f6c9f66e5d0b82b8a89ade0496b0f05c3553b045460f101aba77fb81a3c1a1a0

Analysis

user interaction
yes
max time kernel
95s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/05/2026, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
udp.py
Size 1KB
Sample260510-sfwpksax71
SHA256 f6c9f66e5d0b82b8a89ade0496b0f05c3553b045460f101aba77fb81a3c1a1a0
MD5 e1797b93fcbc65148af664c14db9c927
SHA1 83555cc72e72ce9029db38ef887fe0f425429ae0
SHA512 91d43ab182544f5b11361111ac1cb5adab38680150d88e7f8a015675b3bd2ab3f16f969a6b87368a955388e9d61f4c8bc6c778bc13f6dc28a88d29d843add969
TLSH
T14A21DD81DDBC40E5E3B3047645E610913727A0171B01882CF6FDE7602F1E036A785ED7
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
57	6056	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
5860	spoofer.exe
6108	spoofer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	pastebin.com
31	pastebin.com
64	pastebin.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\spoofer.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6056	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2400	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134228990900907913"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\spoofer.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	5076	chrome.exe
Token: SeCreatePagefilePrivilege	5076	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
448	OpenWith.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 5040	5076	chrome.exe	81
PID 5076 wrote to memory of 752	5076	chrome.exe	82
PID 5076 wrote to memory of 752	5076	chrome.exe	82
PID 5076 wrote to memory of 6056	5076	chrome.exe	83
PID 5076 wrote to memory of 5456	5076	chrome.exe	84
PID 5076 wrote to memory of 5456	5076	chrome.exe	84
PID 5076 wrote to memory of 5496	5076	chrome.exe	85
PID 5076 wrote to memory of 5496	5076	chrome.exe	85
PID 5076 wrote to memory of 2244	5076	chrome.exe	86
PID 5076 wrote to memory of 2244	5076	chrome.exe	86
PID 5076 wrote to memory of 5940	5076	chrome.exe	87
PID 5076 wrote to memory of 5940	5076	chrome.exe	87
PID 5076 wrote to memory of 3180	5076	chrome.exe	90
PID 5076 wrote to memory of 3180	5076	chrome.exe	90
PID 5076 wrote to memory of 2728	5076	chrome.exe	91
PID 5076 wrote to memory of 4672	5076	chrome.exe	93
PID 5076 wrote to memory of 3784	5076	chrome.exe	94
PID 5076 wrote to memory of 4424	5076	chrome.exe	95
PID 5076 wrote to memory of 2876	5076	chrome.exe	96
PID 5076 wrote to memory of 2876	5076	chrome.exe	96
PID 5076 wrote to memory of 884	5076	chrome.exe	97
PID 5076 wrote to memory of 884	5076	chrome.exe	97
PID 5076 wrote to memory of 5412	5076	chrome.exe	98
PID 5076 wrote to memory of 5412	5076	chrome.exe	98
PID 5076 wrote to memory of 3220	5076	chrome.exe	99
PID 5076 wrote to memory of 2004	5076	chrome.exe	100
PID 5076 wrote to memory of 4528	5076	chrome.exe	101
PID 5076 wrote to memory of 2004	5076	chrome.exe	100
PID 5076 wrote to memory of 4528	5076	chrome.exe	101
PID 5076 wrote to memory of 5860	5076	chrome.exe	102
PID 5860 wrote to memory of 3540	5860	spoofer.exe	104
PID 5860 wrote to memory of 1892	5860	spoofer.exe	105
PID 1892 wrote to memory of 5892	1892	cmd.exe	106
PID 1892 wrote to memory of 1744	1892	cmd.exe	107
PID 1892 wrote to memory of 3356	1892	cmd.exe	108
PID 5076 wrote to memory of 4744	5076	chrome.exe	109
PID 5076 wrote to memory of 4744	5076	chrome.exe	109
PID 5076 wrote to memory of 6024	5076	chrome.exe	110
PID 5076 wrote to memory of 6024	5076	chrome.exe	110
PID 5076 wrote to memory of 4692	5076	chrome.exe	111
PID 5076 wrote to memory of 4692	5076	chrome.exe	111
PID 5076 wrote to memory of 3744	5076	chrome.exe	112
PID 5076 wrote to memory of 3744	5076	chrome.exe	112
PID 5860 wrote to memory of 2728	5860	spoofer.exe	115
PID 2728 wrote to memory of 4284	2728	cmd.exe	116
PID 4284 wrote to memory of 2400	4284	cmd.exe	120
PID 6108 wrote to memory of 2232	6108	spoofer.exe	124
PID 6108 wrote to memory of 3784	6108	spoofer.exe	125
PID 3784 wrote to memory of 5844	3784	cmd.exe	126
PID 3784 wrote to memory of 5608	3784	cmd.exe	127
PID 3784 wrote to memory of 6052	3784	cmd.exe	128

