67f899b7e141301574831a4368277e3459c6e16db3f7be27e7a26ef84d4a6a5d

Analysis

user interaction
yes
max time kernel
148s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
unins000.dat
Size 4KB
Sample260503-k44fbsev2x
SHA256 67f899b7e141301574831a4368277e3459c6e16db3f7be27e7a26ef84d4a6a5d
MD5 8a2e9eb931925aafd6c2daf5b93e3993
SHA1 876988d300fb59925ca2ae80115cb04bff2a7bb6
SHA512 6c235b7423de8d9fd7c8bed57a5669e648dad8b5ca21283c44dd2cfaa060ee75fd19cae61af551f7b4a4f26156622d516faac8d13fb245845ad6716cf076243e
SSDEEP 96:6T1XiEEMCmbcuJlIDA4MZAe2L5gC3CxCStCjCjCkMHhe+n:6T1yEEibPkDSmzH/n
TLSH
T1A4A15B01ABF8012DF3FBABB16B790E28267BBD005E36C11E4599838D0435912DF76323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
51	camo.githubusercontent.com
3	camo.githubusercontent.com
28	raw.githubusercontent.com
50	camo.githubusercontent.com

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5100	powercfg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4300	PowerShell.exe
5324	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1904	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222730398831386"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Win11Debloat-2026.04.26.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Get (1).ps1:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5324	powershell.exe
5324	powershell.exe
4300	PowerShell.exe
4300	PowerShell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3764	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe
Token: SeShutdownPrivilege	5256	chrome.exe
Token: SeCreatePagefilePrivilege	5256	chrome.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
236	WindowsTerminal.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe
5256	chrome.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
3420	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
3764	OpenWith.exe
236	WindowsTerminal.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 2168	5256	chrome.exe	82
PID 5256 wrote to memory of 1716	5256	chrome.exe	83
PID 5256 wrote to memory of 1716	5256	chrome.exe	83
PID 5256 wrote to memory of 1904	5256	chrome.exe	84
PID 5256 wrote to memory of 2420	5256	chrome.exe	85
PID 5256 wrote to memory of 2420	5256	chrome.exe	85
PID 5256 wrote to memory of 5348	5256	chrome.exe	87
PID 5256 wrote to memory of 5348	5256	chrome.exe	87
PID 5256 wrote to memory of 5912	5256	chrome.exe	88
PID 5256 wrote to memory of 5912	5256	chrome.exe	88
PID 5256 wrote to memory of 852	5256	chrome.exe	89
PID 5256 wrote to memory of 852	5256	chrome.exe	89
PID 5256 wrote to memory of 3096	5256	chrome.exe	91
PID 5256 wrote to memory of 3096	5256	chrome.exe	91
PID 5256 wrote to memory of 5568	5256	chrome.exe	92
PID 5256 wrote to memory of 5848	5256	chrome.exe	94
PID 5256 wrote to memory of 5848	5256	chrome.exe	94
PID 5256 wrote to memory of 3780	5256	chrome.exe	95
PID 5256 wrote to memory of 3780	5256	chrome.exe	95
PID 5256 wrote to memory of 2060	5256	chrome.exe	96
PID 5256 wrote to memory of 1912	5256	chrome.exe	97
PID 5256 wrote to memory of 2252	5256	chrome.exe	98
PID 5256 wrote to memory of 3252	5256	chrome.exe	99
PID 5256 wrote to memory of 4196	5256	chrome.exe	100
PID 428 wrote to memory of 5324	428	cmd.exe	106
PID 5324 wrote to memory of 332	5324	powershell.exe	107
PID 332 wrote to memory of 236	332	wt.exe	108
PID 236 wrote to memory of 1788	236	WindowsTerminal.exe	109
PID 236 wrote to memory of 1572	236	WindowsTerminal.exe	113
PID 236 wrote to memory of 4300	236	WindowsTerminal.exe	114
PID 4300 wrote to memory of 5100	4300	PowerShell.exe	115
PID 4300 wrote to memory of 488	4300	PowerShell.exe	116
PID 488 wrote to memory of 4772	488	csc.exe	117

