1a123e8f0ae740e839dfd1b0e4feda4096ca028a3c819f24e230775e62e57d18

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DH.exe
Size 8.1MB
Sample260522-ws5d2aey71
SHA256 1a123e8f0ae740e839dfd1b0e4feda4096ca028a3c819f24e230775e62e57d18
MD5 97f5ab70e4a9c11fc4517b83891c3d5d
SHA1 f4ea75e60f9c92fda4d21a162f2710c1f9b6111f
SHA512 f56d14a16f0fd299498cb37dce0770ac6792ce5f0fe9634bc64fff532adc9b7fd85f7a9efcf73b80675c8094a7517e003f986b0190f17f42fb5ba3e1786feeb3
SSDEEP 196608:H8mjLciL1Z7RrRTlgFpgd+9RcvFe9EIadD:vjLfRrJiFpgd+9RSaad
TLSH
T17A86E169D2A922A4C07BD4345503F50AF1B1722D87B853E77BC62F425FAABF0D57AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery vmprotect

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	DH.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2964-825-0x0000000140000000-0x0000000140826000-memory.dmp	vmprotect
behavioral2/memory/2212-827-0x0000000140000000-0x0000000140826000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2964	DH.exe
2212	DH.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3476	WINWORD.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
236	chrome.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239471785382700"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{060774D3-742F-4DFE-9FE1-0501BD7E839E}	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\DH.zip:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3476	WINWORD.EXE
3476	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
2964	DH.exe
2964	DH.exe
2964	DH.exe
2964	DH.exe
2212	DH.exe
2212	DH.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe
Token: SeShutdownPrivilege	3144	chrome.exe
Token: SeCreatePagefilePrivilege	3144	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe
3144	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3476	WINWORD.EXE
3476	WINWORD.EXE
3476	WINWORD.EXE
3476	WINWORD.EXE
3476	WINWORD.EXE
3476	WINWORD.EXE
3476	WINWORD.EXE
3476	WINWORD.EXE

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1500	3144	chrome.exe	86
PID 3144 wrote to memory of 236	3144	chrome.exe	87
PID 3144 wrote to memory of 3148	3144	chrome.exe	88
PID 3144 wrote to memory of 3148	3144	chrome.exe	88
PID 3144 wrote to memory of 3880	3144	chrome.exe	89
PID 3144 wrote to memory of 3880	3144	chrome.exe	89
PID 3144 wrote to memory of 4600	3144	chrome.exe	90
PID 3144 wrote to memory of 4600	3144	chrome.exe	90
PID 3144 wrote to memory of 1400	3144	chrome.exe	91
PID 3144 wrote to memory of 1400	3144	chrome.exe	91
PID 3144 wrote to memory of 1220	3144	chrome.exe	92
PID 3144 wrote to memory of 1220	3144	chrome.exe	92
PID 3144 wrote to memory of 1020	3144	chrome.exe	94
PID 3144 wrote to memory of 1020	3144	chrome.exe	94
PID 3144 wrote to memory of 3900	3144	chrome.exe	95
PID 3144 wrote to memory of 2280	3144	chrome.exe	97
PID 3144 wrote to memory of 2280	3144	chrome.exe	97
PID 3144 wrote to memory of 876	3144	chrome.exe	98
PID 3144 wrote to memory of 876	3144	chrome.exe	98
PID 3144 wrote to memory of 2076	3144	chrome.exe	99
PID 3144 wrote to memory of 2076	3144	chrome.exe	99
PID 3144 wrote to memory of 664	3144	chrome.exe	100
PID 3144 wrote to memory of 4036	3144	chrome.exe	101
PID 3144 wrote to memory of 4036	3144	chrome.exe	101
PID 3144 wrote to memory of 4488	3144	chrome.exe	102
PID 3144 wrote to memory of 4468	3144	chrome.exe	103
PID 3144 wrote to memory of 4464	3144	chrome.exe	104
PID 3144 wrote to memory of 2040	3144	chrome.exe	105
PID 3144 wrote to memory of 2040	3144	chrome.exe	105
PID 3144 wrote to memory of 3580	3144	chrome.exe	106
PID 2964 wrote to memory of 2212	2964	DH.exe	113