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\udp.py
1⤵
- Modifies registry class
PID:2464

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa06cec728,0x7ffa06cec734,0x7ffa06cec740
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,6141970147231159416,11541575370684423948,262144 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,2356441602277366891,1429846273813016125,524288 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2288 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,9898207401684385624,9627267067443602177,524288 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2544 /prefetch:13
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,16241399514905761237,2796989305333101768,2097152 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2596,i,14910140949935126664,14792941231645186441,2097152 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4192,i,9183592154261496693,12710515710250111814,2097152 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4204 /prefetch:9
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,14938046089648999975,7783534715750374937,2097152 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,15411680337759133369,6275679463473788930,524288 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,135948733641246067,12289769933813235661,524288 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,2247140749548123732,4421416960333810810,524288 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,8406445999643123693,8481821996807741889,524288 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4204,i,17922598981688789418,13935669827500987168,2097152 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4772,i,780087100178366796,11969116855620202252,2097152 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4488,i,4172879800323104189,5105524587523489272,2097152 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3200,i,9260972863961789375,15562232037515595928,524288 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4220 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,12757868957620162541,8102110877526348757,524288 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,10457798086714381834,1057985521084418758,524288 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3520 /prefetch:14
  2⤵
  PID:4528
- C:\Users\Admin\Downloads\spoofer.exe
  "C:\Users\Admin\Downloads\spoofer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title 40fps.spoofer
    3⤵
    PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Downloads\spoofer.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\Windows\system32\certutil.exe
      certutil -hashfile "C:\Users\Admin\Downloads\spoofer.exe" MD5
      4⤵
      PID:5892
  - - C:\Windows\system32\find.exe
      find /i /v "md5"
      4⤵
      PID:1744
  - - C:\Windows\system32\find.exe
      find /i /v "certutil"
      4⤵
      PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\system32\cmd.exe
      cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5904,i,15662756402475787654,10391137146946850259,2097152 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4740,i,1069560528699004196,3632821127726027444,2097152 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6084,i,11942201199554451825,4629913879639432546,2097152 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6296,i,13975244639921769650,7124057250155094432,2097152 --field-trial-handle=1908,i,8309654893653902438,10374335110654955171,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:3744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3668

C:\Users\Admin\Downloads\spoofer.exe
"C:\Users\Admin\Downloads\spoofer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title 40fps.spoofer
  2⤵
  PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Downloads\spoofer.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\Downloads\spoofer.exe" MD5
    3⤵
    PID:5844
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:5608
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:6052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 227a0f700705d8217ca5f8d2fda584fec6910a93e1e7ee7b81176711e203a8df
MD5 3ea19dac2526938036397adc278d78c0
SHA1 adb0f11c95ae032ef687002936b53b04b50fee9f
SHA512 f5a47ed13460762fe8b33e3a926f4a890cf35e12d5687ede5d11b72f9879f31d30e32b4bea1e72492b116277fe65dfc6487d9c1574a184f5f5a1cfbf5d860842
TLSH
T10DE02BA6CE66D93708FD0B2830500341E74403571740955F7B3E870E4FB1A3E455582C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 5e5b2e4047b1022d5ac75b2f960def15bb836ac025da25da7441a0277704179c
MD5 4ff2430a79cc502023852f48bc78291a
SHA1 4dde17ab4df183df4431784463c32b67042a237c
SHA512 6bc64d9631b37c1936140b63ffaa61da9140e373ac9cc7e16a54ac9858ea672011633d68e0233e82f46618b8fc4a566588be0534b26272e01906ae0b89b127b4
TLSH
T15BF0D894D86D4486E763767508A00D157B341E995493398B45B8383D3CB1BD674023C5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 1a210597fff918479cc521801ce6a425a5a4807da68f6aac1bdfa0ca512b3b40
MD5 1b705682a05eb01addfbff2eb3c0819d
SHA1 0062b5c57e38c2e3ea43d36cb3abaa6c9cb15bdc
SHA512 486ff5a33f41563f5e29350d84f2fff327841d42f7c086e4f281c39b127d93f488efbb3edaadafe865ffdf4a1fc41e53572bf8cc77d306f30810d61cadd4ab33
SSDEEP 96:D7zirO42aIatP5dJ4jsk/ka8KD+j9RpD/1bu:D7zsO42aIatP5dJ4jssB8s+j9Rpr1y
TLSH
T10DB18FB3C3E48D7DC91151F5EB162E1FCE690924536C3D6AC8D4AF1B57E6872E20068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 be286aae618d6e0c3f8fa43c82faaa772c4a1afb8a969fd0d5bf8a9a584aa315
MD5 c753a904e0d5141e30fc5e62fd497b4c
SHA1 8cebe856f90881d48650b52a84d469a94fa4e179
SHA512 4e17b39ea8ec14b40ec8aeefd2687446bd6aef4aac179799ff9af9f13eb96166597d0500d06921d582aa46b7ae689650e4b5adc8d9b3d7e11bba4197480a703d
SSDEEP 192:33RCs327lBqev7ghAPRp2B99Hsb+WNndx10PXBpakwcEloVyIsnAUgtaJ:33RCs3Has8Xq/wl0fBpaVlM8
TLSH
T16242D72EBA18753B9CDBD22AFD117717E7F5102220952E98E6FC891C09D79CD312301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0b7a343bfedaca6ff95563bcc194333668a31d79b9c753b54190095425444a5c
MD5 0001363207364164bbf0757d0a06d58a
SHA1 dc73c99f54b843c21b7f76b2922d166222dadf13
SHA512 b73d69e3ead75efa23c8fae9b5ced47ea31c486c0b9a730de66265df8274fa7617fdd470be3e2f0f2f4abedf80a13185715980ab49b7f538486dc7e020279651
SSDEEP 192:33Rvs127lBSYv7ghtPRpFMv99Hsb+WNndx1wLh2DXBpakwcyloVyIsnAUgraJ:33Rvs1HEsjXo/wli2jBpahlMe
TLSH
T19C52E82EF918753B9CDBD22AF9117B57E7F1102221952E98E6FC8A1C19E79CD321301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 231d6da69787b9f56b5c0604c53dd52a442d63c403c50c44772370fa1982cead
MD5 d6d00dd3143bc269fdf90eb127c64d55
SHA1 1e36fd1e3eece77127089ab88da0e568e960952c
SHA512 d8b03ae82a909816ff46bb872dfb1fd9159a47ba155c017e1b7ed482c449a9c5c58c58770b967167d495d852fa3ab3371ac88aa31530c9cd162ab5872104e63d
SSDEEP 192:33RCs127lBSYv7ghAPRp2Mv99Hsb+WNndx1wLh2sXBpakwcGloVyIsnAUgraJ:33RCs1HEs8X//wli2SBpaHlMe
TLSH
T11A52E82EFA18753B9CDBD21AF9117757E7F1102221852E98EAFC8A1C19E79CD321301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82085f58435b7b7a260780dca3ee69a48427de11b3ece82d53af0d56f36fd555
MD5 92547e8f34c99d1b69c0e1d957604d80
SHA1 4ca5a2d93853b96b7fc565a0e16045bbcee47e58
SHA512 aee9857bb3f81b98b9310e49ebca2773ad80f91201f0efac2260b404123571baef569acba1d144b7aa20664020dd07820f3547f4604d3bc6c7d155025f48eb07
SSDEEP 384:V3jBM7KxkXqKf/pUZNCgVLH2HfgslQwl7pLuLcifTuXODBU+ErU3bwxHGak5Je0o:VTBM7KxkXqKf/pUZNCgVLH2Hfgsi87pL
TLSH
T1DE72FA67AC4CAA370F94D6CCD827BE4FADB5020B65DD886883FA581903D5ADF110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4ad9421d41ab142568006ee7fb17fe00837accfb98c252b54d0aa5af7b8bb33a
MD5 4e789b871223e62932a189a184bbede7
SHA1 57fcb61b7bab3b0c3134e5e611047c66710e0d06
SHA512 4d140db9c8b2650f096257b20906d4102a336b50eade70731b746c70d67bfa6ec9899639a6526abf119549a563b8e6f23d9c786e65c71d0be9bb2e787e592046
TLSH
T172B0121080015D01C04303F82182088833286F308706271153E47972D82A1A18019162
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584699.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584699.TMP
Size 96B
SHA256 84d546491d2c535f27d26c613c554f6cca4ede978f52524d8da842cc15168130
MD5 a25584b53d540ba4d3cd4f6a313a7f70
SHA1 c77fb8b199c1052dcbddf596ec674c9858188f97
SHA512 2fa4caa37fc8023b347ea2661aa00824937d6b4b4fd629784afc7d5395a6b0dc38e8933b6165b39638ae03f036635a9f99d4ec4d03d2fb55eed5e6d567b28d50
TLSH
T1BBB00296C106B712C04303B52AA597E8B170EF25C653531F92E29EA6ECA66B18626164
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 33152f52024dee7d5e126240fd987568d89b6ac18132f9d49b342d0b1446027f
MD5 561ca691a02900d98cd85424935e2032
SHA1 565ec016dc5279641da92d0f724fa8db252c492d
SHA512 691babe2bc8dafabfe29870060055fa636eb9176024e843d384975aacf72642da4e7c2148f263ca9343390c7116673783e9eaa8bd3164352d798b5647a358e83
TLSH
T1B8A002709A783335D51142782AE20A50631189250B17070680E400888CE97428601617
MD5 SHA1 SHA512 TLSH

Submit Download

b3e829e5-75a7-419a-ab31-805773588e17.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b3e829e5-75a7-419a-ab31-805773588e17.tmp
Size 12KB
SHA256 f1da0f3793f5808b71578485608038831fc5561c9ed34f88d052c558946e438c
MD5 09e252969dd60ecb7543b8c370c7cdc9
SHA1 57409571838929502a9d762ddcdbbf5c1f78ee3a
SHA512 d313ed24c5a82860057f8c1524d762c11a432f3fe4b1c94b2296e1ef297fa0a606b40dade4522ac5820421ab93e0d8fc7c311390982a5d1daf246b6ec967e9fa
SSDEEP 192:33RCs327lBzYv7ghAPRp2B99Hsb+WNndx10WXBpakwcGloVyIsnAUgraJ:33RCs3+Es8Xq/wl0EBpaHlMe
TLSH
T13742E92EBA18753B9CDBD21AFD117B57E7F1102221952E98E6FC8A1C19D79CD321301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 ae17c35bb0d5d40623c05c7104112e211eebe9c58d5ef5b2b2f91c2eafaa8ced
MD5 9f9f4090197b1127a8ccb5eee5e0d7b4
SHA1 ffe96db89e58dc84b16484806ee3304bd7029560
SHA512 38886cc0d319b4ff0228acac98bcb0e322c020dd50064d3e5ece34421fc3348f705318261f8e8769b97be267615ec6241c9f6408e43d5939ac0763719acd7e12
SSDEEP 3072:3hV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/p++J3qUQm08KMWF0bFTcVHr6z4Z:j6OgB2HWv3G8YnOnR++JjcMW2VcVLjZ
TLSH
T14C1412264919BC74236EE2D2D01F2DC48DD29CAE854564F9B1E37B4E06EA301278FE6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 48829d9aa6525fbd9f039eaee15d651d3b5a39e565494c82453dd73d0b0d00e9
MD5 96bdcf5572f2808f35862bbcc17aba31
SHA1 4c450fd4ddfeeb41538397b3bac979a6c6f6fd98
SHA512 9df0585e2998521050f0de94d78543afdabeea08d2d625e13738f95540efc51876bb0f55dfd719c5a418e0469a4f109f87e2fe4fe79b8be1de8e07bb4ad2b166
SSDEEP 1536:ubrP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:m++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T12D9312B9991E7D79636BC296A0079CAC4CD3CCCE111055BC30C76F0E18BA392E31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 f2be7d4b18c5209de725069887238557843d000565c11deb24d812eea018b1ee
MD5 a48abfc25325795f150f158214e27dcf
SHA1 f94071d96377df5470479bf773bc7cd5acef7f22
SHA512 211cffeff43a4e91f15cfb737d225096e13e779a3c593f21d7b5950f17ec780051be5e9f58bc2edf8fdd9e6c0424ae22038229867425498234d2ff492e93dd4f
SSDEEP 3072:9FXhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/p++J3qUQm08KMWF0bFTcVHr6z4Z:PD6OgB2HWv3G8YnOnR++JjcMW2VcVLjZ
TLSH
T11D1412364919BCB8222EE2C1D00F2D854CD1989F8A4575F9B1937B4F06EA3416B8FD6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 4cf1f5cf302fb47e040f511a915242a08edb922d5b28d335470cc1cad0f70bd4
MD5 60714ffbd0c6df16ff1c57534397aa8c
SHA1 380bf33078ff995d80e9c6a7973fe27156a5d3ce
SHA512 33de87d2148dbc41736f1ebf18e2708ef3e46c2447293d544fea15f55f4a76384929310840fd46713b5febba7ae2cb8fa545629ed33024716d9d853975249eaa
SSDEEP 3072:GhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/p++J3qUQm08KMWF0bFTcVHr6z4Z:o6OgB2HWv3G8YnOnR++JjcMW2VcVLjZ
TLSH
T1E21412264919BC78236EE2D2D01F2DC48DD29CAE854564F9B1D37B4E06EA301278FE6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoofer.exe.crdownload

Path C:\Users\Admin\Downloads\spoofer.exe.crdownload
Size 818KB
SHA256 1ab098d9b6f4447d92d5fc2af7fea587e5860cd3e0e5887eb3f487fe59cecaba
MD5 5a72e2269d6f04141eb2434940dd0c20
SHA1 38c38fbf68ce4a087f4e7b2405a5d3626e6b4c7e
SHA512 b9146c4b53fb38239750aed34e933e94d916c067a258b0f894ede4d06d0b105885fdf064f59d83f5bf1ea566b4be779670bfdd6eafe690e1f78f9fa2f0d08f9e
SSDEEP 24576:8DzTo7+vjcl8BTL5MofdP+O+EX8prdLq:8YBITlPHhY
TLSH
T162059E9A97A810EBC1AB903CC693DA07F27679D56325D7CF03A095752F13BD05E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoofer.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\spoofer.exe:Zone.Identifier
Size 219B
SHA256 5ae459fcf63794c03a8378daa8d4ecea5da730908d44a3c73b62b6cbf36b2fe7
MD5 aedcf2b5d17a9728c22da38ef306af79
SHA1 777a0448338e715b925baba12af836557fd1511c
SHA512 4fc97112eff0e397ea5375b16b7f31da13fc9f9daaf27fcb241d5cf3b0bed75e0a21f47be1699b9daf6e72baca3ea4c2def8f46d4ae4f841f2279960c9aa3506
TLSH
T1C2D0235F5047F470245919DB3FDC415D520E5680D88D160564C4C2AB5DE2D38E0D5C17
MD5 SHA1 SHA512 TLSH

Submit Download