Overview

overview

10

Static

static

3

abf60d26f7...f9.exe

windows10-ltsc_2021-x64

10

Resubmissions

15/05/2026, 03:18

260515-dtxfpsdw4110

31/12/2021, 21:06

211231-zxq9rahca510

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    15/05/2026, 03:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    abf60d26f7062fa3ed554d4ed437c8f9.exe
  • Size 13.8MB
  • Sample260515-dtxfpsdw41
  • SHA256 48267b826fa7ec0cea8be878f979a967d0a091cccea9f226ad8d87b29dc94800
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
aspackv2backdoor915a9912f1030c80831a4857ec7cb54b69653332c85v1userdefense_evasiondiscoverydropperexecutionfabookienullmixerraccoonredlinesmokeloadersocelarsvidarinfostealerinstallerpersistencespywarestealertrojanvmprotect

Malware Config

Extracted

Family

  • socelars

C2

  • http://www.chosenncrowned.com/

Extracted

Family

  • nullmixer

C2

  • http://hornygl.xyz/

Extracted

Family

  • redline

Botnet

  • v1user

C2

  • 88.99.35.59:63020

Attributes
  • auth_value

    308c93d6de0a77611de620bfe5a605c6

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://melchen-testet.at/upload/

  • http://zjymf.com/upload/

  • http://pbxbmu70275.cn/upload/

  • http://mnenenravitsya.ru/upload/

  • http://pitersprav.ru/upload/

rc4.i32
rc4.i32

Extracted

Family

  • vidar

Version

  • 49.2

Botnet

  • 915

C2

  • https://mstdn.social/@kipriauk9

  • https://qoto.org/@kipriauk8

Attributes
  • profile_id

    915

Extracted

Family

  • raccoon

Botnet

  • a9912f1030c80831a4857ec7cb54b69653332c85

Attributes
  • url4cnc

    http://178.62.127.193/borderxra

    http://5.181.156.155/borderxra

    http://185.163.45.70/borderxra

    http://185.163.204.22/borderxra

    http://178.62.113.205/borderxra

    https://t.me/borderxra

rc4.plain
rc4.plain

Signatures

  • Family: Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Family: NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • Family: Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Family: SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Family: Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Detect Fabookie payload 1 IoCs
  • Raccoon Stealer V1 payload 2 IoCs
  • RedLine payload 1 IoCs
  • Socelars payload 1 IoCs
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Vidar Stealer 1 IoCs
    stealer
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops Chrome extension 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\abf60d26f7062fa3ed554d4ed437c8f9.exe
    "C:\Users\Admin\AppData\Local\Temp\abf60d26f7062fa3ed554d4ed437c8f9.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3640
    • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5116
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4496
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4408
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3432
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Wed069fcc26fbe1081.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed069fcc26fbe1081.exe
          Wed069fcc26fbe1081.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1600
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 1768
            5⤵
            • Program crash
            PID:1092
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Wed06ff344e83e.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2480
        • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06ff344e83e.exe
          Wed06ff344e83e.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3584
          • C:\Windows\SysWOW64\control.exe
            "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\3GuvT.cpL",
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5068
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\3GuvT.cpL",
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3300
              • C:\Windows\system32\RunDll32.exe
                C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\3GuvT.cpL",
                7⤵
                  PID:1368
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\3GuvT.cpL",
                    8⤵
                    • Badlisted process makes network request
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:3232
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Wed06e8d5075f3.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5040
          • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06e8d5075f3.exe
            Wed06e8d5075f3.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4684
            • C:\Users\Admin\AppData\Local\Temp\is-BS8CQ.tmp\Wed06e8d5075f3.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-BS8CQ.tmp\Wed06e8d5075f3.tmp" /SL5="$80210,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06e8d5075f3.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5028
              • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06e8d5075f3.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06e8d5075f3.exe" /SILENT
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1960
                • C:\Users\Admin\AppData\Local\Temp\is-Q8T0R.tmp\Wed06e8d5075f3.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-Q8T0R.tmp\Wed06e8d5075f3.tmp" /SL5="$100054,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06e8d5075f3.exe" /SILENT
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  PID:1740
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Wed066b4077a88be4ae1.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1440
          • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed066b4077a88be4ae1.exe
            Wed066b4077a88be4ae1.exe
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:236
            • C:\Windows\SysWOW64\control.exe
              "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\3GuvT.cpL",
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3712
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\3GuvT.cpL",
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:712
                • C:\Windows\system32\RunDll32.exe
                  C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\3GuvT.cpL",
                  7⤵
                    PID:4120
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed0685687174402079e.exe
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2392
            • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed0685687174402079e.exe
              Wed0685687174402079e.exe
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks SCSI registry key(s)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:1672
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 412
                5⤵
                • Program crash
                PID:5000
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed06ccb03714.exe
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4160
            • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06ccb03714.exe
              Wed06ccb03714.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4176
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Wed06aa4d5a7e051648.exe
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:444
            • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06aa4d5a7e051648.exe
              Wed06aa4d5a7e051648.exe
              4⤵
              • Executes dropped EXE
              • Drops Chrome extension
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4972
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c taskkill /f /im chrome.exe
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4336
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im chrome.exe
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1316
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                5⤵
                • Drops file in Windows directory
                • Checks processor information in registry
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:2040
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffe0c4fc728,0x7ffe0c4fc734,0x7ffe0c4fc740
                  6⤵
                    PID:3564
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,11120547168420008996,10676646510322484138,262144 --field-trial-handle=2032,i,12579404851293627691,10783763133675072613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2028 /prefetch:2
                    6⤵
                      PID:4352
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,1553566219706282595,12465055943227891570,524288 --field-trial-handle=2032,i,12579404851293627691,10783763133675072613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:3
                      6⤵
                      • System Time Discovery
                      PID:5100
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,16047364841262251474,8392890545340749150,524288 --field-trial-handle=2032,i,12579404851293627691,10783763133675072613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2528 /prefetch:8
                      6⤵
                        PID:1448
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,11508699082087679721,15257825860139405466,2097152 --field-trial-handle=2032,i,12579404851293627691,10783763133675072613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
                        6⤵
                          PID:3788
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,79937867021078063,11487375452853689613,2097152 --field-trial-handle=2032,i,12579404851293627691,10783763133675072613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
                          6⤵
                            PID:1208
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,8402083497854160960,10356532419101157561,2097152 --field-trial-handle=2032,i,12579404851293627691,10783763133675072613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4352 /prefetch:2
                            6⤵
                              PID:1572
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4576,i,13365293885213923226,13909028558006450783,2097152 --field-trial-handle=2032,i,12579404851293627691,10783763133675072613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3860 /prefetch:1
                              6⤵
                                PID:1944
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,15190250314615898541,12985518531873446400,524288 --field-trial-handle=2032,i,12579404851293627691,10783763133675072613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:8
                                6⤵
                                  PID:3872
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,8577181357603858940,7910059913450132554,2097152 --field-trial-handle=2032,i,12579404851293627691,10783763133675072613,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:1
                                  6⤵
                                    PID:2936
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Wed06efec13c3f.exe
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4648
                              • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06efec13c3f.exe
                                Wed06efec13c3f.exe
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:4392
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Wed06ae0d1db7de9.exe
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:3336
                              • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06ae0d1db7de9.exe
                                Wed06ae0d1db7de9.exe
                                4⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1468
                                • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06ae0d1db7de9.exe
                                  "C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06ae0d1db7de9.exe" -u
                                  5⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:1244
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Wed062a822126.exe /mixtwo
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:736
                              • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed062a822126.exe
                                Wed062a822126.exe /mixtwo
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:756
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 444
                                  5⤵
                                  • Program crash
                                  PID:2968
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Wed06b327d566df8.exe
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1148
                              • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06b327d566df8.exe
                                Wed06b327d566df8.exe
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:4404
                                • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06b327d566df8.exe
                                  C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06b327d566df8.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2456
                                • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06b327d566df8.exe
                                  C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06b327d566df8.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3848
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Wed065729708bdfea8.exe
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1552
                              • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed065729708bdfea8.exe
                                Wed065729708bdfea8.exe
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:780
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2080
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Wed0651826247831d8.exe
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:3364
                              • C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed0651826247831d8.exe
                                Wed0651826247831d8.exe
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3516
                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  5⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3824
                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  5⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3296
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 648
                              3⤵
                              • Program crash
                              PID:3340
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1428 -ip 1428
                          1⤵
                            PID:1920
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 756 -ip 756
                            1⤵
                              PID:4472
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1600 -ip 1600
                              1⤵
                                PID:4536
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1672 -ip 1672
                                1⤵
                                  PID:4576
                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                  1⤵
                                    PID:4144
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:1484

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          FarLabUninstaller.exe
                                          • Path C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
                                          • Size 295KB
                                          • SHA256 7d68d482cbfcabb5aae94131903209271032693317c684d00df5731c8c8f123e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          103621DE9CD5414CC2538780B4B75751
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
                                          • Size 808B
                                          • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                          • Size 4KB
                                          • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                          • Size 1KB
                                          • SHA256 71ccd39de69ec147afd8ad4337a36829dcababbf40897250380c7770de551242
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          B46811C17859FFB409CF0E904A4AA8F8
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                                          • Size 528B
                                          • SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          103621DE9CD5414CC2538780B4B75751
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
                                          • Size 192B
                                          • SHA256 54d096535ac2f74c92baab5b13517c74f18011bff70f01f56adef5a58ba4b18d
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                          • Size 342B
                                          • SHA256 001418f483c32e753aa5a3e0bae297a284152ddde3afdc8cbc52cf39cc299917
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                          • Size 174B
                                          • SHA256 244dd0f4b9f823e899cde0b0305da6b9645a0d5d33a975eb7b7dfa1c9af83cb5
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          B46811C17859FFB409CF0E904A4AA8F8
                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                                          • Size 170B
                                          • SHA256 cf2a5496dccba717e7499a5b2fc8fe7e70c2d5600d836f7b0dcc62cd59b81b1a
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          3db3b2e9-ddbb-4a27-8e1f-b8560908b5d3.tmp
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3db3b2e9-ddbb-4a27-8e1f-b8560908b5d3.tmp
                                          • Size 19KB
                                          • SHA256 1287c142f2869d2e8369963f4b711dc02ebc05bcf67bf51a4e14dd8960b28129
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          BookmarkMergedSurfaceOrdering
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                          • Size 6B
                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          BrowsingTopicsState
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                          • Size 414B
                                          • SHA256 4490baddd4e3ea080ecb91295d67977d3031da2060616be26a12a951577671aa
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Network Persistent State
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                          • Size 2KB
                                          • SHA256 66b8b55ce1e30e69c739f14b485edff62640c24f96c576ef753e936085a70550
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          SCT Auditing Pending Reports
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                          • Size 2B
                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TransportSecurity
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                          • Size 523B
                                          • SHA256 d94df2dd69beab86e64db22c71cfceec4c6305a8b66d1055efe69de0194e678c
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                          • Size 11KB
                                          • SHA256 b09ca4ee4434281e141cbc70c94edd74d674aae1e8e3ad1fedc81a8a25dd9dfa
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          the-real-index
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                          • Size 120B
                                          • SHA256 2bd947e2785938f03301c259431fe004f2e0e50b9cb6e6f74e0a8cd4a1a1e002
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          the-real-index~RFe58ae1d.TMP
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ae1d.TMP
                                          • Size 96B
                                          • SHA256 bf5fbb5f1ea378c77356c267990cdc91142700b2861204966403dbac0fd20782
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                          • Size 227KB
                                          • SHA256 809e94a8f267503303934775c73ebcd1877af1e6a9d684484e425afc314eb4a2
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                          • Size 115KB
                                          • SHA256 c950ed9571668b078c1e42d9dd2bacc34b8981e143483293cd783c608de4fdae
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                          • Size 227KB
                                          • SHA256 7c6b61e927e5beec083e56e12dc9540f8d5f59338d503b91f48c6b8491b2d17e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          data_1
                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                          • Size 264KB
                                          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Wed06b327d566df8.exe.log
                                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Wed06b327d566df8.exe.log
                                          • Size 700B
                                          • SHA256 2c8c2b0e4d080458c9ed1e7888638fd679f803af6dc209f5369dcf0f1f2ef402
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          11111.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\11111.exe
                                          • Size 458KB
                                          • SHA256 8165138265a2bf60d2edd69662c399bdbf1426108e98c5dfff5933168eba33f5
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed062a822126.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed062a822126.exe
                                          • Size 1.1MB
                                          • SHA256 af890b72e50681eee069a7024c0649ac99f60e781cb267d4849dae4b310d59c1
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed0651826247831d8.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed0651826247831d8.exe
                                          • Size 2.0MB
