Overview

overview

8

Static

static

1

run.bat

windows10-2004-x64

8

run.bat

windows11-21h2-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    101s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/05/2026, 18:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    run.bat
  • Size 50B
  • Sample260525-w5drvahv21
  • SHA256 38b4db9ad8d01c0e4da67c3d216e4a9202c86b3ab02982f4f8f2661b9b1e8df2
  • MD5 SHA1 SHA512 TLSH
Score
8/10
collectiondefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: LoadsDriver 11 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
    1⤵
      PID:3904
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4204
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff81ad8c728,0x7ff81ad8c734,0x7ff81ad8c740
        2⤵
          PID:4568
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,7917447578941974433,4436980656127425321,262144 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
          2⤵
            PID:772
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,4771049880534857537,1189309104120367831,524288 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:3
            2⤵
            • Downloads MZ/PE file
            • System Time Discovery
            PID:4656
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,1010594101758476600,10823436131730767214,524288 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2564 /prefetch:8
            2⤵
              PID:4348
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,601321369603835942,14859898194794173826,2097152 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
              2⤵
                PID:4736
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3392,i,16055896574938268845,15375640133128156297,2097152 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:1
                2⤵
                  PID:2308
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,6250865342765313208,6478234645454980360,2097152 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4392 /prefetch:2
                  2⤵
                    PID:5020
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,3731562750625562958,12316952009343524631,2097152 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:1
                    2⤵
                      PID:3020
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,14938599601357748728,16259579976874932847,524288 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:8
                      2⤵
                        PID:4992
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5776,i,15811598603774897517,7144582088438892857,2097152 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:1
                        2⤵
                          PID:3824
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3612,i,143212658324870801,7606342327204758192,2097152 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3624 /prefetch:1
                          2⤵
                            PID:3368
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3588,i,11815672240237128768,5334779200750477824,2097152 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:1
                            2⤵
                              PID:4004
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,11547032909398937024,6174774241812054395,524288 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3412 /prefetch:8
                              2⤵
                                PID:2336
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3388,i,3251761005193460368,9022009912968114674,524288 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:8
                                2⤵
                                  PID:3668
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,767865176686373090,5163002015217509875,524288 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:8
                                  2⤵
                                    PID:3264
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,3393340423568323165,17982429256412708023,524288 --field-trial-handle=1936,i,2351356009338324721,3051867381607371455,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4520 /prefetch:8
                                    2⤵
                                      PID:3708
                                    • C:\Users\Admin\Downloads\HitmanPro_x64.exe
                                      "C:\Users\Admin\Downloads\HitmanPro_x64.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Modifies system certificate store
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of WriteProcessMemory
                                      PID:4180
                                      • C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe
                                        "C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe" /update:"C:\Users\Admin\Downloads\HitmanPro_x64.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4916
                                        • C:\Users\Admin\Downloads\HitmanPro_x64.exe
                                          "C:\Users\Admin\Downloads\HitmanPro_x64.exe" /updated:"C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe"
                                          4⤵
                                          • Drops file in Drivers directory
                                          • Executes dropped EXE
                                          • Impair Defenses: Safe Mode Boot
                                          • Unexpected DNS network traffic destination
                                          • Accesses Microsoft Outlook profiles
                                          • Enumerates connected drives
                                          • Maps connected drives based on registry
                                          • System Location Discovery: System Language Discovery
                                          • Checks SCSI registry key(s)
                                          • Modifies system certificate store
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • outlook_office_path
                                          PID:4224
                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                    1⤵
                                      PID:1428
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                      1⤵
                                        PID:888
                                      • C:\Program Files\HitmanPro\hmpsched.exe
                                        "C:\Program Files\HitmanPro\hmpsched.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:4100
                                      • C:\Program Files\HitmanPro\hmpsched.exe
                                        "C:\Program Files\HitmanPro\hmpsched.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:4200