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\unins000.dat
1⤵
- Modifies registry class
PID:4456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80f06c728,0x7ff80f06c734,0x7ff80f06c740
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,13403063913954604700,1022684284086069673,262144 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2272,i,74935431997354468,17404826710288289444,524288 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,467959803008288490,295368428452175762,524288 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2568 /prefetch:13
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,8144055973851326376,15476195506434384725,2097152 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,1522143603162500916,14483846896732793282,2097152 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,219695261990712486,10468125922031533536,2097152 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4008 /prefetch:9
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4632,i,13848919474010376631,8241395009191023083,2097152 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,14537841500842448665,9492229785693405373,524288 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5772,i,17937888628061871579,5972818878068589351,2097152 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3368,i,13814604863998236267,2843792979131777148,2097152 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,711686625263626044,16613389692667397246,524288 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3476 /prefetch:14
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,9848777165042501344,17435647386666238025,524288 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3576 /prefetch:14
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,1961952337917639982,15272541121729873293,524288 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3460 /prefetch:14
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,10778149136368284556,13823785373875746327,524288 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4388,i,9063500616914651497,5619058190557614886,524288 --field-trial-handle=1932,i,10380585961216638388,13435918426300442124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4404 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4792

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Win11Debloat-2026.04.26\Run.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\wt.exe' -ArgumentList 'PowerShell -NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\Desktop\Win11Debloat-2026.04.26\Win11Debloat.ps1""' -Verb RunAs"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
    "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\wt.exe" PowerShell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\Desktop\Win11Debloat-2026.04.26\Win11Debloat.ps1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
      wt.exe PowerShell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\Desktop\Win11Debloat-2026.04.26\Win11Debloat.ps1
      4⤵
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:236
    - - C:\Windows\system32\wsl.exe
        
        C:\Windows\system32\wsl.exe --list
        5⤵
        
        PID:1788
    - - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
        
        "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa08 --server 0xa04
        5⤵
        
        PID:1572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
        
        PowerShell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\Desktop\Win11Debloat-2026.04.26\Win11Debloat.ps1 "
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4300
      - C:\Windows\system32\powercfg.exe
        
        "C:\Windows\system32\powercfg.exe" /a
        6⤵
        Power Settings
        
        PID:5100
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ate3kogs\ate3kogs.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:488
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DBF.tmp" "c:\Users\Admin\AppData\Local\Temp\ate3kogs\CSC26B1391AE8E8419FAAB43850CB5B7E65.TMP"
        7⤵
        
        PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0999f5b6-30f0-4fbe-aebe-e728c6e94e67.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0999f5b6-30f0-4fbe-aebe-e728c6e94e67.tmp
Size 198KB
SHA256 73b3345e2e949955ba8800f901ac3e5a6669fe60c28e76f3dc95f15746c53312
MD5 c749b04302108dbd47cd829df0e113a9
SHA1 51dc6dfaa34c03b3ab404523c48857549d695116
SHA512 a4b7eee71024c77baa38cfa6741ec5178022bab48e68345688c60813f28ec7407a4dd3bc12c5f140897141ee43f15cc984037eaf8bc7fcfd23dfc040e8fc5e3d
SSDEEP 6144:/PRxx+5VwBbR6GoUGU6Yw++JjcMW2VcVL0:/5S5VyzoUGUIOMWS
TLSH
T1EB141272EE1B7E65836FC7B7750B8C548DD388C90600A778529A6F9A0DF87A383134B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2116da75bddd9f7a7fe48d52e5284ae90225e389f4fbd6c727bed53f5cc60e81
MD5 99bc40caa1f813c4bd2c653b548633a6
SHA1 f9b453899f028b054ee0160db206a92a12e6cd18
SHA512 72c92a360af4d8b34dd6d368d429e8814646143e531a95ea544a0d2bb1ef6bd64037a175ae0d4e2144919c6f1f374803fddb1e6fa03747d2603b066633edc2b5
TLSH
T13EE02BAAC925DC375CFE4B1D90905792F74013972B40552F7A3D920DCFB063E0189C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 da11dd5819356b171f3a1d3cc9118b3b5870d78c1261665622d257fa5a77b777
MD5 cd1fa4a8b66ac55eac714c92a632469e
SHA1 5f32d3e10df7ede5487b2b4cbc92cae3e9c03c49
SHA512 5e33e7ea676c6ab01491c6f577995612ad60e429feea513c1b15f541922bf5a7c85906704dc8b3e4f21f76cd5051febf458551d37a9818f67728b9eaf31babfe
TLSH
T19C51C79581D76E7BFF682DF2A9C0CD8A3C30803140271FC30299A27CA14B7F421B85E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0174a6069d7a095bf4a872d8d97b02f1b084af7dcb2b956f73322908f3489354
MD5 6c5ff8ed30b6492c4fc8908d67326301
SHA1 9d90774af66fba484709cb3e7f2a1483b28ffb1b
SHA512 5060e657e35213dc53efa4aed384f03fe6f268777aabe4726caf41b675bc52626cb8e8f38b1c4490d0ba964163c45f8025eea11e5b140d9e31be9d7f803274f7
TLSH
T1C481E89841B3AD67FF6829F168C1CE8A7D3040B54F232EC60298BE7C65077B721F85A5
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 036ad401cc0e9fd870966f23895f49fd7bda7ed813f3d53726e4de492a861ad4
MD5 fd137a260204f34d5c8fd1a63e2298b2
SHA1 013bf7a3f0a1da4831e75c94266b4c02763b388a
SHA512 0d0a5992acaf7a4b03f3b4da695062df67c7783db2ae45801044b10cf165e039ba34a03817221a24afdd3924d84761d8f7c894b53d5f79b72254894b45b61059
SSDEEP 3:MsEllllkEthXllkl2zEVZKu:/M/xT02z6Ku
TLSH
T1BC4404147FC10C45CD0150304011C3500370D4304711F74334D504135CC75C00F5C040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 68f9921b8abfe5dd6ba88b9c14002ec8dd51360a577894327f29611f000515bc
MD5 ca5be5bee3948f62a560928656c1f9a5
SHA1 22b1e3742d10d1c4dbb729ff0dab6bc666c3358f
SHA512 6474b86138519f6533e76c886c69ac66bfeabb6bccedecf9b8e5af66eb2d839dc0da64e8f41d6dce4294fd9a820df75367058e6c2dcf20c802b3711e7256f5b5
SSDEEP 192:Dp0C3mZmEmhhaIao6BQKraZGfHifrB6Hm9m2mmmXmDmzmgS:Dp0C3mZmEmhhaIao6BQKraZeHSrB6Hm9
TLSH
T160E19BF783E4862D8A5156F4AB14AF1FCE290A24431C3C6688E4AF5B93F2872D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 7d75ff47adbd869a8f479792c146a8a641e3f35f0a50958fd3ab6669d2917dcf
MD5 68e9f1df9b5b65454837176d28c64b21
SHA1 579fa0351fbdeebc4536e876f907f6205f4daf40
SHA512 49b32711c2011adc8c12717528bb6886bb168a44d9903cfaed4aa69d1f4329eb3dcd67c0dd9cc742492acecbbc0bac0b2946b0d93d26e6cf8b0754f320e738f5
TLSH
T134319B97CBBE785B207D08BB1C09795A2DB9A832018169F0DBA7C03CA0E64F70B15C76
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 a0e2b22300349ca9d08364e805acb1656b76655d164feff28f46ab42734d4466
MD5 8766cbade004788a759647960977995a
SHA1 5e424c74b2eaad9c9c3ac746a90cbe3290262e8c
SHA512 077deb39b3a508ab9ecd0930e3085007b347e94a2afb5d8704dc97d6dd64f363fc12e09fba11c95be2166a83d718ee85366f60d19db19842b49d0d10463c4748
SSDEEP 192:XR3cBzKPzbH7tZv7+FhjPRpLcUO4M9hHsb+WNP32qvAw+ZANc23VykwNVgD+VyI6:XR3mzKrbZ56F5XUbwnre2FytO2e
TLSH
T10062D76BE9502A779CDAD229FA11B727E3F1203161901E8CE7FC8A1C15EB9DD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 68d347290207895e9e18ff7b5177ef5fa362eb67c4ce5fec8bfbc49360832547
MD5 a6fe1b2736ae1b864d4ca642b2da6ecd
SHA1 3622cf92bc78df4311335337c5d7a82331cbba3f
SHA512 7892959f46d8a7d1939820a7f307de809f53ed5559b8af658574dadfa05bfb506cd8256958de23ccac2fea33bf48e5a7f4197698018d03d301435c0c546e1de9
SSDEEP 192:XR3cBziPzbH7tvv7+FhAPRp2kKM9hHsb+WNn2q4ZANc2w+VykwNVgW+VyIsnAUg8:XR3mzirbZn6F8Xdbw/k2Rytp28
TLSH
T19352C66BFA5429379CDAD229FE117717E7F2203161841E88E6FC8A1C15EB9CD722701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a7d70f773640ef7d30996158f76c97aded624472c44afc958c121ff66aff3b36
MD5 3bd624c6c65542de5b8d0774d1d04aad
SHA1 6c6aa23595063085637b595508b94461c39fbca1
SHA512 bb75762dc0393d8b4fdfc0ee36e1869f15b0d72ad6f6a2925b97ffb5f24feb886d3e925289784cf2ad4fefef6555e97b0619f1bba8d88012ec1aca4724f7454d
SSDEEP 192:XR3cBziPzbH7trv7+FhAPRp2cUO8M9hHsb+WNP32q4ZANc2w8VykwNVgx+VyIsnB:XR3mzirbZT6F8Xlbwnk2Jyty2e
TLSH
T1A552D76BF95029779CDAD229FA11B727E7F1203161841E8CE6FC8A1C15EB9DD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 56aa66eb0ea02ad829607eea525d0f1251290bb81d159bfb3805b72213cce9ad
MD5 ff51e96961f04492d7f4264bd6bf7be5
SHA1 600fbe67962bbf0a36ff1a2ce7b5cb1c8501ed97
SHA512 7cdad11a8357bdea648baea393200211a0b811f949414d48975fb4fe12e55fffcedb5724e8a7f66fd5a9f277e30133142aab5d9aabe55a19c16064bc03a7519b
SSDEEP 192:XR3cBziPzbH7tZv7+FhAPRp2cUO4M9hHsb+WNP32qvq++ZANc2XVykwNVgx+VyI6:XR3mzirbZ56F8Xhbwnve2lyty2e
TLSH
T16352D76BF9502A779CDAD229FA11B72BE7F1203161841E8CE6FC8A1C15E79DD321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cb174df848073b2d090617db37e49d7280126a870e340fe4239c7d07060118e0
MD5 dc02c1e959489963f55c5aa5e7e01096
SHA1 ec78f087cd00bbce53cf1256f587750cdad9602c
SHA512 788886213a7107190e517de466d376c9d7b1058e919cf93a2cccc895f30059395e93f6b851a324151547ff58bb2f51cfe80b0bca74fe889b24eba720117e0621
SSDEEP 192:XR3cBz7PzbH7tZv7+FhjPRpLcUO4M9hHsb+WNP32qvDIEc/ZANc2ksVykwNVgD+M:XR3mz7rbZ56F5XUbwnLzc2kAytO2e
TLSH
T15A62D76BE95029779CDAD229FA11B727E7F1203161C01E8CE6FC8A1C15EB9DE321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 616b20d8fdf8fbf22878f91edcf25547a92453c592e8280b99e3766708718550
MD5 e14a44b032bff16ebf58db038d99e3ad
SHA1 eb8e04affd533be517c95d864a343c5e8d76ce73
SHA512 937fab1b3e762131f46e511a95d4af3c73f6ab9a6b6f54435e169fec8c1053f8b20aa57e5581b408aeaf15b56f1031819dd2c5537e0f039093cf7357b7d3ab90
TLSH
T16CB01260C0056541C94342F8228304DC3114DF108706230153F0E971D8261904034261
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589af3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589af3.TMP
Size 96B
SHA256 830f6b5edf2620712643699bcf90f263276b0ff51ddf5320d52b51b27a2756b8
MD5 9a8666ff67a43c6d7352f658f5f1dc2d
SHA1 1b6a9769de7f8a84ccc0021d52115abea0c57286
SHA512 51dc2df671380ffec2cb369962e9539de27a14090e13d75252ddc5ef86ca46d87b4e56babacc3a821cc70aacf81946c379790e8082b8f0bfb3c6ca612511e3e2
TLSH
T176B02202C082B203C00303B02AA0C8E830A0CF22CA03022EC2E30A32CC203228033020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 b6e3c733af85216593bfef608c6c73a3413f4187f27b460e49ec184e08b5abd9
MD5 89fc4f37cae1735f50c0cbee8bd98946
SHA1 d380703bedb91c6ccec4ab72f70ce8afe45f6432
SHA512 0c191bc76c0ab34cb65be35787ce202d2c68adaf03021b638be4c2211630089a3589ace14bc3c739c718a2dcfac21eda0974bb1d6eea1d713af893038ee73316
TLSH
T154A00211C3401006E15546F225870744A2595890074A0351B4D00088FD641488111044
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 d52141f5b96c11598df52014878b5bfe4e76e06ca10f4cf658af05e0df90e1eb
MD5 6052c414312d1fb85fa0b24c7bf77738
SHA1 4e2c874a961421d50f088cae4a8e0ea445bfd752
SHA512 1755f2dcc2f7b1fb4fb925f3c90645e3c1779f2d362b4158ab11683d87147fb234746b5dbfac50c5f49d1d97082959ccebfc2e7e3037dc6494cc5601039d09c1
SSDEEP 6144:Mv/Rxx+5VwBbR6GoUGU6Yw++JjcMW2VcVL0:MhS5VyzoUGUIOMWS
TLSH
T108141373AE1B7DA5436BCAF6750B8C548CD7C8CE0A00A76C51996F8A0DB87A3C7135B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 45fa93fbb14c4156ee7d2eb71b88c7d20a9b19d669f41786c2e5fc7bf0126e8a
MD5 8f07bb116c7aa5807e39ffbe909fb10e
SHA1 f953a9bd97274d62175be8f77052fce33d37e370
SHA512 aba5841524509a0629082770596ad5ae954ab5e4e3e70c6b84381d57df20a5688376b2f596c2c0369a0e04678397960d57f2ccb8b61b5afaaf4de22a78e0a17d
SSDEEP 1536:eGQ/fP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:An++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1069302B9991E7D75636AC6D690079CAC8CE3DCCE1514117C30C7AB1E28BE393A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 69372bf8e1539acca1126daa11e8fe0ae5a48430093ff40642b69a8328f7964b
MD5 4468cce1cb79f280acafd67dc6e7a4dc
SHA1 0538fcd606c7f8d779d9e2f9736bc2ea1268406b
SHA512 e7aa09b254b1b2d17e6a874c1d722a2c4d6b63455beb5ec91aaef94d73d8cf19fc779a98b27c6d8948ec8002f4b59711a08058259724226c17a6577d16091266
SSDEEP 6144:ePRxx+5VwBbR6GoUGU6Yw++JjcMW2VcVL0:e5S5VyzoUGUIOMWS
TLSH
T1AF141272EE1B7E65836FC7B7750B8C548DD388C90600A778529A6F9A0DF87A383134B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 d7c628cec879efe2aaa408a2fc6d6e15f4ed1a7734d4606d52d56c451773fc59
MD5 d153353d776cce324b61c0f8663cf48f
SHA1 4aab90c5081cd3fa19c20193a0707960974f7887
SHA512 46765a9670171af243f6db2a2e3b7cbc8a75581507afcc3988fe6cc835fc850e43e264f13732f009078d0ae039be970668764d08115d1f196834b58854761dd4
SSDEEP 6144:irSRxx+5VwBbR6GoUGU6Yw++JjcMW2VcVL0:iIS5VyzoUGUIOMWS
TLSH
T144141373AE1B7DA5436BCAF6750A8C548CD7C8CE0A00A76C51996F8A0DB47A7C7134B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PowerShell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3a3dd2d4bdfc17d64262f4dc86ceb242ecf743f2da0412eb60074557a741a5eb
MD5 d6b84d4be64de661c778642e3a7f6ff7
SHA1 714900a833208d39d6a4d0a96c671372dc5a12dd
SHA512 7fb33a924af54810bb8c69a0c4a126b1ba6ade4944f098ab8334c0a6c8fee91c7d8e25465c79deed6f6f7fe2000366831f801691dd950051a37c850722907c77
TLSH
T108115333B79CC235C8E915BA1088AE11B1B5C3C7049EDE8F7A84C109E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

RES6DBF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6DBF.tmp
Size 1KB
SHA256 af76ac1b0f91eee7605b60a51ff03525d3336828a9eea5fda74fcc4a94b4d930
MD5 28b383656b09362a95803a03b01cd857
SHA1 a39a51f8cecf815fe69bb3f20e98b7aaf0c1ede9
SHA512 a539037521a552ae19b271411f247d1f80b33b049c8edaef9d4042f4be9a8c4cbba57cbaa53a72313ca08afae15cd7e0c8d2895bd65b76dba9042260bc8da077
TLSH
T1C621890593E8472FF0735B31B9F6032FA164FE65EF62935B894052282C40914DFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xxfeweow.u1l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xxfeweow.u1l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ate3kogs.dll

Path C:\Users\Admin\AppData\Local\Temp\ate3kogs\ate3kogs.dll
Size 4KB
SHA256 ca053bc8381bd04bf29e4848520f6c1e5918f851d33a45671a78f13723c3a16c
MD5 83bdbca12dcc976e9fbcbf71d688d04c
SHA1 7216499ec15433f098b4874db96ec7ab5fd9bbdc
SHA512 ef2164e801dddea1e464743211b2d88c4c4abcaaa86596b73a964830de6f867b1848971ed93ebd23ed99f572e89367617fcf4084d4215d4fd96ab9bfaf46bf14
SSDEEP 48:6LkAg5HkoailbSWjcYHlCPKCybEZr56xfTjB1JrKD6CMRM5MkIHgyp1ul5a3lq:y+5HkoailbSWjHFCJYKFwBgyirK
TLSH
T119919646A7E81936E07F873A58B303132778F5105F22EB2F1D88A17E6C153742A25775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Get (1).ps1:Zone.Identifier

Path C:\Users\Admin\Downloads\Get (1).ps1:Zone.Identifier
Size 1011B
SHA256 ce76c1e46374fcf96def1a3430e03d86116a522bca9e82ea5b88805e413ba9a2
MD5 c8affc59c9ffdc6efb2b9d4c3e3e8bd6
SHA1 deda101338e134a43c3b7e0ea7df4a7162547826
SHA512 01e8d941d928602dee2edc15217def228368f55e179dd5183db2fcc1415bad9e096c589c085d0a947e01312cf72d9d70654ff06a02d223f43d9d8543b6e9d7e5
TLSH
T12F1161F3D0298A9F2B0A79A2DA9D1CAE6027B1E9C943074C5029C00EE4C02BA90DA537
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 860495.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 860495.crdownload
Size 8KB
SHA256 114d9366a0e572208cb98a18efbde18ab31ca1bac2cd4dd1948dbcd2066fdd5a
MD5 d8bd457f775d9765e769f33ca833e778
SHA1 50e19aa4f4f7d8b5fdc4cda450397363e71f69a0
SHA512 ddc1359c40ad17c544579b2032ba9ee76777b2283b18e2dd84798b76c5d2cf82d16926bf0e87851f4f2fad98cbb7f0d1e7306b4477b5584da6433256b4d305b4
SSDEEP 96:Do51hmPcDzEic++kNVtiXYaA41Xz69PxX/+u3EqSZysi3NriA6puXmJQ:Dw00DzEivTaA40NZ/+SPSQp9GPuXmJQ
TLSH
T10E02B6B06C111C1AC7B2C2679D945119FA9C02BB944E0536BABB487CAF314DE4D9D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Win11Debloat-2026.04.26.zip

Path C:\Users\Admin\Downloads\Win11Debloat-2026.04.26.zip
Size 304KB
SHA256 ae3e7ddf6c4e8f02978de4f4f737df8fdb2dac464d8ba9d7b6339779fcee4cf7
MD5 2c5d13e9a8e0e3be5840673baaaa1fe1
SHA1 fcc607a9993d1b994386186b3b850912f9fd7d66
SHA512 1b19ffab45529af1d980bc984c0f02266c5a2f451ba727cb969df84eb2524d5b4f84a67f607b400d8f486df30ec53730bfe992a987413758a2b3026a32f55011
SSDEEP 6144:KQfoKXAf8R0KQxJiEHOMnKuA8qPGrtHHTFK1Wo+:KQffnzQiEHO/8TrtHHTOu
TLSH
T14C646BF00CA058C6F636D0F70B0C94BA8B11E5D86295667E6BBC7035FE0661A1EBC5F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Win11Debloat-2026.04.26.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Win11Debloat-2026.04.26.zip:Zone.Identifier
Size 103B
SHA256 ac3deb01cb9670635a378e8b205c46a8109917c4ee08f48243551bbc8117acca
MD5 0d2ad0f3c17aac89dcc122061c94e61f
SHA1 7f1e58a9d6903b0152155ffca70cc15a97559b1e
SHA512 922c4dde5e8dd01006783402e0b2f32424aebab4d3419163c6969c6d7444de9f02979788198bf52a95b2838fc3fa68f3947f127ba770aa130a03c5f7cbac2352
TLSH
T150B012E3448055B80B00F6A04BDD5119B01762BDCE61419CFC6000D6E84003946EE537
MD5 SHA1 SHA512 TLSH

Submit Download

CSC26B1391AE8E8419FAAB43850CB5B7E65.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ate3kogs\CSC26B1391AE8E8419FAAB43850CB5B7E65.TMP
Size 652B
SHA256 7fbe7aa9aef4ce6ba1ee52d316ff892638dc140b1f47a033198b5010f3f0d655
MD5 16b1122cb7124dc07a6cc0b484315404
SHA1 c232a0eb5e69f08a66c898c079567b1cb7ceae66
SHA512 9e6211bc1d7e3a9e26beb29c648923fb66dc48665190bbb6c78d35cad364eee9a764a2d0d9c0187dfbcf482fd3fabbdb81f2cb2035765e125e520f65a344baea
TLSH
T14CF03A4A63F8125EF4F34B30F9F6436391A8BC65DE3293ED1540536D28649208A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ate3kogs.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ate3kogs\ate3kogs.0.cs
Size 3KB
SHA256 6d3a0eb0ec4b97954fc5643dc386d97b52fc82c76119c02cbf35ddaec33d1088
MD5 94ab6b9a8a1db67737c057d3cc56844c
SHA1 7a34de1be199071712735bb55e0588f6f6fb403b
SHA512 7f632e929fad1d015c34452325df2af33956fa67e64ebdd6f4a8c7d1364850ce57a0e1dfc9b82cd36a7f30ff9c8cac8792a3ab0bc02103f5f7a4a6d78af6123b
TLSH
T169616A2C95CB886A0057702A9EE7A1C05A3F422F349EFD11B6CEB165CFDB7441235B74
MD5 SHA1 SHA512 TLSH

