3dce5422ca5083378f81d88
SHA512 4c32147daa0c29c5ae6e87ba442a134d975d460737e8aa9a222fd64a88fc13096d51d8a329828388caac1399fd7276468fd4c072decf49f0ca595b004b639855
SSDEEP 24576:eKv8ASc3Gv0Z+9YcZGEEJ9CnMn6haEvG0vl8XwLj86tTeOQ6aazwRb:Oc3Gv0029CU+a23jw6tTeOxE
TLSH
T1DD757B13F2D901E8D06AD178875B9632EA62BC060B34B6DF0690B6962F77FE4673D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.1MB
SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
MD5 fa63967c128ae8a0849c916979790211
SHA1 7064ec510e9828d290aacdee2af26855ca816c84
SHA512 db167c33774c8032501e36488c9f6724a7394f9e7134a1c9235df8bc7f71658132bc39a84967cf98ef8a61e68ce2d4c813f156ae445a8f6273c811e746fe181f
SSDEEP 49152:VyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:Um7vj1BDlZG
TLSH
T19DE58C13F2D940D8D059D079874A9232EA72BC494B3166DF0A90BB562F7BFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4dea14c1043c7a29ba7febd693412c163c6922bd5b156d645699093750c599d3
MD5 53547ef10604534286fe5c876170303a
SHA1 d6fcfbee980b701dbadacbd46966b0fddb98a701
SHA512 42bcde63722e149849f0ecb9f3cd29942426f42be4fd541572fa52975ecdde1ac5701000fd1b3eb500695b20bebf193338c132f9065b2d82c46cbcbdbe9e2274
TLSH
T140E02BAACD319C371AFE0B3964154701DB5123572740495F3B3DD20D8FB16360645C6C
MD5 SHA1 SHA512 TLSH