C:\Users\Admin\AppData\Local\Temp\DH.exe
"C:\Users\Admin\AppData\Local\Temp\DH.exe"
1⤵
PID:1888

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\PingMove.docx" /o ""
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff53cec728,0x7fff53cec734,0x7fff53cec740
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1816,i,11184501656895261190,251731102266366641,524288 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:11
  2⤵
  - System Time Discovery
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,18400594570162247324,14056142163021079267,262144 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,6446827216069841179,9009276684700122745,524288 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:13
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,16896750957284692249,15886018714687163184,2097152 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,14241110106363017845,8565582637160211627,2097152 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,1164269584786975676,8884050770280069725,2097152 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4348 /prefetch:9
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4868,i,17156741003607780305,7959322717954235442,2097152 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,8586591930626776779,3656284693953824017,524288 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5872,i,7309281871953160704,13068861334303435786,2097152 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3708,i,371816520220772573,794429182631502241,2097152 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5976,i,1190868644881196090,12947258244939906039,2097152 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,7274754450072260932,4807272659756258657,524288 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  - Modifies registry class
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3712,i,13571343935373901944,9083864205128892524,524288 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6004 /prefetch:12
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,8417485535788134137,989568545578756592,524288 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,11271621939164722078,6100789620107957336,524288 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6200,i,1429019724909606592,1092847253352398190,524288 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4464,i,15187340620690368370,3094742362838332107,2097152 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,5776250872614638843,5099631378728888838,524288 --field-trial-handle=1972,i,7526946589399977891,4615998456227914300,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2964

