hxxps://gofile[.]io/d/9VCneB

Analysis

user interaction
yes
max time kernel
215s
max time network
210s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/9VCneB
Sample260502-wgjm7ads21

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
14	1428	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
5676	tuff.exe
4136	tuff.exe
5540	tuff.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	api.gofile.io
9	api.gofile.io

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\tuff.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1428	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222180222483204"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\tuff.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
5676	tuff.exe
5676	tuff.exe
5676	tuff.exe
5676	tuff.exe
5676	tuff.exe
5676	tuff.exe
5676	tuff.exe
5676	tuff.exe
5676	tuff.exe
5676	tuff.exe
4136	tuff.exe
4136	tuff.exe
4136	tuff.exe
4136	tuff.exe
4136	tuff.exe
4136	tuff.exe
4136	tuff.exe
4136	tuff.exe
4136	tuff.exe
4136	tuff.exe
1804	chrome.exe
1804	chrome.exe
3860	chrome.exe
3860	chrome.exe
5540	tuff.exe
5540	tuff.exe
5540	tuff.exe
5540	tuff.exe
5540	tuff.exe
5540	tuff.exe
5540	tuff.exe
5540	tuff.exe
5540	tuff.exe
5540	tuff.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeDebugPrivilege	5676	tuff.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeDebugPrivilege	4136	tuff.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe
Token: SeShutdownPrivilege	1804	chrome.exe
Token: SeCreatePagefilePrivilege	1804	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe
1804	chrome.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 444	1804	chrome.exe	79
PID 1804 wrote to memory of 1428	1804	chrome.exe	81
PID 1804 wrote to memory of 2348	1804	chrome.exe	82
PID 1804 wrote to memory of 2348	1804	chrome.exe	82
PID 1804 wrote to memory of 2648	1804	chrome.exe	83
PID 1804 wrote to memory of 2648	1804	chrome.exe	83
PID 1804 wrote to memory of 4884	1804	chrome.exe	84
PID 1804 wrote to memory of 4884	1804	chrome.exe	84
PID 1804 wrote to memory of 3924	1804	chrome.exe	85
PID 1804 wrote to memory of 3924	1804	chrome.exe	85
PID 1804 wrote to memory of 3816	1804	chrome.exe	87
PID 1804 wrote to memory of 3816	1804	chrome.exe	87
PID 1804 wrote to memory of 1452	1804	chrome.exe	89
PID 1804 wrote to memory of 1452	1804	chrome.exe	89
PID 1804 wrote to memory of 4956	1804	chrome.exe	90
PID 1804 wrote to memory of 4956	1804	chrome.exe	90
PID 1804 wrote to memory of 3252	1804	chrome.exe	91
PID 1804 wrote to memory of 4680	1804	chrome.exe	93
PID 1804 wrote to memory of 5676	1804	chrome.exe	94
PID 5676 wrote to memory of 5080	5676	tuff.exe	95
PID 5676 wrote to memory of 4728	5676	tuff.exe	97
PID 5676 wrote to memory of 5488	5676	tuff.exe	99
PID 5676 wrote to memory of 2772	5676	tuff.exe	101
PID 5676 wrote to memory of 124	5676	tuff.exe	103
PID 5676 wrote to memory of 5900	5676	tuff.exe	105
PID 5676 wrote to memory of 2564	5676	tuff.exe	107
PID 5676 wrote to memory of 4524	5676	tuff.exe	109
PID 5676 wrote to memory of 484	5676	tuff.exe	111
PID 5676 wrote to memory of 3136	5676	tuff.exe	113
PID 1804 wrote to memory of 984	1804	chrome.exe	115
PID 1804 wrote to memory of 5420	1804	chrome.exe	116
PID 1804 wrote to memory of 2948	1804	chrome.exe	117
PID 4136 wrote to memory of 5024	4136	tuff.exe	120
PID 4136 wrote to memory of 3560	4136	tuff.exe	122
PID 4136 wrote to memory of 4284	4136	tuff.exe	124
PID 4136 wrote to memory of 5448	4136	tuff.exe	126
PID 4136 wrote to memory of 5552	4136	tuff.exe	128
PID 4136 wrote to memory of 1656	4136	tuff.exe	130
PID 4136 wrote to memory of 4724	4136	tuff.exe	132
PID 4136 wrote to memory of 6056	4136	tuff.exe	134
PID 4136 wrote to memory of 5264	4136	tuff.exe	136
PID 4136 wrote to memory of 1744	4136	tuff.exe	138
PID 1804 wrote to memory of 3860	1804	chrome.exe	140
PID 1804 wrote to memory of 5540	1804	chrome.exe	141
PID 5540 wrote to memory of 3248	5540	tuff.exe	142
PID 5540 wrote to memory of 5404	5540	tuff.exe	144
PID 5540 wrote to memory of 4628	5540	tuff.exe	146
PID 5540 wrote to memory of 3716	5540	tuff.exe	148
PID 5540 wrote to memory of 5036	5540	tuff.exe	150
PID 5540 wrote to memory of 4496	5540	tuff.exe	152
PID 5540 wrote to memory of 1588	5540	tuff.exe	154
PID 5540 wrote to memory of 2016	5540	tuff.exe	156
PID 5540 wrote to memory of 4904	5540	tuff.exe	158
PID 5540 wrote to memory of 2620	5540	tuff.exe	160
PID 1804 wrote to memory of 4788	1804	chrome.exe	163
PID 1804 wrote to memory of 4788	1804	chrome.exe	163