Submit Download

538edb00-3a70-4a43-a858-8c9472642747.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\538edb00-3a70-4a43-a858-8c9472642747.tmp
Size 2KB
SHA256 7672a826157deb0e357f9720ede138f2660c362e92bbf63ed4197c8ae74cfc0a
MD5 00bd205f9fadbc811cb0f8197385cc81
SHA1 10ae3c7b786dfb97023a274b9b9f895d2ec6c4d9
SHA512 393f35627143418b4d3775de6377e51d7def66e1bad267cb827f4de970dfc0749eab9021cf554643a7500bab6f775671ba25aaf3b57951cd8e859af0a94fe2af
TLSH
T173517BF793E4957D891196E4EA256F2FCE6D0A25131C3C6288D4AF4B53F2972D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 3e12e11a5944ffcd1c2602b7aeaad732b6df5e3caa792007bc092b35fe257beb
MD5 cb6b0d1ee0b8a011eef722907ead0b89
SHA1 b0fc14763d9b1a4b51dde7affd785def5bcfe7ba
SHA512 4d07bbe084f7bf15217ea8a3517c5a85a5432a8a4c8081cd1b852206550e6967cd8981c58da55d4aed692fa8faf19284e3c732255dde46e108fac14246f6fedf
SSDEEP 192:MRAw+PcO8Sm7AEf9Rwjpv7WghgePRpbVod9lHsb+WNn9R6rgeNY2m5kwlkGVyIsB:MRwFy5spligXbC3wTVei2m5Fpe
TLSH
T15162F92EA404B97F8CC7D229F9657F67D3E5142266901E48EAFC9B2D04E76DD7213023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ee40acde8426d406e165edd143b77c4510e7317a9b9da030ef979826b97db6e4
MD5 ca9bfb523c873850e49354d9c5ec8b0b
SHA1 b559d4e4c9106863354f96e583cb067850100f14
SHA512 07300cb37e4892fbf50ce75ec2bb76e3c9ca69d7080c41cbbf05c57443f90dd7b1c06e923dc823a6703682ab0325bd96fabf1d02b314760a40c964c310857d26
SSDEEP 192:MRAkP18SJ7LEf9RwjKv7WghAPRpzQod9lHsb+WNn9R6YM2OY2m5kwlkDVyIsnAU/:MRTNjYsGl8X73wTi2P2m5Fg8
TLSH
T1B762E72EA914B5BB8CD7D229FE257F27E3F5142261941D48EAFC9A2C00E75DD7213027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 219a91e6baba754bfe748c2f2e7172ea4568aa8882be0672d9e2d608d226a3f8
MD5 b0137296a33e4fb7473658bea7de1cd4
SHA1 2efca35e323968083412af3e029b8fd483bf19d9
SHA512 3b9272ac5577c8f793a1717564a865bbcb0f48f1f829dde1bf1af8546e4a86de07b282848bcf5fd9c93ecde38c2ef323c1de9509fb93a68cab4b30744ada49e2
SSDEEP 192:MRAkPcO8Sm7LEf9Rwjpv7WghgePRpbVod9lHsb+WNn9R6A3guY2m5kwlkGVyIsnB:MRTFyYspligXbC3wTtgv2m5Fpe
TLSH
T18562092EA404B9BB8CC7D229F9257F67D3F5142266901E48EAFC9B2D00E76DD7213027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 748f434a5fb4466b075e8f1f2dbcca2663765601c76d273ba89ed4755000f474
MD5 3288c900ae55e602bad08ba2583962b7
SHA1 9bc2c920d5c1a5351656eb870d394e81156c3abe
SHA512 374bd8eade0952869b5f2537a61e3ae1786d9a25e630339153c02a95c12fbb6311d58ff24be6ff069e2250bae8017422f9e50ba37653455a87448208eb9d4876
SSDEEP 192:MRAkP67nNBwixv7WgpAPRp2R9lHsb+WNnnfdNY2m5kwlkDVyIsnAUgtaJ:MRToNFhlUXG3wfdi2m5Fg8
TLSH
T13642E63EAA14B47B9CCBD32AFD217717D3F5102161942E88EAFC9A2C15DB5CD621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 e1cf7535c48799b7858fc0709087885a14569d445dba02a9d68781a356ef0c23
MD5 2b6b9e1fbd41819324b4bfbe73eb9b6f
SHA1 4e83c3072ad4a769c3d190ece85254b6b39f453b
SHA512 c9b47e0a271400c9e2b5091169ed0bcf1a702098f0250ea3e75066867acedef321698bffcac6f0681746fdac22ccddd0ee23372f4ceb7c1def746354e97b2274
SSDEEP 192:MRAw+PcO8Sm7LEf9Rwjpv7WghgePRpbVod9lHsb+WNn9R6rgeNY2m5kwlkGVyIsB:MRwFyYspligXbC3wTVei2m5Fpe
TLSH
T13962F92EA404B97B8CC7D229F9657F67D3E5142262901E48EAFC9B2D00E76DD7213023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 eead3548a15610f890614edfbafb1eee3b1eda1e8f4197f56d12c4e978140826
MD5 27a450d12449cb727e9ec769e3af752a
SHA1 5dc6334dcba2f5f3de7f71cd413dbbf27bcf3c4d
SHA512 52d9863068325f04686c67565f1f3f0bf6990331b84a27db2b4360b5dbf43a9c0661557ef430a78c49aeb3c61470c3f943593711fab62e6d9398a2c6a07711d2
SSDEEP 384:gGj8D7KxkXqKf/pUZNCgVLH2HfgslVM7pLuLcifOPXOD8/+ErU39nHG4F5KvB4tG:gm8D7KxkXqKf/pUZNCgVLH2Hfgs7M7pj
TLSH
T1FB7208676C4C9D3B0F94DACCCC167A4FADB5024B61E98C6883FA982503D5ACB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 16e56bd913b40db8fb06bfafb3d00a5e971268310b3f60de227e87e6ae6ee0ee
MD5 435d1120aca38c9634aa1b568d340dd6
SHA1 c5a92a94f6bf86bb28e0ee0840018bbe13969ac9
SHA512 ec574156a894fccef10c77d535c841a5b04aec7c25f73ae2c5c5060f4b291f79a1fcb1dadf61dc3acba1395ad1bf750ae035da22c47eb63e381de54ba0f18572
TLSH
T14DB0125084019D11C01343F4119218987114BF14CB45134153E0697198371B04216191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ecf6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59ecf6.TMP
Size 96B
SHA256 f24cd9c96071eb59f42ed63711424203b67577cd0f4e22267e5e13303363ab44
MD5 51979ff1684ed71a3a468bdf7a4053ec
SHA1 bf9bedfc0976f8a46412ee805f0d8a825b4fb143
SHA512 48064a315fae052fea7ad04990a25dd490b2613082bbc2a507f284e6d184cff93f160e2f229ad8e8d3d0b4b4a993ff7d18469f026f51d220b827582e14cbf382
TLSH
T1BEB02282C002A322C00203B03AC082E83020EF30CA0B0323A2F02A2BCC203E00230030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 196KB
SHA256 ed1847b3578329a4a5cab38480d0292d04a79d0eecef7ef63f0a40a4f189e2d7
MD5 fa63b3b46711aedfa940b4e364f4637a
SHA1 89641f92aa470d48e06c2f0535e9612a9e1a90ba
SHA512 7c2076b8dc89944968b59ab9ff24ce3b3bd1c84e7c30e1f9ac10cc760433342604e09905639707612a97d38b8e2c933adf4fd70eb045decfea17d4d8080f9c71
SSDEEP 6144:SWecOYPp+82q3iasrRjRO6ZZwINsIrS2uB2G:SbcOYl1+Rj8upNPS2u0G
TLSH
T1411422EA7EB6DC33A84DD105D03E3D2DAFF570A9C44FE5A529C1671B40D7AE89243828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 aa2d21795d5fff6979cb1c5c23b8496b01241b0f2e473f5b00179abd31db5494
MD5 c3d5a5e1ccd5de6a45180a27827ab88d
SHA1 aa6c1c80ebb8d4e010f888c24fdf60388819af94
SHA512 b7cbca3f82a394496e1980406e6c0dd9b95d9ab60bcc61693de223f14090d5fafa1051e9f1d23dc68800a02ae2fb8e31638ee6c4c8825da67d69bfb464f7b1d1
SSDEEP 6144:2lecOYPp+82q3iasrRjRO6ZZwINsIrS2uB2G:tcOYl1+Rj8upNPS2u0G
TLSH
T1E31412FA7D7ADC379C5D9409903E3C2DAEF5B1AAC40FE4A938C5660B40D79E89207824
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 d7367e86af49fd1811da9607a3be71efdd77e8cbb456da1c95580976b3d54c5c
MD5 c4eb22fda14fbaef28c920109c5e2b61
SHA1 27ae9c3b5162ff903790c524fca29c957d4e51ae
SHA512 02f6408408af695cdbe8b69e888d6e1affe33f15003a640a7f249bd242bb2395f32a2e0e011b916c10e6df7c7a8f829d10e30d094e1052a427202387d3248bee
SSDEEP 6144:KWecOYPp+82q3iasrRjRO6ZZwINsIrS2uB2G:KbcOYl1+Rj8upNPS2u0G
TLSH
T1431422EB7EB6DC73A84DD105D03E3D2DAFE570A9C44FE5A529C1671B40D7AE89203828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 1f73019a389afb087a8f3849e324ed39b7b19d710da267e54990cd68319b9340
MD5 4e0a4ab190c685309e455b047c4a455a
SHA1 143df239bdba54ed145a16312073a8bcda811a99
SHA512 85d30d9171d59c56d815009fa65441b5df568945fe8e0cae49ff2711269232ccac5897110b16625e53739cf0bf3d63299921f1562b8d7752f2886bd24c1fa2f9
SSDEEP 1536:IsKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPr:bDlBshIZZwINsIrS2uJBLpAkLQqr
TLSH
T1B49302BB3EA6DC77C49C4102B93C2A4D6FC4E5E9C818B66559CA277F41F1BF99203502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4
MD5 713ad359b75fe6d947468ec1825202b9
SHA1 19dcd19f18a2ad6deb581451aad724bd44a592a4
SHA512 4df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8
TLSH
T18A51DB313375B1E4895A7F47192819C023BF8355FA98AF5CB65C621ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5eda0f6ae8623cff9400482aa0810ce60715d7ce29cd6071e8bf9e1d4b80b121
MD5 c75816a31ec321ca2001c586eac62f5f
SHA1 04010e6d9a8743463e8b244e4c483510eb3c6b44
SHA512 4a53f2e40233bea75c25d1824ecfa99588622ef8c024876264330b04f74e6c5898bf0e4584349908e973a99bca5e8e0a0977a16cade5e10f757345d09aa26bb5
TLSH
T144119723F3DC8950CC89023B409D9CA075B2D7C7809EDF9B2EC5C204A07F599CB201A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_amm2td0h.vnx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_amm2td0h.vnx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3436-138-0x000002117C430000-0x000002117C4DD000-memory.dmp