C:\Users\Admin\Downloads\DH\DH.exe
"C:\Users\Admin\Downloads\DH\DH.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\Downloads\DH\DH.exe
  "C:\Users\Admin\Downloads\DH\DH.exe"
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d86c6393e4920f5caa6d34e463e974ee5360bb81c57ada76cb33f9edaa141a66
MD5 ddc189afcbe5c22d4b24d9ddc6666ee2
SHA1 b53ee1f1f2f7af1857d82971c6a795a28b905caa
SHA512 149dd0015b5c6f80b571cdcb210c517c753dcbdbd0e51ca6c1d08e210f5484e61514d987f1085d84051ab6b41d87553a29a1b5000424d31cc4ec93e113ea0eac
TLSH
T113F0A4B6CA21AC3B2CFD0B2D74984B47EB5013672B91995B3A3D520D8FB163B8585D1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 70a0d770168dbe3db842fa3a398d09dfc2087d0773c78521a1c9cb7a1fc08619
MD5 8a63c7577d80ad89d481f3b70376401a
SHA1 02af8d1e2bfc278b1a9a550c2a492bdadfd7d43d
SHA512 e277d9432b1a697574580ad99045c69d57b1a2c1bdb04e6ac3aa98e8aceaab6e1d2d0c00ff07613e2142c4b281c38369b03e7d31e3f6f8c808236207d31a2caf
TLSH
T15751734482EF0B5EEF533BB462500E83E17B0F21DFD69B7B1348A4D0A453EA4174253A
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 784523052a01354afeca8d3ceaadf159a74f2f081bd49d6b226cdb270b7ce9d6
MD5 aaba3989ddf171aabd68cffcad92e6c7
SHA1 89d70b73e47ff862c687e756aea8c9eaa79e4b13
SHA512 67f861f7e0eb4fdb8062597f03ba794f5b339d3abfb6b895685071f52586d903f6cd5b94f01968f3d15aaaae5d228e65a89595a3d5ab04d972463f2bc1a04108
SSDEEP 192:DZnnIb/3fU/9HecdmlBDGuCKVKf81j1C/qAZqf1EWzrJiF8zBPYg/3Gh5u/d:DZnnIb/3fU/9HecdmlBDGuCKVKf81pC8
TLSH
T166326DF7C3E8CA6DC81157F4A7246E1FCE1E0A18532D3C1689D9AF4B93E2872D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 948a978a618de9941e6a0580af560d538a64c4665c1d08086fbbffce0134982a
MD5 46ee11a17f7c6844f2f5e981816df299
SHA1 413ab751c266d36fa3b22b3792cfaf3b5a4fb721
SHA512 9efeea3685cf1a3af6964e29424bf28a05e3fa8384a50f02b1a7227016a2010539bccdd2c485ba002338883a23123682511607acb1a90ca1a3c0523e8214765d
SSDEEP 192:ZRpcBzf1xJakIhUv7sBhAPRp2aZA9NHsb+WNne44nz24x9kwyNVyIsnAUgtaJ:ZRpmzNyQ88XurwbK2288
TLSH
T13942E82FBD10697B9CDBC22AF9167713E7F5102226D42E84EAFC8A1C14E7ADD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ed3b6dac67d68fe670b398d5bce08206ef9bf2ed91a7107edb17bb59b2463b06
MD5 d5ea445f2f97aef9ce6561d5558da81a
SHA1 e2141cbd977897dc0864053d68de694474ce8e7c
SHA512 f88b3b65e0d95c38029239f0d32e6fde7fc6c700b1f0098298c8b5a9c935e3056a9d28dcf5e527039e9312bda958c6732beb7acbeef397d9e208a9acffee6bf6
SSDEEP 192:ZRKcBzr1xJakIhUv7bBhAPRp2a4H4j9NHsb+WNXmj6Le4tpp+nz2fx9kwyzVyIsB:ZRKmzpyQJ8XVrwWGPBM2bCe
TLSH
T15852FA2FA910697B9CDBD226F9127727E3F5202225D42E40EBFC8E1C15D7ADD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9bf22242760925e033642d2efbd2fe785fdf4a796355dea202ca5c5d50a50215
MD5 e337032a5d3b29760ba68267037d647f
SHA1 522bde3817e84d1f04f33260f5ed2e10e18a99a3
SHA512 0951feda4b3442b06e0bf67b3caafd13da128635d2b2721dac9c947099279590b9a703e70a46169302d00f221041725f518f5cbf5214f1af8fa9dc5fca1e072f
SSDEEP 192:ZRpcBzf1xJakIhUv7bBhAPRp2a4HA9NHsb+WNF6Le44nz2Vx9kwyzVyIsnAUgraJ:ZRpmzNyQJ8XprwoPK29Ce
TLSH
T16852E92FB910697B9CDBD22AF9127723E3F5202225D42E84E6FC8A1C15E7ADD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 765d9b0b707b7cabfd00243c4a766bdb650837c29a6e08e191d25b34f75ff86c
MD5 d368f853011c4814956449df92f31200
SHA1 285f3ded5b25e0ef3e0630829b7000c109da0ffe
SHA512 f7345fd193917981ef204600f029b26c4845ddf9daadb2ea2c0358a90f24693c77910e64a7adfc9b455623ecf0b54064394658cb45ca5d331992ddf615b114ff
TLSH
T1D9C01281C80AE121C04B03F52586A89CB2749F21D60A3B4843F05D57E839222C127191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3f2e1af4d64d7f49a5d12b61aac8ef25a88d35569d5e2232a45e0a5fb1553986
MD5 655fb4551895a458f2a7c34f745b5609
SHA1 c540a24810d87b5e55ebe036237a64beb9e0bb81
SHA512 22fab72aecc58b799a4b09fbbc2bb36b0d93b773b1632303e480b9a2101255641388e906458d8d01207cb6a46342a76425e766d51139d3d1c3c93b2ea82aaf83
TLSH
T1F0B01204C0455501C08202B421422498B1745F10FA0B1B0683F0792BC8252628414050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592cc3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592cc3.TMP
Size 96B
SHA256 0d6488720b4c0706bbae2e236e96b63ba9eb7f98146a65e2c5b0bdb464294465
MD5 1efa1f8877b4fd9655f108871891515e
SHA1 95998d016e71984a2817ea3dfe65f18a0401c0c8
SHA512 6a62ffe861e3672809aa2910b370304dbc30cb49ea0c9adfff451161bfe4788c70af9633990cfc5b817addf7e1d645931ed0d3241fefdc5d72d21ca040ea02ff
TLSH
T103B00255C1067756F04283B02D9599D8B160FF3BC7131223D2E05B66DC35A715529660
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\1b03bcf4-ce3a-4f77-8bb1-bfcdf6997ac0\index-dir\the-real-index
Size 72B
SHA256 67a6fd6fe051bb036b98603f7a841f0f543c216422737b1ce6ebae2df4830339
MD5 dacc3e6ddebb8cc0a655033e185ec9c6
SHA1 128635f0c3fc4a8029a41a77a8d539682bcfdc7a
SHA512 91680198d2131d04fe0cf5d507196e624ea0866c5118b851a0a7e756ee6ba5ce3fa2a3339425347e4618033a493781ec8a41fdc37729fb0b7e56aa9460fddaeb
TLSH
T119A0027C15510218C92011B424370562333E4911FC04030AD0D1B598C9D10E5810727C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5969ad.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\1b03bcf4-ce3a-4f77-8bb1-bfcdf6997ac0\index-dir\the-real-index~RFe5969ad.TMP
Size 48B
SHA256 872d5002dcf1cfe310a8fcec531340e02033b5b54f1c5b8d5ac81b67d41c718f
MD5 c30b4317126b7fcb833e98e16daa1528
SHA1 0239cd21d2d416158e7868da3d67abaef34d8589
SHA512 a8af89bdd6632dc3897e5602f579553b3082e314ef0405922ed95cc9820474d1002eeee866e69f1e0daec8986bbdb5669646f8191b2cc59798f1d5dd81bc5a71
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 79B
SHA256 a4c6cea5357c17b9df6ebec784ee95a2d343be676a4667a38dc7ab349e18fcba
MD5 5129a98afa330739a86754df28747090
SHA1 f1a32746c84272a7efe83b84effb06a401399140
SHA512 e2b8782f59e9951469a8da17115dc1b54c4162ad2a1f03923a043b913de445e5dcafd82bbb6371c2412bacf7b6cb34f69ce5824db8cd048855457a93dad3b08f
TLSH
T160A002FF081488DE4F30E9E92234B25DE14B919C9DD1CEF0CD1991576139B771003914
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 160B
SHA256 3805168505e44033953a549762d2220d698b5c6524a9095264d91831bf6b2abb
MD5 63973bb20a41387b1c9f20405ccb2ef8
SHA1 9cd58572c3d6614ac4521516b2cf40f08a819c3c
SHA512 130e959093bc7573d7ca9bc116b8cc67cbe5ff13187efdba333f229bc7803fa8acc28003243a307f46711379c6db886208531269ca8e3b33566023766ea53104
TLSH
T1E9C08CDB04204A8A0B30A9CA2038361DE2178C1C8CC5CCE89946B047A0789234041628
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 154B
SHA256 5134e7a10aaf44559f84721c1e99b91d5f4bc775c6e5e38d7cbcce8cd69f53c4
MD5 a9836e2dafd8c9f6244edcbc90f9c046