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/9VCneB
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc65fcc728,0x7ffc65fcc734,0x7ffc65fcc740
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1436,i,12798012288703315434,14295983854838901020,524288 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2488 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,5246185189836044979,1820483612964997083,262144 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2460 /prefetch:2
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2052,i,6544809422163390686,3531048336369071011,524288 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2496 /prefetch:13
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,12835147798374626821,7948817768498479362,2097152 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,1886204556104107341,7048034346391250892,2097152 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4176,i,6750201485121791517,11336514928383126319,2097152 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4180 /prefetch:9
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4580,i,13042466529307556041,8101670660052811507,2097152 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4480,i,15542119188170780791,6811191766980598393,2097152 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,8461010357057722098,14848805893408455252,524288 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,3834920710417179245,2194912732946349060,524288 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4680
- C:\Users\Admin\Downloads\tuff.exe
  "C:\Users\Admin\Downloads\tuff.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:5080
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:4728
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:5488
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:2772
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:124
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:5900
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:2564
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:4524
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:484
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,891685731197588901,6005134682416656198,524288 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,12724411265952618835,3790063373538310884,524288 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,10756455975942099257,14671742536261634973,524288 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5128,i,16408346638377862582,3643403203677796055,262144 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5132 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Users\Admin\Downloads\tuff.exe
  "C:\Users\Admin\Downloads\tuff.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:3248
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:5404
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:4628
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:3716
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:5036
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:4496
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:1588
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:2016
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:4904
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /q /k
    3⤵
    PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5100,i,8926110712779672596,5897174539241603192,524288 --field-trial-handle=2464,i,9023361745838563639,13525241219110320250,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:4788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2096

C:\Users\Admin\Downloads\tuff.exe
"C:\Users\Admin\Downloads\tuff.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /k
  2⤵
  PID:5024
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /k
  2⤵
  PID:3560
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /k
  2⤵
  PID:4284
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /k
  2⤵
  PID:5448
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /k
  2⤵
  PID:5552
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /k
  2⤵
  PID:1656
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /k
  2⤵
  PID:4724
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /k
  2⤵
  PID:6056
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /k
  2⤵
  PID:5264
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /k
  2⤵
  PID:1744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 94ce671fff24bc39d6dca1aacb6ca0bfff261eec8b6eb453503f99210541640c
MD5 2474cacd031cac848104ebf60cc1e34a
SHA1 b447d38deef3ccdf8d0afe408a44446aa0472473
SHA512 3e94ed5d8dbfb6e5836455c5c943f25533680fe27340acd9f692bf5068f4070b775c4ecf7ec1dd385925764b1367988b6cb8e0adc6e8074cda4b7fb54e302eb5
TLSH
T121E02BAAC929EC371DFE071890904743F65013972740453B7A3D830C8F74A3E4585C1D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 a52f2d0f3a07a9593a493e96bbbe092e2b0648a1c573ad9723df35a25da4df78
MD5 4c1b67c6023f7f11c495e80e4cc97587
SHA1 3cf3d940820e2dbdf4c5bd5e6749856eadf64e7c
SHA512 bc5f103c203b60b9d431b7de60aa476ccb8497c54390e1b06da0ccf1a4245a9a56cd49bb23a9684293ab26f975e9c8223a8c6b40168606550beb8640b4692721
TLSH
T1420155624958A6E3F360AE35AEC96DE0323A131C42038DFF60C141B3A80C3601A0579D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 67646163a56c88421a3e6afcca5ac90349d4dd3a81f73b8a7e6fa7541560deab
MD5 02d2117107373cc0c91f0ac04617b693
SHA1 d2c7ad38730759b63da128353141dd9636a56a37
SHA512 7ba32239b258e373bbbdb099315c8e9ce7615a11103eae85f3aa14ed63f43001991e7a7c9e159352cbf1cbfee2937069142a4af138f081d04920bb63b417b299
TLSH
T13451CBF783B4997E8A11A2E4EA106E2FCE6D0520032C3C6589D4AE1B53E3972D24038F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b92c449a1b2be782b66be0795fbbe2bc540aac1ce40be1d491983d7f71fdf9b7
MD5 209ded4d459d8c2659ff1d41e5ab997f
SHA1 5fe2a7e6c2e2de39a3a6bc2d69c84014e570942f
SHA512 7fe566460968f2992ed519cb4759e239ece4403df9401001ea56381ff5954c01d74758fad511d1f8153b4b614666e34b72e0c700ca714cca673472e36ebac99c
TLSH
T17B51CCF783F4857E8A11A2E4EA156E2FCE6D0524432C7C6589D49E1B53E3972D24078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8cf16c80656617e29ebdcdc2cf474b6049a76205ec755926e9469901807722ca
MD5 e2771812f79cdf955608b0e021467fa3
SHA1 1458bb9c10c1f57d030f603b2e6b2a388ac4ee41
SHA512 a8d3545c230a0ecec3a6d6e8505d5836454e0a9417dcbcd220433ea648e041647a483248e12172e1cd562eb1ca7914f50f8e1a5a58a4a23712d9bd7b86c7c157
SSDEEP 192:zRucqdfW3k8Cfqv7+Fp3J8jPRp2VlTE9hHsb+WNncVQJW2Ek2je8naEQ1VyIsnAC:zRuc6zm6FFeXLbwyL2N2raFe
TLSH
T17542A62AF914693B5CDBD219FA55BB57E7F6002170941E88E6FCCA2C16E75CD322301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 24a5e944093c42b7cfd949bea9efbfb3ee0c2812619d0065aa89098990f74999
MD5 a30405639cb8dfefc168f2e5deda637d
SHA1 139fbfea93b0a0e61781393fd1b0b4fe0a9ef6f4
SHA512 9798e1cf76e9a9d7349476cd685c5e911d6f2d00d93ce46b6c9888051f760a2aecbe7e333ae09c0381f73e34f29996ebf3b265f04a7e76cc32025435eb2a7c6e
SSDEEP 192:zRuc6dfW3k8Cfqv7+Fp3J8yPRpVVlTE9hHsb+WNncVQd6ebk2je8naEQuVyIsnAI:zRucKzm6FF9XSbwy/eo2raAE
TLSH
T1EA52B42AF9146D3B6CDAD619F955BB57E3F5002121941E88F6FC8B2C16E76CD222302B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 24e22310eacf07ada16476d0208699852100830b58e1006ec7f622c3546c171e
MD5 5552752ea12bc9089a195edf20355589
SHA1 2c9828d71b9e1fcb8640f78838ab3e5a9f8710c8
SHA512 70a74ef96141675459b8ac2600b67d259f337c142167bfb6d7f852ddfca2cd9cc40765512291590d19b5f32a61b24ee0ba16c91300578b185f20be17d0cd2d83
SSDEEP 192:zRuc6dfW3k8Cfwv7+Fp3J8yPRpVVlTE9hHsb+WNncVQbkYYQk2je8naEQuVyIsnv:zRucKzs6FF9XSbwy1YYp2raAE
TLSH
T11C52C52AF9146D3B6CDAD619F955BB17E3F5102121941E88FAFC8B2C16E75CD322302B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 af4ead09a3b0794a272629e8c8c55999cf11a6d915747690ad6a814a5578a5c2
MD5 85dfd746f9a5db88d67078e82d53849e
SHA1 dafafb6f3aa5cc6fe83ddba444943bd5b3291a0d
SHA512 1788f1233f3cb555f565c68a4d0ad4c1eeaad784a113e91b347269e2628ca27d2b870b79e28a6ea9d89531f18c53c3ad9227d171957832f27bf7fefe817017d8
TLSH
T196B012628001E991C04302F81182548C3298AF108F09130253E06D73A82B1914014370
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586ffb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586ffb.TMP
Size 96B
SHA256 7c3a682c4d54657e2c3e0241c248c49c42625d0d6a2cec6835b1b004ac070951
MD5 58c14f6b4fa2020dd54eb5ef311ba677
SHA1 4203899036457820063e2d030af5ebf52d98f962
SHA512 67c4e4cdd84ce76f60b79f127e1099eebd0e86b0ebd9c0edd40248c067f1dbf3e7a127860dbecd0d4a339b2ecca6dd53aa74b037ab681b3947918ad67c2b4867
TLSH
T14FB00276C6826612C04303F02D95A6ECF164FF25C603232792F02E67EC6577045755A4
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 f1b4593344d124c308184984847ed0fedba1df79ea100735570b9d5e7ece2554
MD5 0e2ee46195153a3275d3dec723a7ca24
SHA1 236a24ada309c89dd34b3328978840aae32a7284
SHA512 fa074311a325b86ebffc31d2fb19561cc2134e716c95b7fcceca7b651be668ebc1a1f72e57b5fc06af0ac76334c974a06e7e65c2c39bcd37b5b8b5177cf8b3a1
SSDEEP 1536:dGvwP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:A2++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T12C9312B9991E7C3563ABC6E6A0079CAD8CE3DCCE1514157C30C75F1E15EE392A30B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 8a80594ec32bc2591dc689c23aa87fc608a817352083cf273393bc1f0bb3ea6e
MD5 1ac94358b9a4815155e2d81c1b9f7d90
SHA1 d0f6c8a56f2113fb30b1dc995ff9bd78d833ce3f
SHA512 ecc302aca87d28d9c97b46aa5b8cd4c5794b44dc24386203f50b68139860e4d71260ba28172c7582ad77c31a67e984f2a821272abecd32c7aec7316ede482aff
SSDEEP 1536:tGwpTP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:npL++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T12B9312B9991E7D3563AAD6D690079CAD88D3CCCE1518257C30C76F0E14BA393E30B8B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 8ae914de41ddec49d087fba79f9155c37d1b06ac3e1b312928e38c38bbebeb9f
MD5 e3e66fe3e462bf275ad966efa18b362d
SHA1 dcd75292b4e2043a0bc0aa6062366ffc23f4ac73
SHA512 f98d8e0643b5df0e929731e9ad1f7fdb57bb7cc0ddba54533f944982e915ead2a11fa9aa724969c29045b99920c4a558e6c0709b9116b7ec501618e7605df5b9
SSDEEP 1536:dGwpTP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:XpL++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1C39302B9991E7D3523AAD6D690079CAD88D3CCCE1518257C30C75F1E14BA393E30B8B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 d83ee5743a25ec8d50391994cd561ea04fd6ca504232618cc5809dfde12b5a97
MD5 12966f7421fb2b648780b1422166c256
SHA1 85cb3f79c09c670ec7265a65710e8b31b84fb4d9
SHA512 ca706b1c61f7b6a32c05e9a40047a3864846f59e1c6b4f99993c79e57bdcf9b52a04e575e7a7ef20b494877f296589cc4cf1eced8e8b55b30da06a18b44169f4
SSDEEP 1536:eG853P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:K/++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1E49312B9991E7D35636AC6D690079DAC88E3DCCE1514117C30C7AB1E28BE393A30B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 83758750296bfeff22ecc916250b40976ac7f9d28d60fa7a6a05f101a47b7411
MD5 f2de74f71cb400e5fdc0fb944534c552
SHA1 aefad6b4ed565dfc15ee9ddc0e7bc82bf756f0d9
SHA512 6946cf8a3f11cb999909d7cd65dfd015ab9c367d33b82ebbe55d38a895355f9d3bf1d4aaa948adab33329c113e2c458bd14ac467ac8ec8f8252c18b437be64ad
SSDEEP 1536:+GvwP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:z2++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T15C9312B9991E7C3563ABC6E6A0079DAD8CE3DCCE1614117C30C75F1E15EE392A30B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tuff.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\tuff.exe:Zone.Identifier
Size 150B
SHA256 244f59bf14be11afc8ff4a18c36fe38454654cc0c627ec34d045d5ef834ef1cf
MD5 2c1cacec93217fc58deee1ca08922599
SHA1 57855a74f5592110e16e90257dbf553bdd81b3a3
SHA512 19a27703f73de266cc6e4da30c4ce01433ac672ea57985ffa0b79fb207ce25de17c9e9898324774f27060902d05a58eed0acf55bb2797a42e707ad7b151af89a
TLSH
T1C4C08C938800A44A030836D830E8A458B00B68848DAD8E44A400045F9C29828C3C4576
MD5 SHA1 SHA512 TLSH

Submit Download