                                          • SHA256 28314e224dcbae977cbf7dec0cda849e4a56cec90b3568a29b6bbd9234b895aa
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed065729708bdfea8.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed065729708bdfea8.exe
                                          • Size 6.4MB
                                          • SHA256 68ca0efdc62bc9c4aad4d808d5f17197e3407c0df029211ca1151935fb31d56f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed066b4077a88be4ae1.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed066b4077a88be4ae1.exe
                                          • Size 2.0MB
                                          • SHA256 58d0abc4679a3ac9c8735bf7eb889c43e3913981803804665fd59c55cea24079
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed0685687174402079e.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed0685687174402079e.exe
                                          • Size 297KB
                                          • SHA256 7ee28443cc116166f5be366ae99be3799e16a60eefdadd8eb08ff4c2489e74f3
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed069fcc26fbe1081.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed069fcc26fbe1081.exe
                                          • Size 123KB
                                          • SHA256 cb17edd2f1497ec1f54b46d1aa36227b2d6b7a856f3e28771e3aee5e855485db
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed06aa4d5a7e051648.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06aa4d5a7e051648.exe
                                          • Size 1.4MB
                                          • SHA256 2e3ea63013d29f2c8d5d7d79343fd72ad8517324ccc55a5abe2f1736b4153c62
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed06ae0d1db7de9.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06ae0d1db7de9.exe
                                          • Size 124KB
                                          • SHA256 73437218cd12895c7a59c0c03009417705ed231d323e3a1ad279750e46bcc8ad
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed06b327d566df8.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06b327d566df8.exe
                                          • Size 525KB
                                          • SHA256 8f04f094179e8fe1fab044ba37f0b5388e84c73884ab1daece9d4bcfecebe4b7
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed06ccb03714.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06ccb03714.exe
                                          • Size 240KB
                                          • SHA256 9d7eb339382eed0fe9bfba57b5267e4d941c4fdcaeb088a5cf2e7e5daedff753
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed06e8d5075f3.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06e8d5075f3.exe
                                          • Size 1.7MB
                                          • SHA256 558a67043fbcd0bc37d34c99ff16f66b259b24b44811516ceff678964ec655c4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed06efec13c3f.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06efec13c3f.exe
                                          • Size 764KB
                                          • SHA256 1bea15c4f7f48e2ca7b8ef0000937f05ec97f0a0d8fe786b73b9623b0e4d42a5
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed06ff344e83e.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\Wed06ff344e83e.exe
                                          • Size 2.0MB
                                          • SHA256 629e2d5f6d1f30dd0664f8ea622ea13b69299837d804ba9b5b3ba46c0f4f0717
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          libcurl.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\libcurl.dll
                                          • Size 218KB
                                          • SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          libcurlpp.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\libcurlpp.dll
                                          • Size 54KB
                                          • SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          libgcc_s_dw2-1.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\libgcc_s_dw2-1.dll
                                          • Size 113KB
                                          • SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          libstdc++-6.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\libstdc++-6.dll
                                          • Size 647KB
                                          • SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          libwinpthread-1.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\libwinpthread-1.dll
                                          • Size 69KB
                                          • SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          setup_install.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\7zS83E20D28\setup_install.exe
                                          • Size 2.1MB
                                          • SHA256 ec31c743ce6b4d622237911314e40988d4424698b4b8450da2263fba457b264a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          __PSScriptPolicyTest_n312mpsh.gz5.ps1
                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n312mpsh.gz5.ps1
                                          • Size 60B
                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          fj4ghga23_fsa.txt
                                          • Path C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                          • Size 82B
                                          • SHA256 fdc4bd1a873febc18ac9e5b75d13a630466c8a2d43aff86a4ceeeab1a40398eb
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          _shfoldr.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-9P6KS.tmp\_isetup\_shfoldr.dll
                                          • Size 22KB
                                          • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Wed06e8d5075f3.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-BS8CQ.tmp\Wed06e8d5075f3.tmp
                                          • Size 691KB
                                          • SHA256 bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          idp.dll
                                          • Path C:\Users\Admin\AppData\Local\Temp\is-J2IMQ.tmp\idp.dll
                                          • Size 216KB
                                          • SHA256 e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          memory/756-131-0x0000000000400000-0x00000000004DE000-memory.dmp
                                          Download