Download

memory/3436-96-0x000002117C7E0000-0x000002117C802000-memory.dmp

Download

memory/3436-137-0x000002117BF00000-0x000002117BF0C000-memory.dmp

Download

memory/3436-132-0x000002117BF00000-0x000002117BF0C000-memory.dmp

Download

memory/3436-133-0x000002117C430000-0x000002117C4DD000-memory.dmp

Download

memory/4616-149-0x000001CEF2DC0000-0x000001CEF2E5E000-memory.dmp

Download

memory/4616-55-0x000001CEF2DC0000-0x000001CEF2E5E000-memory.dmp

Download

memory/4616-0-0x00007FF7A9520000-0x00007FF7A9564000-memory.dmp

Download

memory/4616-14-0x00007FF7A9520000-0x00007FF7A9564000-memory.dmp

Download

memory/4616-9-0x000001CEF2DC0000-0x000001CEF2E5E000-memory.dmp

Download

memory/4616-8-0x00007FF7A9520000-0x00007FF7A9564000-memory.dmp

Download

memory/4616-3-0x000001CEF2DC0000-0x000001CEF2E5E000-memory.dmp

Download

memory/4616-2-0x00007FF7A9520000-0x00007FF7A9564000-memory.dmp

Download

memory/4616-217-0x000001CEF2DC0000-0x000001CEF2E5E000-memory.dmp

Download

memory/4616-1-0x000001CEF2DC0000-0x000001CEF2E5E000-memory.dmp

Download

memory/4616-235-0x000001CEF2DC0000-0x000001CEF2E5E000-memory.dmp

Download

memory/4960-106-0x000001C5F47B0000-0x000001C5F47BC000-memory.dmp

Download

memory/4960-107-0x000001C5F66A0000-0x000001C5F674D000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads