aa6613b095648e905693c7a1532e98891b4c9c5849b7a90d4901f9c30eb69ec9

Resubmissions

11/05/2026, 19:02

260511-xp6clact8m10

11/05/2026, 18:58

260511-xmvs3sct6l8

Analysis

user interaction
yes
max time kernel
930s
max time network
930s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Atlas.exe
Size 16.5MB
Sample260511-xp6clact8m
SHA256 aa6613b095648e905693c7a1532e98891b4c9c5849b7a90d4901f9c30eb69ec9
MD5 f7bc32f0a1f3689ae74b024288b2621e
SHA1 c13a65720505cc6107d749db3120f4291d80134d
SHA512 89ee9e685c505b2d887374b655a36c5886101b0062042e4341db57825d4849de4c7107450ea6581ab3664ff1254e5001acfb7312f7d878c88ac9972e0535e012
SSDEEP 393216:2I/1FqD6I9JhfhrnblRmRJXDg5fzMTnX:20zIrJrnbX5Y7
TLSH
T1A7072306F39586A9D476D13CC652A317EB72B8160322CBDB73DE59211FA71D04E3EB82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
127	1000	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
5764	windowsxpupdate.exe

Loads dropped DLL 12 IoCs

pid	Process
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsxpupdate.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsxpupdate.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229999119779528"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\windowsxpupdate.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe
3180	Atlas.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3180	Atlas.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3180	Atlas.exe
5764	windowsxpupdate.exe
5764	windowsxpupdate.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5360 wrote to memory of 5892	5360	chrome.exe	83
PID 5360 wrote to memory of 5672	5360	chrome.exe	84
PID 5360 wrote to memory of 5672	5360	chrome.exe	84
PID 5360 wrote to memory of 1000	5360	chrome.exe	85
PID 5360 wrote to memory of 2156	5360	chrome.exe	86
PID 5360 wrote to memory of 2156	5360	chrome.exe	86
PID 5360 wrote to memory of 5976	5360	chrome.exe	87
PID 5360 wrote to memory of 4884	5360	chrome.exe	88
PID 5360 wrote to memory of 5976	5360	chrome.exe	87
PID 5360 wrote to memory of 4884	5360	chrome.exe	88
PID 5360 wrote to memory of 4672	5360	chrome.exe	90
PID 5360 wrote to memory of 4672	5360	chrome.exe	90
PID 5360 wrote to memory of 5388	5360	chrome.exe	92
PID 5360 wrote to memory of 5388	5360	chrome.exe	92
PID 5360 wrote to memory of 3264	5360	chrome.exe	93
PID 5360 wrote to memory of 1504	5360	chrome.exe	96
PID 5360 wrote to memory of 1504	5360	chrome.exe	96
PID 5360 wrote to memory of 5280	5360	chrome.exe	97
PID 5360 wrote to memory of 5280	5360	chrome.exe	97
PID 5360 wrote to memory of 1692	5360	chrome.exe	98
PID 5360 wrote to memory of 1400	5360	chrome.exe	99
PID 5360 wrote to memory of 4648	5360	chrome.exe	100
PID 5360 wrote to memory of 2536	5360	chrome.exe	101
PID 5360 wrote to memory of 2044	5360	chrome.exe	102
PID 5360 wrote to memory of 2044	5360	chrome.exe	102
PID 5360 wrote to memory of 2112	5360	chrome.exe	103
PID 5360 wrote to memory of 2112	5360	chrome.exe	103
PID 5360 wrote to memory of 1560	5360	chrome.exe	104
PID 5360 wrote to memory of 1560	5360	chrome.exe	104
PID 5360 wrote to memory of 3844	5360	chrome.exe	105
PID 5360 wrote to memory of 3844	5360	chrome.exe	105
PID 5360 wrote to memory of 5108	5360	chrome.exe	106
PID 5360 wrote to memory of 5108	5360	chrome.exe	106
PID 5360 wrote to memory of 1628	5360	chrome.exe	107
PID 5360 wrote to memory of 1628	5360	chrome.exe	107
PID 5360 wrote to memory of 560	5360	chrome.exe	108
PID 5360 wrote to memory of 560	5360	chrome.exe	108
PID 5360 wrote to memory of 4648	5360	chrome.exe	109
PID 5360 wrote to memory of 4648	5360	chrome.exe	109
PID 5360 wrote to memory of 1044	5360	chrome.exe	110
PID 5360 wrote to memory of 5764	5360	chrome.exe	111

C:\Users\Admin\AppData\Local\Temp\Atlas.exe
"C:\Users\Admin\AppData\Local\Temp\Atlas.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b11c728,0x7ffd6b11c734,0x7ffd6b11c740
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,13339131072118856991,6142668406383567880,262144 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1900,i,1155979934844255292,11211479271828518441,524288 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2272 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,12055484477104975880,10828581544988763560,524288 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:2156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,15276517773439898128,5799899920478135011,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,9285044650275117768,17221146957696819867,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4252,i,8947305842293567091,11639511817158472223,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4248 /prefetch:9
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,6753192721780850655,7245845828801152083,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,18070053889150629498,16090166336174243284,524288 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5424,i,1644323599661922316,3169802466048695684,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3616,i,8854894389841784385,11331248326485123467,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4756,i,10599681396916797360,1225846855001097880,524288 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4744 /prefetch:14
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,2542569353226724731,14302050282979821688,524288 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,1617667669573918084,2160644526304249163,524288 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4716 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5608,i,10569239798692005595,16309987063075006051,262144 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=876 /prefetch:10
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1204,i,16324227350458666961,16098298593646343393,524288 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3860 /prefetch:14
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4760,i,962389309403593703,13242006287561890304,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5508,i,17664980141597116795,12561826579157343340,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5676,i,14692270037238003459,2439779753314912199,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5956,i,9552170480595105707,8692782868823424549,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4664,i,1721547077267949041,8815651701009954257,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4720,i,9666333610335910012,16851848234347777651,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6100,i,13454730929518482711,6288418217448648172,2097152 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,12093680002979581471,140119945579665439,524288 --field-trial-handle=1936,i,9103037549299093045,15775645032773915715,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1044
- C:\Users\Admin\Downloads\windowsxpupdate.exe
  "C:\Users\Admin\Downloads\windowsxpupdate.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8afa8a6926503735831a9450e16b9e42468415cf1b2a181bd40963ea7e938c93
MD5 748e5e4a081761caaac626c056388e12
SHA1 7931422cb8c67194fc34054f9821efe6cbf7b56a
SHA512 7e004a26c213970fa0412fd83c98a7922f405e5eb84ed6266dfc8d64330b1676282874a0b3ba43a15aa92b5f6114684a2a757bc5128189576239384cb63609b4
TLSH
T1C3E0EDAAD820A83B18FE071960A44746EBA1131A2BD0894F7A3D82088FB063A058AC1D
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 184KB
SHA256 7642115a6a02e7db9cc9c8c257b756aabcefccf152e135e0265450285f1cb863
MD5 fc88fdbbaae8ae97f11948bf376dc72c
SHA1 8236579a36dbb4a1844910faa29fbab7c04318a2
SHA512 5df42816cabc3c1e5cf16ccbe393626a0e511b2cc81aab4d6e22d36ad3d0e1e148f9f1ac99e4c73b76e5eea625251d860518c96f5ae2cfc1ee014a92d76a00d6