Submit Download

ate3kogs.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ate3kogs\ate3kogs.cmdline
Size 734B
SHA256 9f97f7ff55e93d4a46a35cfc81ac7cd27061e91cd016de20ef2f77616dae6bcb
MD5 2af3a0b256574d4466a8028234eb4a68
SHA1 8d345a542a2f6b3b2e7e4d6d23915e7ec7dc431c
SHA512 d67044b6d736eb24050ef018f08fd882ce750720dd423eaad2de090e0c31e2191f94a63d7992093d36be9918290ffdcea1713e4de1ac7876411f5bd55e797aab
TLSH
T1F901C039023BC6BE86FA3443156F899CD133075F34869F587588885FF5634411F51BAA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-903-0x000001B4B7800000-0x000001B4B7920000-memory.dmp

Download

memory/488-897-0x000002069CBC0000-0x000002069CBCC000-memory.dmp

Download

memory/1572-904-0x00000160BEE00000-0x00000160BEF20000-memory.dmp

Download

memory/3420-1-0x000001A61FAF0000-0x000001A61FBDA000-memory.dmp

Download

memory/3764-716-0x000001E38AD60000-0x000001E38AE4A000-memory.dmp

Download

memory/4300-899-0x0000026542E80000-0x0000026542E88000-memory.dmp

Download

memory/4300-900-0x0000026543620000-0x0000026543628000-memory.dmp

Download

memory/4300-879-0x00000265434C0000-0x00000265434DC000-memory.dmp

Download

memory/4300-880-0x00000265434B0000-0x00000265434BA000-memory.dmp

Download

memory/4300-881-0x0000026543500000-0x000002654351A000-memory.dmp

Download

memory/4300-882-0x00000265434E0000-0x00000265434E8000-memory.dmp

Download

memory/4300-883-0x00000265434F0000-0x00000265434F6000-memory.dmp

Download

memory/4300-884-0x0000026543520000-0x000002654352A000-memory.dmp

Download

memory/4300-905-0x000002652A630000-0x000002652A63C000-memory.dmp

Download

memory/4300-907-0x000002652AAB0000-0x000002652AAC2000-memory.dmp

Download

memory/4300-871-0x0000026543660000-0x0000026543822000-memory.dmp

Download

memory/4300-906-0x0000026542D60000-0x0000026542E4A000-memory.dmp

Download

memory/4300-870-0x0000026543250000-0x000002654325A000-memory.dmp

Download

memory/4300-869-0x0000026543280000-0x0000026543333000-memory.dmp

Download

memory/4300-868-0x0000026543260000-0x000002654327C000-memory.dmp

Download

memory/4300-902-0x0000026543630000-0x000002654363E000-memory.dmp

Download

memory/4300-872-0x0000026543D60000-0x0000026544288000-memory.dmp

Download

memory/4300-901-0x0000026543870000-0x00000265438A8000-memory.dmp

Download

memory/4456-0-0x00000260781D0000-0x00000260782BA000-memory.dmp

Download

memory/4772-894-0x0000022887170000-0x000002288717C000-memory.dmp

Download

memory/5324-847-0x000002A6B71A0000-0x000002A6B728A000-memory.dmp

Download

memory/5324-836-0x000002A6B7460000-0x000002A6B7482000-memory.dmp

Download

memory/5324-846-0x000002A69D450000-0x000002A69D45C000-memory.dmp

Download

memory/5324-848-0x000002A6B73A0000-0x000002A6B73B2000-memory.dmp

Download