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            hmpsched.exe
                                            • Path C:\Program Files\HitmanPro\hmpsched.exe
                                            • Size 151KB
                                            • SHA256 b2b50833a1275b6f5df8239ad88a6279b8c939f21e541da53cf1edaa22b7c53c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            hmpsched.exe
                                            • Path C:\Program Files\HitmanPro\hmpsched.exe
                                            • Size 151KB
                                            • SHA256 a11f91bbe7eaa260ba5d60b475612f26302ddc47b726a3e6b48282c98bfbad92
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            HitmanPro.lnk
                                            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\HitmanPro.lnk
                                            • Size 1KB
                                            • SHA256 763238cfba184998e47dede86a3a09b89848c0efa4a814a54069b606cbabaed8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Remove HitmanPro 3.8.lnk
                                            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\Remove HitmanPro 3.8.lnk
                                            • Size 1KB
                                            • SHA256 8ec137868bc558031ab19da868aa7b2e5b18908b9c867871f5d2dd099ba5724f
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            BookmarkMergedSurfaceOrdering
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                            • Size 6B
                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            BrowsingTopicsState
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                            • Size 649B
                                            • SHA256 c758b7afbf457f04d8951d9a68273978fb845fb58a20bec6e396324df89a0e1d
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            the-real-index
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                            • Size 792B
                                            • SHA256 3f3040077c6e77c589b3b237d58152361fd52f058b0a87b1e2be5579f2860027
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Cookies
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                                            • Size 28KB
                                            • SHA256 da06f0e2a73af05e1b7c7058bb97723c12d81183a0d4865fe9d22abdb858ebcb
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Network Persistent State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                            • Size 5KB
                                            • SHA256 4a30c526116be419ae64c65daa819bd90aac09c4a63b6f6a8a5acf0cc94037ac
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            SCT Auditing Pending Reports
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                            • Size 2B
                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                            • Size 12KB
                                            • SHA256 8861f57f3f4c1916bc568689abf3f171e555628668adb31df4d677152c15b582
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                            • Size 13KB
                                            • SHA256 7366b7b37121bab32e5aae725fb0398873f9fec3c1a34af8ed0b383ecefd07b7
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                            • Size 13KB
                                            • SHA256 0afd4dca7b7ff4a8d4431187188cb7fe9ca33cc7c90d7396b73e35f1cebaeaf3
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                            • Size 12KB
                                            • SHA256 8675aec0cb92a380ab9609d7b329aa4ee01459591cf685622cd959af053a2df5
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                            • Size 13KB
                                            • SHA256 a930f6727fafa4416d41c9a8fb7bc16b5a49d4bd08753f6586d0790c9955299e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Secure Preferences
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                            • Size 17KB
                                            • SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            the-real-index
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                            • Size 120B
                                            • SHA256 5247cc76e4d6d57a09ee4b06c1bb3f59b215b5304e964eea9f733a2f5f445afe
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            the-real-index~RFe58a60f.TMP
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a60f.TMP
                                            • Size 96B
                                            • SHA256 140713f0a906aa5450630e24122cf0e9ad9cebd91be7536f6a004e9d65b1986b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            the-real-index
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                            • Size 72B
                                            • SHA256 77ff35dd21755d2abfa6ff81b0871635d86d3a6333d31e74e03fe0aae697d660
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Web Data
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                            • Size 138KB
                                            • SHA256 bac0eda4511b6ac6167a52e95cca18da76221ad6acf490eee92d2e2a974af05d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                            • Size 231KB
                                            • SHA256 13185069871f635fa2f0538ab2a88e3a92f176140d4a62ac90e39e6969c4f8c1
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                            • Size 115KB
                                            • SHA256 dc78fb816ac9f588c2af2997cfb9f4275c0abf5edbf4b2ebc5687df44e47db72
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                            • Size 231KB
                                            • SHA256 0f3d27a898d1d16de99e6b7fcd6814a8bd573b3e719dae1c3b901923109104b0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                            • Size 272KB
                                            • SHA256 6a3946ac40587658c0e8c888f931d745908caf77777dda8a5e737da73cec5aea
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            HitmanPro_x64.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe
                                            • Size 14.0MB
                                            • SHA256 76cf297cfe3f64e872d8994d5ba758a42000f50b70c1f757076d61a67d667bd9
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Unconfirmed 82589.crdownload
                                            • Path C:\Users\Admin\Downloads\Unconfirmed 82589.crdownload
                                            • Size 13.6MB
                                            • SHA256 221ede5696634b6f2be0bfa6a5ea531bf93d78b7113facf34185ce305891d66c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            HitmanPro.lnk
                                            • Path C:\Users\Public\Desktop\HitmanPro.lnk
                                            • Size 1KB
                                            • SHA256 64ef53cab2ad34ba5253060ab8a1ff351de6847e271a566c2d220e9f68cfa43c
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            hitmanpro37.sys
                                            • Path C:\Windows\System32\drivers\hitmanpro37.sys
                                            • Size 42KB
                                            • SHA256 f8a4a64a75f3a00d814b1274373e33ac4e57022b1c68607d6ec82d79cf9fe988
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            memory/4180-256-0x000001A547C90000-0x000001A547CE5000-memory.dmp
                                            Download

                                            memory/4180-255-0x000001A547C90000-0x000001A547CE5000-memory.dmp
                                            Download

                                            memory/4180-220-0x000001A547C90000-0x000001A547CE5000-memory.dmp
                                            Download

                                            memory/4224-306-0x000001E94BC00000-0x000001E94BC55000-memory.dmp
                                            Download

                                            memory/4224-339-0x000001E94BC00000-0x000001E94BC55000-memory.dmp
                                            Download