                                          memory/756-190-0x0000000000400000-0x00000000004DE000-memory.dmp
                                          Download

                                          memory/780-156-0x00000000012B0000-0x00000000012B1000-memory.dmp
                                          Download

                                          memory/780-160-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
                                          Download

                                          memory/780-158-0x0000000002E90000-0x0000000002E91000-memory.dmp
                                          Download

                                          memory/780-159-0x0000000002EA0000-0x0000000002EA1000-memory.dmp
                                          Download

                                          memory/780-157-0x00000000012C0000-0x00000000012C1000-memory.dmp
                                          Download

                                          memory/780-155-0x00000000011A0000-0x00000000011A1000-memory.dmp
                                          Download

                                          memory/780-163-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
                                          Download

                                          memory/780-164-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
                                          Download

                                          memory/780-165-0x0000000000180000-0x0000000000D27000-memory.dmp
                                          Download

                                          memory/1428-74-0x000000006FFC4000-0x000000006FFC5000-memory.dmp
                                          Download

                                          memory/1428-67-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                          Download

                                          memory/1428-60-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                          Download

                                          memory/1428-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                          Download

                                          memory/1428-71-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                          Download

                                          memory/1428-64-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                          Download

                                          memory/1428-70-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                          Download

                                          memory/1428-188-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                          Download

                                          memory/1428-66-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                          Download

                                          memory/1428-189-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                          Download

                                          memory/1428-187-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                          Download

                                          memory/1428-185-0x000000006EB40000-0x000000006EB63000-memory.dmp
                                          Download

                                          memory/1428-182-0x0000000064940000-0x0000000064959000-memory.dmp
                                          Download

                                          memory/1428-59-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                          Download

                                          memory/1428-72-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                          Download

                                          memory/1428-73-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                          Download

                                          memory/1428-65-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                          Download

                                          memory/1428-181-0x0000000000400000-0x000000000051C000-memory.dmp
                                          Download

                                          memory/1428-75-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                          Download

                                          memory/1428-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                          Download

                                          memory/1672-287-0x0000000000400000-0x000000000083C000-memory.dmp
                                          Download