SHA1 ca841f60a701e258280cecbea6a8557a6aac991a
SHA512 2e89c00214169e51bde9029b94cfeb66d574e99f17da88c79674ec3f77438d5a1303304d89ef5b7a32b19c8ae4beadd485ba17d4bf94ca2f7034bebcad6eff5c
TLSH
T19FC08CDB04208A8E0E30EAC92028362DE207850C8CC5DCE89944904B90B89230802628
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe594b28.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe594b28.TMP
Size 163B
SHA256 ee92e62d45e1ba19bb289ac4a0051d8c729ed79fc2ee925ef7c9743d8755bb26
MD5 7d35636b0aa2c4f72568982e6a3f27ec
SHA1 be93153b18365d888326a342974d2f04534ae235
SHA512 e4e3927c09fa55a87ed8b913a30c54bb2e46092192700cd700f5ac28b5c67477b3143d2ec1e1e17795ef294a0b0068f25caea85031c53fc306e31f95a5e87de5
TLSH
T1E8C08CAB443088992B3099D11034744CD156AC1EADC0E8E49E80F16A34B8632950B524
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 81c35b45430ee149713c71cbc3fdb030fbb68daa0bd2ff1b90f9092e5e858572
MD5 e7ffed3fe524798070db0b60b5385ed6
SHA1 525c7511c036a73e1af7127f6824b41c75b04340
SHA512 4e3775c84a98832fb275babdb95fd919581ce51db89525beb9f6d161caa437ff1c1b51a4d6271c1535a195a0e3183c1e39d9f9e9ad8aad32215519084a7a6bc2
SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:Vm7Rkm1tYpBeh2BAoe
TLSH
T1E6C3123B5E75A97799B5B70EB08E0B1F1EF14EA6C920DE82C8D85B0437E97CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 8780a0b7835261150c9758635adebceef7ad6f092b1f75f461be042252fdc691
MD5 8f4f11c445ff329668f5ee949ef3d299
SHA1 e39ee4f7c92b7624bb53cbd3198c6a4c3a9f3cd9
SHA512 dd47465553eb579ec88bbe4072d6262a8e3db1755dbcf6476f5f8d443bbddca1d177db782446c065b6d323bc8fd4662d0623ea9a031cf810244e502ffa235c00
SSDEEP 6144:8hFJe11/oaR4E9v4V8p35GnoEDQjm7Rkm1tYpBeh2BAof:ME11nSImpDQS9oBGcAof
TLSH
T1DB34133E2CAAAD72ACB5EB2B50CB0F0D1FF1C677C0258AA8C5E9870427E97D91104D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 59c77545b2c6d09ec1bd225746ccc93d0a83583d6b5ff9876eb74327aac8582a
MD5 a249fdc48c51a7bfae0318485e280d96
SHA1 76be3726e882b575b4ec41d53c7851ee70fbf478
SHA512 8356770be900824b23373edb47ab5d3aa029cb15b9d500f87657808c822064f748f84689a83a5ad4c0325aaba5f217cfb589cf3ffec57d5c1183e967be832420
SSDEEP 6144:7hFJe11/oaR4E9v4V8p35GnoEDQjm7Rkm1tYpBeh2BAof:jE11nSImpDQS9oBGcAof
TLSH
T19134133E2CAAAD72A8A5EB2B50CB0F1D1FF1C577C0258EA885E9870427E97D91104D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 d58eda483446d19fa7897d1c927ce0f361afa60928fdf0bee6fb4fde4cf075a3
MD5 336cdb5eb1b23e798475b5ab06f19dd1
SHA1 4cf513a20245ea68a44c27de1a36894b608b0cd3
SHA512 1105467c92a550d3a57d6f4890ac0d7093d24940e9b392ec351b03b6b007aed10ec7c0230edfd995954dcfc36d27ef7c8964c41f96fbd8debd46a59c473f4d3e
SSDEEP 6144:HhFJe11/oaR4E9v4V8p35GnoEDQjm7Rkm1tYpBeh2BAof:PE11nSImpDQS9oBGcAof
TLSH
T11834133E2C9AADB26C75EB1B60CB0F0D1EF1C673C428CE6885E85B0427E97DD6508975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 198B
SHA256 29a40554c66ea3712e7148f41b4b6b2f00ac9e25458c9f56c93eb4a2cb434264
MD5 5aebfc94290fdd1fd1e7eb9a5f228f75
SHA1 586342ed0586ef23c91da0b298c223aab26da474
SHA512 73c19a298269c1f84bdc168c7289265d6295b3f88cc8e3f29219df31a690b75ccc2834c163d20dd73afcf58f816b3e6f3fd32893bbc0ccb989437e04b17df835
TLSH
T103D0C90F5336E7F0833C41A439388DE14BF28834C6A9242119CC2CCA0D88247526B955
MD5 SHA1 SHA512 TLSH