SSDEEP 3072:xAW1ejwetxxc80Yanr229RRBFCS0eIvoO0qTmAFp5DqJ5BHFagO13t1cGTx4Or:xAW1eztEY529RRX3nyd5G7BHFrORt1cc
TLSH
T1FB0412FDED59292F6FAB600ACA88DE440C56DC2F3BE854E088BA057847C375D4B1C69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 505KB
SHA256 d74eea859d08e3c867889b5a45cddf15fafb56a853a1586ed04e677a326b45d9
MD5 a5f17f2033b5b6f7ffc1b41e4ac1669b
SHA1 57af4da263bf2228ccff1bdbfc030d7bb8c785b7
SHA512 0c3989f9a7bc116883690179798516cb7c97a5b8358437f30471187f33f32246337a274aab34580646f3417c5a73ad7c2132e0ec9f6c54f327ca8c0b1056bae1
SSDEEP 12288:vihIzgQ3i4hF+gi9cOBZH9G7YE40NGD2QojFkmq9VQR:vio3jhFvAcOjsf4cGD2Qo5aQR
TLSH
T1A3B423A3B708D0F95F36D74722BE4334F8C26B4513841A2A1B53B5C8E81D6AFA5A731D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 81KB
SHA256 87d2fbb2b73b6d46eb18f70bcaa77cb7b01015b55f069dfe7896c3021ee9a8da
MD5 65b9b1e26f9089cc6b77f8092c294903
SHA1 a5585227a602fc458019aef112c6f129c3d6ab75
SHA512 cfba3c84b981e0b4d94cc8f3543479a4b234f70b3eda01932b63b6ea2ddc3e1db13f6d8241fa9d2c0624ad1d1d9aad92e730224a4be3d2da8ba48ecc8d5e7c48
SSDEEP 1536:yCe8FBkG+gMEqxJaLhEDJNbnPZjymIkyqCTeBRMgZj5e4w6LP:y4FmEWJaLyddBymI3qLByqjL5
TLSH
T1278302DAE2B0729D868F5AE7668D49CF72E0BD165DCE5D38EB782302D8C41B154336C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 60KB
SHA256 51557cc5d8f95ed0eb90836787af82403eaa73e74d2ba174860cc49bbfb6b00a
MD5 17229ef288b560ba7bff7002984cbffd
SHA1 582cad52fa2f334e3e8902b3cbc8fd178a8c8549
SHA512 63a0748e6e6d308f07aa5250b665fb265777726a9499d4f424505a05777230b9b101fad2207a1e1b7e5d8f5df72abd53d2127ee36f55b567342e5d572c1cae42
SSDEEP 1536:Kfq2gDhb7whWdiVxRKy8vf6Pc4EU8mYHyi36QrVQxGQkrMIEXtZTHkc:f9b7sV/Lq6E4ImUdEGQ+MIanHkc
TLSH
T1D9530295557CFD3FCCA823492ED75A2C583A28433BEA8C53572B725B2E821F4931D238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 75KB
SHA256 167ffb19af7b5035fbd5d145e6decfb91c0cd58d6ea01801fc43f79e21371a40
MD5 b824978804f81f11ed05350c9447f4ae
SHA1 e9291dd35721ae7b1f52a375671dc3221d96555e
SHA512 56f28be2c56e48f80ed06cc2ae68b5114ddc3e0ab63531d9b24b5dfcb8cecb100d2a0b983d4eb866284528fae3c178005a71874d9451d0385c433ae10280d5f1
SSDEEP 1536:lBpDIn7+i1gn9cAWCPJRyaThs8RgrN+9J6X2BKGH82czj:lXwiO+z6kR59JSGc2czj
TLSH
T14A731257DA63E0D272EDD4376087F43A80307AB7724D8227463EBA46596F7E82F0258D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 dc8f74b37befce1e48e8c8416fd5632c1fb86f432298033bc58ded53ac2d03ae
MD5 0212fa81886dd3b31c84577feba75685
SHA1 b143249ac031c23f30586b01d8cac04a4a6dbc39
SHA512 b4cf44d5f75a5fb03e592be31b373e83f84b5008253dc2d848db06db8f2d4083f7ef29a0f1a3dff037325cc908bd7743fcf2058786cf99ca3d26b7089344bb5e
TLSH
T1D351521AA1D090A0DFA56633B3E36C44F89FD66447433347C5CC6430A13BFF052059E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 17be25ed4adc1b908cb095da269c33fc6f9d051f175be0f303fa17b849efe480
MD5 ca1cf519e5ff7cdfe117fe5732081b3f
SHA1 eae1c4a1c2e76c935e505fb90b52d68a59ba691e
SHA512 0ce21bfa765904250efe7a147eeb764d7cd397e35a1c805d96ccc4fde37b9d26b58df9cfbbba933d8b8fdcd20b994b2a0c184b8fc296890019fa77720aebf5ef
TLSH
T15A71BB1691E16070DF68A533BBF21E49F89ED26867173397C99CA43091BBEF011154D9
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 30eac1e79751af46586dc5f84bbb0f9671e7159d0c3c5f173cca8e8977a33162
MD5 6fa6f292eebd8f9b913316e66bef2d02
SHA1 1fdd7dc9531199a52f978ff43c6b34820803c95c
SHA512 9299f49405322bf0a714f65c7721d319a457d711ca41a99c7e05544c9613cc1f51b6bccd7dbb0e58e615ec67cf41911c64af1839f9f0236377391f73be5a247f
SSDEEP 384:D0u4tq0wekXJJ3mKejvjgjWj8aIaYvrUhGMuigHtIeI9yImduOSEaXOIaXkMNTIx:KfHDbR
TLSH
T1E7527DF7C3E4856DCA1156F4AB156F2FCE290524432C3C6A89D8BF4B93E2871E21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 ea4eaa98e1c05d2da8d2034aeaa1f813fd667bc1448f6178703d1288d5676435
MD5 e02ddcbc3d71de174670e2183de57661
SHA1 a2c810b1218063a2d83c4433b8e3df665e73218c
SHA512 a6417f2706c0fa87dcb66025e0c1dac8f1923eb428f777a19d120d7cbb4a7f09620bb06320965745578f4427dffc0ad8b4d433a0b0ed23c2b4ad9621284cb7cd
SSDEEP 384:D0u4tq0wekXJJ3YKejvjgjWjAjeaIaYvrUhGMuigHtIeI9yImduOSEaXOIaXkMNy:DfHDbh
TLSH