                                          memory/1740-330-0x0000000000400000-0x00000000004BD000-memory.dmp
                                          Download

                                          memory/1740-327-0x0000000000400000-0x00000000004BD000-memory.dmp
                                          Download

                                          memory/1960-326-0x0000000000400000-0x0000000000414000-memory.dmp
                                          Download

                                          memory/1960-331-0x0000000000400000-0x0000000000414000-memory.dmp
                                          Download

                                          memory/1960-152-0x0000000000400000-0x0000000000414000-memory.dmp
                                          Download

                                          memory/2080-490-0x0000000000400000-0x0000000000495000-memory.dmp
                                          Download

                                          memory/2080-495-0x0000000000400000-0x0000000000495000-memory.dmp
                                          Download

                                          memory/3232-523-0x000000002DC40000-0x000000002DCDD000-memory.dmp
                                          Download

                                          memory/3232-525-0x000000002F000000-0x000000002F096000-memory.dmp
                                          Download

                                          memory/3232-529-0x000000002F0A0000-0x000000002F131000-memory.dmp
                                          Download

                                          memory/3232-531-0x00000000000B0000-0x00000000000B5000-memory.dmp
                                          Download

                                          memory/3232-526-0x000000002F0A0000-0x000000002F131000-memory.dmp
                                          Download

                                          memory/3232-505-0x0000000002D80000-0x0000000003D80000-memory.dmp
                                          Download

                                          memory/3232-509-0x0000000002D80000-0x0000000003D80000-memory.dmp
                                          Download

                                          memory/3232-510-0x000000002DB80000-0x000000002DC32000-memory.dmp
                                          Download

                                          memory/3232-524-0x000000002DCE0000-0x000000002EFF1000-memory.dmp
                                          Download

                                          memory/3232-512-0x000000002DC40000-0x000000002DCDD000-memory.dmp
                                          Download

                                          memory/3232-514-0x000000002DC40000-0x000000002DCDD000-memory.dmp
                                          Download

                                          memory/3232-530-0x00000000000A0000-0x00000000000A3000-memory.dmp
                                          Download

                                          memory/3296-289-0x0000000000400000-0x000000000047C000-memory.dmp
                                          Download

                                          memory/3300-502-0x000000002F190000-0x000000002F221000-memory.dmp
                                          Download

                                          memory/3300-278-0x0000000002F70000-0x0000000003F70000-memory.dmp
                                          Download

                                          memory/3300-365-0x000000002DD30000-0x000000002DDCD000-memory.dmp
                                          Download

                                          memory/3300-364-0x000000002DD30000-0x000000002DDCD000-memory.dmp
                                          Download

                                          memory/3300-363-0x000000002DC70000-0x000000002DD22000-memory.dmp
                                          Download

                                          memory/3300-499-0x000000002DDD0000-0x000000002F0E1000-memory.dmp
                                          Download

                                          memory/3300-362-0x0000000002F70000-0x0000000003F70000-memory.dmp
                                          Download

                                          memory/3300-368-0x000000002DD30000-0x000000002DDCD000-memory.dmp
                                          Download

                                          memory/3300-498-0x000000002DD30000-0x000000002DDCD000-memory.dmp
                                          Download

                                          memory/3300-500-0x000000002F0F0000-0x000000002F186000-memory.dmp
                                          Download

                                          memory/3404-460-0x0000000002CB0000-0x0000000002CB1000-memory.dmp
                                          Download

                                          memory/3404-280-0x00000000005E0000-0x00000000005F6000-memory.dmp
                                          Download

                                          memory/3432-106-0x0000000005970000-0x00000000059D6000-memory.dmp
                                          Download

                                          memory/3432-261-0x0000000007580000-0x0000000007616000-memory.dmp
                                          Download

                                          memory/3432-98-0x0000000005170000-0x0000000005192000-memory.dmp
                                          Download