Submit Download

DH.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\DH.zip:Zone.Identifier
Size 52B
SHA256 161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67
MD5 dfcb8dc1e74a5f6f8845bcdf1e3dee6c
SHA1 ba515dc430c8634db4900a72e99d76135145d154
SHA512 c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d
TLSH
T1A190025B044444440A9571C495DC9658A41F79994D4512C4EC8044D69D840AC51E452A
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 6405516f5c91e8e48fc0e7ed4441bb97a3180aa332fcd32d65f120d02b9d9f81
MD5 74d8dc8d6aa0902d519abdf58b918b14
SHA1 34d77706b34d44077f4a0577687c981b58085ae0
SHA512 374fdcfdb7388ae92ab5c4e0829dac36b07d104b79c52846344050e0cb106e75c425ac29881db3d5736f391cbf94e7db9c69eac1ef50c6351e97652165b0f254
TLSH
T13021DF360645919D21F341950828B42FE31FD0EB0D6B99C93F8E440E7BB2A0C536664A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2212-827-0x0000000140000000-0x0000000140826000-memory.dmp

Download

memory/2964-825-0x0000000140000000-0x0000000140826000-memory.dmp

Download

memory/2964-824-0x00007FFF63470000-0x00007FFF63472000-memory.dmp

Download

memory/3476-7-0x00007FFF63260000-0x00007FFF63469000-memory.dmp

Download

memory/3476-40-0x00007FFF63260000-0x00007FFF63469000-memory.dmp

Download

memory/3476-2-0x00007FFF232F0000-0x00007FFF23300000-memory.dmp

Download

memory/3476-3-0x00007FFF63304000-0x00007FFF63305000-memory.dmp

Download

memory/3476-6-0x00007FFF63260000-0x00007FFF63469000-memory.dmp

Download

memory/3476-95-0x00007FFF232F0000-0x00007FFF23300000-memory.dmp

Download

memory/3476-9-0x00007FFF63260000-0x00007FFF63469000-memory.dmp

Download

memory/3476-10-0x00007FFF63260000-0x00007FFF63469000-memory.dmp

Download

memory/3476-13-0x00007FFF210D0000-0x00007FFF210E0000-memory.dmp

Download

memory/3476-12-0x00007FFF210D0000-0x00007FFF210E0000-memory.dmp

Download

memory/3476-11-0x00007FFF63260000-0x00007FFF63469000-memory.dmp

Download

memory/3476-8-0x00007FFF63260000-0x00007FFF63469000-memory.dmp

Download

memory/3476-5-0x00007FFF232F0000-0x00007FFF23300000-memory.dmp

Download

memory/3476-4-0x00007FFF232F0000-0x00007FFF23300000-memory.dmp

Download

memory/3476-94-0x00007FFF232F0000-0x00007FFF23300000-memory.dmp

Download

memory/3476-1-0x00007FFF232F0000-0x00007FFF23300000-memory.dmp

Download

memory/3476-96-0x00007FFF232F0000-0x00007FFF23300000-memory.dmp

Download

memory/3476-0-0x00007FFF232F0000-0x00007FFF23300000-memory.dmp

Download

memory/3476-98-0x00007FFF63260000-0x00007FFF63469000-memory.dmp

Download

memory/3476-97-0x00007FFF232F0000-0x00007FFF23300000-memory.dmp

Download