T1F8527EF7C3E4856DCA1156F4AB156F2FCE290524432C3C6A89D8BF4B93E2471E21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 92b06300cc694644b9b9bc0bc3aa4ffde61e67df3d445a796d732376e2d6eaaf
MD5 bfc23cb0ae043baf650c9e4f30afc4ee
SHA1 b7e7886da94658e4d8db45a37c2229ac4944bc4d
SHA512 e8bd3ed1659cee28e242796d97847e446ad94ea6ef65a4efaa9a2cb7687e72c66694a735047d05ee0af76eb7b3eb5d013e20d77f558ae3ce5b80b3b3655936bc
SSDEEP 384:D0u4tq0wENTZhkd7ejNjvjPjMjgeaIaYvrUhGMuigHtIKI9yImd7SZXXkqNTIDr0:yfsjM
TLSH
T1ED42AEF7C3E4856DCA0156F4AB15AF2FCE290524032C387689D4BE5BD3E2472E21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 d588382dffbfe1392e3bc8697b388788bb34b8c0593ff142b7d05a0cb2bee74f
MD5 81f933b334f1895aed4c0dfd36e6cc18
SHA1 e95044f18ff16f89e34a476dba4fcf759e0c01e7
SHA512 ecd82b657012d6f239706863d71a35aa801419b3eb6f6d0c71f4b43d27fd225bb161aff899f6bc0298f214cad14a220c93fb9239a7e2fc47d77775af9b8052ac
SSDEEP 192:DS5JyghdaIaqUU0QVOnrYSIymIUiNhGMuigHC2:DS5JyghdaIaqUU0QVOnrYSIymIUiNhGx
TLSH
T135E189F7C3E8C66DC91196F4AB156E1FCE2D0A24031C3866C8D4BE5B93E2972D21079E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 caa8973f0d23f000b5f268af2cf20e9edcb2dc00f558d01ebcb3fd22f3ddaea5
MD5 3ff1535914ac18fa68494fcbe738492a
SHA1 33d598d2b2ee7f20c6d0917e410b4feea3115241
SHA512 dacfadc8a37d17967e5998b7c4eb89a8d587ecf189698e6dc39ec1bd2eac91add911f4542969bace29f04d06bfdbca4b9c2ba22a37f0165ac53d49c0413c8bec
SSDEEP 384:DS5JyghFekXJJ3mKejvjgjWj8aIaYvrUhGMuigHsmhIeI9yITtuOT4EaXOIaXdrU:ZfWakb
TLSH
T1E5528DF7C3E8856DCA1156F4AB156F2FCE190924432C3C2A89D8BF4B97E2471D21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 f54cc6d57b483efdde2a0c64738ad547a5db199fe711e538f8f44e81a8113e12
MD5 070bb73e7dec33881d1b2a531adfc7d0
SHA1 a66dfe435f9ea6d486f4fd1a31a61b39092a9c6d
SHA512 2b2703bf6c9908d30cff0ac63860f3190d052e942d9b286a47dc6c3b114c4fb8cd765f35c8bb9a1045d4f981a16b78525882dd5fb5798116531d002458869e82
TLSH
T14951AEE7D27EB057123C89BB5D44B8065AB7B43012D3A4F8DBA7816DF08A5F30702572
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0da3be04db25c0168844e25f08f53418e545f902fc76c4fd3e2e5cd20c7785cc
MD5 1493b15eb2295d94a063ff5f08442530
SHA1 ae83e4d934e01877fa3bc2ee0f80ba9a88e3257e
SHA512 ee3ad742df550e4784680a145773525b2a78ab81a1c0bd538a7dafab89a9680e0996367fa60e72a75da2a2312ebfc78c94e9922c3b91a8380e2428110038949f
SSDEEP 192:fRr4cBz0ehvCRE/mn/f3xetua4xv7pFpAPRp2bzwIgBl9YHsb+WNYz2p24Mp42Fr:fRkmz0eMtbUXLOwIq2FInC28
TLSH
T13A52C52AB954297F5CEBC32AFA217B17EBF2102161941EC4E6FC8A1C14E79CD621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1627094b7afcc98ff80687303384fb50a571bf6be73cbf800e6261d0f4c30af7
MD5 e0feca5519745613735d8a0512824833
SHA1 460d820c0d99d9e12ee465bd70e5b471a31104c7
SHA512 69314127c459fe2aa753728e0afbcdc905faab7e7c262e21c5f73aad49b20690f8acd88526f434aa33b501b17cf497428fb6b2ae5c9a851cd84eb47e69a06a22
SSDEEP 192:fRr4cBz0ehvCRE/mn/f3xetua4HCv7pFpAPRp2bzwIgBl9YHsb+WNYz2p24Mp424:fRkmz0eMCbUXLOwIq2Znw2e
TLSH
T1E052D62AB954297F5CEBC31AFA217B17EBF2102161D41EC4E6FC8A1C14E79CD621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ddf17351b124f9942b2d8caac36a7843f7b52ead7a1bf43bc2e487f5ac96325f
MD5 6e8c99d9d6a71b88fa9a40b37e7d95d6
SHA1 79ec3d146aba4f850e4589d3c5a36a27b29bf120
SHA512 0bd406976516dcf5d951fccd68f432efd5e53e90d0f0a1ad66a2c705a289ecdb8a9845f9e01625a20fe365d30bb2cce78035022570da89a21f4d5602043c1ead
SSDEEP 192:zRrJcBzweIvCRk/mn/f3xetua4Ov7pFpDPRp7biRlSBl9YHsb+WNhD9pLq0Br/Wn:zRdmzwepGbRXdOwxn/JW+nE2e
TLSH
T1A662D62BB950297B5CDBC72AF921BB17E7F2202261D41E88E6FC8A1C14E79CD6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 0e2e98b27bc13662a8f7fbd8d5f23de3d247d104ae321b67cc0acd8b1ef4de7e
MD5 6176034fa54c19b31c04fbf33d071eb4
SHA1 6fb304fb0be047784ea4251d5d0b9bfb56e8a615
SHA512 14886769268dc8d55a0e65dc4a5ba4585b00843535557e615cd172266d6abef5c498bf8ad773f5bbac6b6c8b8e6b1fc2afba8bbb7b395d0ca77bb22d3b28574f
SSDEEP 192:zRr4cBz0ehvCRk/mn/f3xetua4Ov7pFpDPRp7bjMBl9YHsb+WNYGpLq0BMp42AE6:zRkmz0eUGbRXWOwj/n2VnE2e
TLSH
T1B162E72BB950297F5CEBC71AF921BB17E7F2202261D41E88E6FC8A1C14E79CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 371157f6dece065d7712dcadc54d661b4bfe9d573697fb08df5d7615297095c9
MD5 775a50301c598cc290581748263a0007
SHA1 ef9b5d251a6f9b3515ab5112539d0be2f615f243
SHA512 50c6fb12a8a9907de3779b0c9df20d79494d27f3e4c90f24711bbb379a81a686f8bffd0a3e6102430d298e42e7ff974803b2f3f3a732aa3a5e4832e8c4c155e1
SSDEEP 192:zRr4cBzwehvCRk/mn/f3xetua4Ov7pFpDPRp7biRlSBl9YHsb+WNhD9pLq0Br/Wn:zRkmzweUGbRXdOwxn/JW+nE2e
TLSH
T17A62E62BB950297B5CDBC72AF921BB17E7F2202261D41E88E6FC8A1C14E79CD6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 aab7de8f331dfc07aff4516752ced30f5453dbf2ade351f5ce8350a8bbececd7
MD5 a64bb8651ca2909e0c597e1fabd7e098
SHA1 b271a9f09b05d169a0578fd4f9cc9e1e6df229d7
SHA512 ec3ac78b375a8764ebde5b7f4496d81f114a2649ed13f3af66f31b801750b0e472d4fe447d5915d648f0c2827759d972fdc02cc4a357b6232b63f0d580c95ce1
SSDEEP 192:zRrJcBzwehvCRk/mn/f3xetua4Ov7pFpDPRp7biRlSBl9YHsb+WNhD9pLq0Br/Wn:zRdmzweUGbRXdOwxn/JW+nE2e
TLSH
T1C362D66BB950297F5CDBC72AF921BB17E7F2202261D41E88E6FC8A1C14E79CD6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 21e81c420f3d017ae32c8b64d4e6d75c94b8234e6b16495dd8068581d8c1d8ae
MD5 00354c26d974dd37c82892cc4543401d
SHA1 998a31960482acf892a8127374d96c3a440e9e8d
SHA512 002a30061d299c004f2cb1f953a686553784e46d60be4a0ead8a5803cc85dda5c5d4c62a1b8c130db4c0b1023316a356061b53cd0cdbc9a204299c12d96f29e7
SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLuLcifMtXODql+ErU3HtHGDu9P:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17p+
TLSH
T1BA72FA676C4C9E770F94C9CCD8267E4FADB5024B65DDC86482FA982A03D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d7a4ab12bed5948f947ac43e8e525a51fb143500e5bffb2705b9c859e052c40e
MD5 5bc61bc06a8c659b27d6cdd6128394ee
SHA1 129055326071ef5fa44537e3654d0a4c69009140
SHA512 60bb75ba0f20bc24520e93a602cabbcc84efd0fd1f4f90e6ecac4cb9aeff06bf3adb2daed09eedb06b477f3fcfaba589852fbabf6b3a781799a5c3e56781653c
TLSH
T182B01211A4015541C04312B216A248CC72285F10C705330153E4AAB2E83A1E14014250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4e12.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a4e12.TMP
Size 96B
SHA256 b8b088bcec81f586e4304a8fb30aec3c04f38d7c91fda44fbfd387a270ce9883
MD5 0c695a6d5d204b08e03462f510568ec9
SHA1 a04f438d2668a6bb986c96270a29245037d91664
SHA512 fa9bb615bb3752872fe312e524025292eab229cdac8fd2e1392934aef6c8cdcdeef1c25cae7cef04b65e8debf8f7ec2833f695c0c80b6a9b34458dda89bd563a
TLSH
T1B8B0220AC0032302C02203B02AE083E8F0A0CF20C20322B283F02A23CC323320220B30
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 23377e216d7461d36078a33a5987a2c9f6b8ad4b3c42852f976209c1b62b1f29
MD5 7bd076d406e977e8b4284c0099230b85
SHA1 16d902aff0246749dbe3f8c208ebb99059094ec4
SHA512 f1dd959e1ba6f15f618d60503113484efdb74aafb596e6bc0e5a872322ef62486e1d8d2e8039255d36d122b74d60810a9786727d1fba7e3b84f7daf960bb6dc0
TLSH
T133C04CD31961498F8675BAD81428752DD95797888CD9CDF89545514622B49338802928
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5d9a2f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5d9a2f.TMP
Size 157B
SHA256 c323c3ce08ef1b5758b356959877d1a45e3b2bd246bcc2692de113ed6d105339
MD5 a42c9d7d6bb6046606e08e61092908d4
SHA1 cdf6ee6b5bcdf004328186c7ca61ab3ff4f5b168
SHA512 00f3140576612af59b903232442927428498c6c3cdc690059b2b324423bcbee24c618668eaedea073880c2834c49597429958d5a90931d380f9db8d100bca249
TLSH
T122C08CD30820098F4B31B9D81028711CCA1B8E888CC9CDF8858A700632B4933C401A28
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 eb30043e3869fe82ef900176a9ff1eabb5a00a6155e590d67dfa707de38a4dec
MD5 0ca54c5e64b4d8a50dcb1d44a72f0fdc
SHA1 e6ad8db87f210f3db03e587400fd772538a2878e
SHA512 5fb2b26573b283305133f9e97e6f3e16cc431aab656be4f014e920dd12644ebc4e20232f6003889d234bbab5bc3bb2cdd4e00ed9c343deffac987f2b1199cbaf
SSDEEP 1536:S9P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:a++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T13D9312B99D1FBC79636EC69690079CAC4CE39CDD151014BC30C75F1E18BA3A2A30B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 e9cc7000b53cf1ec31844638262e8edffe405e6d066594b7d385d56009a8109b
MD5 7d6f62229065fea2ae31bfe3ca99c170
SHA1 abd466b93541f93789eb3cffb5a5398ca2d7c4db
SHA512 5e89d1966928eb97967c3708cc5157de5799e50ba0710a776bc275c69e5457681954992b3b1cdb2f2d1a8fb42c483ae3be388042dc003d3489bad7a7fcd641be
SSDEEP 3072:9kotnuJlJJpmE9KtqQYKlxuPDFYpMgNLh6s++J3qUQm08KMWF0bFTcVHr6zi:9rMJJpDkKKl6vgNEs++JjcMW2VcVL1
TLSH
T1021413709E0FFEB6217B87DF150B6D950CC7CEDE0908A96932E12F4519EF3214A438A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 f910c232ab82965f5bfa6c9488f88936b078b88ca416dd5ff73272d61d7e42b3
MD5 90b35c13aca3c7990b48073b31b137de
SHA1 ab15b64db099079df9f4fdfd293a217d6cdf1d5f
SHA512 939d31e79697027b83d4ced363d15390243d3329533c016aa4774714b73bce14617abcd8af04346a64b1a62fc5447949cd0ece978a63d20671d984bda735a5ca
SSDEEP 3072:wotnuJlJJpmE9KtqQYKlxuPDFYpMgNLh6s++J3qUQm08KMWF0bFTcVHr6zi:fMJJpDkKKl6vgNEs++JjcMW2VcVL1
TLSH
T1241422B09F0FFEB621AEC79F590B5D994CD3CEDD0508986532E12F4919EF3214A834A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 ab0c7deb15cf7a1d18258cd9111bb73a6db9da7e9f444cb924a0ba3ffefb74eb
MD5 1389e8c49baf3e5e62d54514a9c59552
SHA1 b5af9900b526a854d1e336fe6a7cfdc165340079
SHA512 aec1ddd1762c511528fee91a30ad0690a88ec1637d719f9908897219f1097fa87fd4cdeedda0892e7945d390ea88757952f4d0e00890ef30ffa4efad3c33c3ee
SSDEEP 3072:lkotnuJlJJpmE9KtqQYKlxuPDFYpMgNLh6s++J3qUQm08KMWF0bFTcVHr6zi:lrMJJpDkKKl6vgNEs++JjcMW2VcVL1
TLSH
T1AF1413709E0FFEB6217B87DF150B6D950CC7CEDE0908A96932E12F4519EF3214A438A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 d6efed7a4b222401109b40d9214903a28f60c7a837a3b89cd6a10b249216be3f
MD5 70b244308db153b664513c578669f9bd
SHA1 72f7c528460199adbb95472368de1fbebfed9984
SHA512 2f679d5cb99fb2370e97d7dcb01cd133d37e001531062972dc5113e26fe8a775d1b5c22d4f561e95863d70d2ffecd976daba4f24cd06d6936a4176a998ec11c0
SSDEEP 3072:+kotnuJlJJpmE9KtqQYKlxuPDFYpMgNLh6s++J3qUQm08KMWF0bFTcVHr6zi:+rMJJpDkKKl6vgNEs++JjcMW2VcVL1
TLSH
T1841413709E0FFEB6217B87DF150B6D950CC7CEDE0908A96931E12F4619EF3214A438A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KcCursor.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt7765.tmp\KcCursor.mfx
Size 36KB
SHA256 957395a47050cebdf4476b8e908a03e90cc8d77f3e50c518a491e4e0d3443a43
MD5 d4f7402bbe6770a3c262f91495d01847
SHA1 375953d6b23b2eaa8b075e5b2f672ba0ac263b42
SHA512 731ffb510f61daa507ff5fa6ae643cd22c3ef0da464e11ead9aa3a315f56bc77760ee27093f8cfff2fac0caee643b80a40b910034bab6a7db564dd6e23d069a8
SSDEEP 192:Bl0tMHeTeN4dUDRhMn38xmrgO5w9LLApekguc/3RabLpNAZi+90lO0gP6ZWlLbxo:70O+2ZDPaNAZi+9NjP6ZSe
TLSH
T1BFF27322E3B59059F4B2AB754CBA42319736FDA3A838DF0706A0F60D6C71B91AD15733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCShutdownOperations.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt7765.tmp\PCShutdownOperations.mfx
Size 114KB
SHA256 7948de373521b28b905b0f543d8851272fa6259594aab4379abd5e330f0360ce
MD5 426ac6ce433939fb99a06c4924f374c9
SHA1 d35fdd69d7788dc4e75e615d0ca9ac011bce14f5
SHA512 6085240699168fea46df1210c85ac874a106fd1de0ecd2b1260a5ba05de6403d7bee48a75c2b6624f98afb55d5a392063cc73af8d2110d289ab9844942bbf7b2
SSDEEP 1536:xCo4vP1+7E8EEWqVZdjMHtKIN30OHkzlkHkoewUjodWEAuBDj3nodh75fEyyjWtP:xCo4vtEWudC/icXzEEbMh75fEyuy
TLSH
T1DFB38E2136A0C472C19A25388969CB725BBEB43298B4954BFBD8077D9FB07C0AF35357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cctrans.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt7765.tmp\cctrans.dll
Size 347KB
SHA256 9b834b5d26983451ef3a11c8c2a715724daa188fbd28597081ecb1e9ed672f87
MD5 21e093d52a3afe8ed5532fcaa189c067
SHA1 8aa7bcb26e3064cd4d1172090ff00d083ee19cc4
SHA512 b4c2205c234e8ed4973fca9c64c0ec11753eb200c1d2eb3c66b9f4509426c8774f14ae1271583e0eaff268eae9c8375c5993af107e4db8d7c87b817bd1ccd9e8
SSDEEP 6144:diAs8FRxWGjVbzWKCc/IEqibsBVthDU6Uthoy28TZKmpEGB:diAsmRgGJzWKCUIhUsjBhP9GB
TLSH
T11F748E10B9808031C2B7383416BDE6B21DBCA8301F749ADF9B581A7A5F745D1AB37A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clickteam-circular.mvx

Path C:\Users\Admin\AppData\Local\Temp\mrt7765.tmp\clickteam-circular.mvx
Size 28KB
SHA256 671a01a39fa56a32fc0a43b16038d3077202734a7beacd50d73439011a74a4cb
MD5 670cfc229784a242beb960a430ae9764
SHA1 9818a8a255e58e28c1e7617aa7ab38f29067e4f5
SHA512 7eb59b4391fed479803c2c2ba075d3fa4581473495f2458b0a86fc3d27f8b7e56a012b920bf2b5f1697b4eb498c8d16de17ebed9f10eb55686048cd4f96df1a1
SSDEEP 192:GaIqUB58KXfpShtO3ouyuokFTxdg+AiQp:3UrNXhS7O35JXFTxdLAiQ
TLSH
T13BD24E16D3DB00A4F1B62A761C7ACE37563AFC1199F9866E0F10E2DD3D71A15CE21B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcwctrl.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt7765.tmp\kcwctrl.mfx
Size 63KB
SHA256 0666e52ea54bb2bdb81216443ea0787b8fcc6292b64d6bdf285eebf42e1bbae6
MD5 fa3aa3c51150eb5410dc3d74484d84bb
SHA1 3ffca600b9d8b2d580c99021c95e8c6400d9a824
SHA512 81ec7ec2a5877d1b226dfb4ccc8c3946b61fb409d5c53c789e6f8c310a0dc0b3ce1681613cc110a5559540a0ab302e6c36a00d0df07acb41c5a7c35b37d4594a
SSDEEP 1536:Gur/2P3+7NhvoU5bc8Tcd2QsWjcdiVKjnB0ya:vK/ohv/y8+YiVKDB0B
TLSH
T1F053050476D09072E1B21B349CB69622472EBC82D9B5DDA73B88114E5E713EDE738F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmf2d3d11.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt7765.tmp\mmf2d3d11.dll
Size 541KB
SHA256 5f6563d6bf2f3ceab8b2ca2c15ba4f7fe882a82c1f72b10041b5692c6515a53a
MD5 839633898178f35f6de0b385b7de0ec7
SHA1 5396e52c45954f0953cc8cf2095b122f7353180e
SHA512 b0ed4fce2815dcb783e0b9a786178b337d215e6a4d16df1ddb3c28ccdba13081fee1976669d9f99505cf31b8f1e8d5584fd1aa9732e1add38217222726c76eb8
SSDEEP 12288:PTj1ZnJmYM1TjXv7aB4hMz0NZZu3VgGVuwY8dXtdIkJrXIW8M:PXMxjTaBcMzYZZuVgGJdXnJbIW8M
TLSH
T1E0C47C02B6C1C837D42E1330489BABBAA27DB6110B65D7D772986B3C6D713D05F33A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmf2d3d9.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt7765.tmp\mmf2d3d9.dll
Size 1.5MB
SHA256 bddda991185a9e83b9855a109f2fcfa78cd2d5402e9db344c6ec77f6ce69a0c5
MD5 c85bcc9f3049b57aa8ccbb290342ff14
SHA1 38f5b81a540f1c995ff8d949702440b70921acc5
SHA512 5097f9d78ddc651aabf41f217f622ee656a1c6de6a9b339354525293102cf631cca2b7babaf991e99e49efe4d1bb6792c8a7a11f82e4ae2081c3961eb9b5afe7
SSDEEP 24576:rYhBOKa6c8DVYrsz0LbMgPqgVmpiLfmVydmN/9KcAfcLacioayK:v6FjILIgigQrye8cqua5
TLSH
T1CC75BF11B681C036C4B73231065EA37562BDAF211A7495CF17883E7A7F745E2AB3829F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt7765.tmp\mmfs2.dll
Size 768KB
SHA256 763ef4484ba9b9e10e19268c045732515f0ac143cf075e6d1ea1f5adcc77633b
MD5 200520e6e8b4d675b77971dfa9fb91b3
SHA1 0c583bf4c3eda9c955fd0d0d3ba7fdc62a43bf07
SHA512 8b7bb334b6bd83ae43e5a4fe32a92b38b1edd2c292c4a540a54c2ee16092eb30108524c1c363508f7c62617bb224d9b447f07cda97ab7de01688acbfbacec51b
SSDEEP 24576:OAN3eETMNlmLBNc/82oLOsy6rvPXPT1YI:hN3eETMNELBNczoM6rHXPT6
TLSH
T1E4F4AE20BDC5C131D6AA247286BDFFBE19AC66300BB455CB4B881E7A1F201D36F36657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mp3flt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrt7765.tmp\mp3flt.sft
Size 24KB
SHA256 81c9a9459a8e124793addf142cd513945d6fe600e1d67f74897898d7570e56b2
MD5 5bebc3ae0122702b89f9262888d3a393
SHA1 064731c0f1d493b5b82921fa78f06e3d1db95284
SHA512 c10cb520c2c4a9fe7c371f17ce7f86f138db247468ab1e465dafd7abd294c2beb13cf3a2595b4c8c820d911d8b70842c8f4e45398693c4f0454f973bd58a10a1
SSDEEP 96:24znrBZKgkk1jqIU9my5F3TM+EXt0D0CZpMC07X7Xbw9pbcPw5KqQ+5lyV:24bXSIXy3IrXtafMCOIpwPRzElq
TLSH
T159B22B12B3A10CF1E55A5E322CE7027B6E75FB9917B4625B9F91C23D1C33901A81B573
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ultimatefullscreen.mfx

Path C:\Users\Admin\AppData\Local\Temp\mrt7765.tmp\ultimatefullscreen.mfx
Size 86KB
SHA256 111c61d9e54b037a2c492b89cf6a82c62f81712fb9fd64a91c9dfc9486887349
MD5 d9ae994eadde0d3418aedda4f712dc33
SHA1 402e8ca669a4fd6ff69399b7e08d2707f216c68f
SHA512 0c6b0a6df08ef8ecbd2bbbc1dd4534f42ea4f440eed45c98647d712945fd71b5fe484f1a76388724a82a6acb2b98e73efcbf82f0d3a329890215d0eecac20c9c
SSDEEP 768:O0tk38+IToRb7/6GLKB/XR0haFH2KhLBhpJVt7EnV1F4TkedlsHAqED+nLF1XJwg:O0tk6+KJOhoL/pJAn54TkJHpZKTXh6V
TLSH
T156834A13B1E0B331F8961A39D47E27631A7EAC225BB552CB5B9CC53A5E903D009B436F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsxpupdate.exe

Path C:\Users\Admin\Downloads\windowsxpupdate.exe
Size 15.9MB
SHA256 a23da945729e6bad2b1f95513916ab706a0e9ec9416e1e4b054b330ac13bb289
MD5 a9130030c972a75a316d5f3118899b1a
SHA1 9d828ad8c08bf9468ae43851b4383c9df2a3c57f
SHA512 ff063d151a0ed612f9f08f04d8355080b05f799f2a93351243399eb4018e4a56da856600fdf3f56a2d9fc1d05b70a699450bfae42f831db0977bbc9800bf2fb1
SSDEEP 393216:5N3eETMNpDH/tw3Ud9kuLsqGD/4ZrgsWZhNPiY+lTdMru:5N3eETMNpDftkUD9LXGLAYZhVERMru
TLSH
T123F62361FAC48232E9A61433D17A6A7716AE4D305BB406E3C1847E2D7D336D06E3E376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsxpupdate.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\windowsxpupdate.exe:Zone.Identifier
Size 471B
SHA256 72b4148b71ab2b8edceae8b2cac24bab8827b235650bdf8d786aa9153e47c5ff
MD5 cf0fb0fff29780e5ec2db87c85ab835e
SHA1 23ebc36824dab5be3990d4b40042613033b7f865
SHA512 25a89c368f00c51b583113c56004ec71b32029b135d7c5369232b3f68cd67a31bb337d4f57fcd0ce878482a558e9d5e165b9386665ece1ba319bee35089878ca
TLSH
T118F09EBF5DC484C511042D596186A2B5B00711763CF6050E641224DB75910A1C58AE6E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5764-921-0x0000000001A40000-0x0000000002042000-memory.dmp

Download

memory/5764-892-0x0000000001A40000-0x0000000002042000-memory.dmp

Download