                                          memory/3432-193-0x00000000062A0000-0x00000000062EC000-memory.dmp
                                          Download

                                          memory/3432-99-0x0000000005900000-0x0000000005966000-memory.dmp
                                          Download

                                          memory/3432-78-0x0000000002900000-0x0000000002910000-memory.dmp
                                          Download

                                          memory/3432-226-0x000000006DF20000-0x000000006DF6C000-memory.dmp
                                          Download

                                          memory/3432-281-0x0000000002900000-0x0000000002910000-memory.dmp
                                          Download

                                          memory/3432-225-0x0000000006F80000-0x0000000006FB2000-memory.dmp
                                          Download

                                          memory/3432-235-0x0000000006FE0000-0x0000000007083000-memory.dmp
                                          Download

                                          memory/3432-234-0x0000000006FC0000-0x0000000006FDE000-memory.dmp
                                          Download

                                          memory/3432-77-0x0000000002970000-0x00000000029A6000-memory.dmp
                                          Download

                                          memory/3432-76-0x0000000002900000-0x0000000002910000-memory.dmp
                                          Download

                                          memory/3432-236-0x0000000002900000-0x0000000002910000-memory.dmp
                                          Download

                                          memory/3432-249-0x00000000079A0000-0x000000000801A000-memory.dmp
                                          Download

                                          memory/3432-250-0x0000000007320000-0x000000000733A000-memory.dmp
                                          Download

                                          memory/3432-254-0x0000000007370000-0x000000000737A000-memory.dmp
                                          Download

                                          memory/3848-270-0x00000000057F0000-0x0000000005E08000-memory.dmp
                                          Download

                                          memory/3848-273-0x0000000005430000-0x000000000546C000-memory.dmp
                                          Download

                                          memory/3848-269-0x0000000000400000-0x0000000000420000-memory.dmp
                                          Download

                                          memory/3848-272-0x0000000005500000-0x000000000560A000-memory.dmp
                                          Download

                                          memory/3848-271-0x00000000053D0000-0x00000000053E2000-memory.dmp
                                          Download

                                          memory/4176-136-0x00000168DA0C0000-0x00000168DA0C6000-memory.dmp
                                          Download

                                          memory/4176-146-0x00000168DA0D0000-0x00000168DA104000-memory.dmp
                                          Download

                                          memory/4176-133-0x00000168D9CF0000-0x00000168D9D36000-memory.dmp
                                          Download

                                          memory/4176-148-0x00000168DA100000-0x00000168DA106000-memory.dmp
                                          Download

                                          memory/4392-302-0x0000000000400000-0x0000000000541000-memory.dmp
                                          Download

                                          memory/4404-100-0x0000000000BB0000-0x0000000000C3A000-memory.dmp
                                          Download

                                          memory/4404-147-0x0000000005C10000-0x00000000061B6000-memory.dmp
                                          Download

                                          memory/4404-130-0x0000000005420000-0x000000000543E000-memory.dmp
                                          Download

                                          memory/4404-124-0x0000000005440000-0x00000000054B6000-memory.dmp
                                          Download

                                          memory/4496-237-0x000000006DF20000-0x000000006DF6C000-memory.dmp
                                          Download

                                          memory/4496-79-0x0000000002CA0000-0x0000000002CB0000-memory.dmp
                                          Download

                                          memory/4496-192-0x0000000006340000-0x000000000635E000-memory.dmp
                                          Download

                                          memory/4496-127-0x0000000005E30000-0x0000000006187000-memory.dmp
                                          Download

                                          memory/4496-80-0x0000000005540000-0x0000000005C0A000-memory.dmp
                                          Download

                                          memory/4684-171-0x0000000000400000-0x0000000000414000-memory.dmp
                                          Download

                                          memory/4684-107-0x0000000000400000-0x0000000000414000-memory.dmp
                                          Download

                                          memory/5028-169-0x0000000000400000-0x00000000004BD000-memory.dmp
                                          Download