58d63d63ba58859fbdcc888842856d054bdf551945c0d8d03dc9489d6df24c05

Analysis

user interaction
yes
max time kernel
299s
max time network
282s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XhangerCS2Lite.exe
Size 1.1MB
Sample260623-tpkt4ses3k
SHA256 58d63d63ba58859fbdcc888842856d054bdf551945c0d8d03dc9489d6df24c05
MD5 3ed2c582c7310b2926ab8ddcb1fadd2f
SHA1 20102cc731a607b572000cb9f9c093f0d6604790
SHA512 50be358072412edce6f414255d10f38bbb74a2d4001064344fae8f2c5d0efa347ff9460930816af81b1b460e9620f518cf5d4faa42baf22e10d5fb3771aa07d9
SSDEEP 24576:C4SCctUXaZ9EzOUoIyGfoJVNbjZO0R5P3rjD3gPH2EF1:CInXaZXHzGfmBOw3rjDZs
TLSH
T1DB35D003F3A2C33ACB17283186A6E762567FBC501B12918773A82959DFD31E04F9B6D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XhangerCS2Lite.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1608	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267049870026615"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
3056	chrome.exe
3056	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe
Token: SeShutdownPrivilege	2208	chrome.exe
Token: SeCreatePagefilePrivilege	2208	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe
2208	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 4492	2208	chrome.exe	108
PID 2208 wrote to memory of 3024	2208	chrome.exe	109
PID 2208 wrote to memory of 3024	2208	chrome.exe	109
PID 2208 wrote to memory of 1608	2208	chrome.exe	110
PID 2208 wrote to memory of 1052	2208	chrome.exe	112
PID 2208 wrote to memory of 1052	2208	chrome.exe	112
PID 2208 wrote to memory of 2004	2208	chrome.exe	113
PID 2208 wrote to memory of 3252	2208	chrome.exe	114
PID 2208 wrote to memory of 2004	2208	chrome.exe	113
PID 2208 wrote to memory of 3252	2208	chrome.exe	114
PID 2208 wrote to memory of 1504	2208	chrome.exe	115
PID 2208 wrote to memory of 1504	2208	chrome.exe	115
PID 2208 wrote to memory of 2964	2208	chrome.exe	116
PID 2208 wrote to memory of 2964	2208	chrome.exe	116
PID 2208 wrote to memory of 3040	2208	chrome.exe	117
PID 2208 wrote to memory of 3040	2208	chrome.exe	117
PID 2208 wrote to memory of 4184	2208	chrome.exe	118
PID 2208 wrote to memory of 4184	2208	chrome.exe	118
PID 2208 wrote to memory of 4988	2208	chrome.exe	119
PID 2208 wrote to memory of 3740	2208	chrome.exe	122
PID 2208 wrote to memory of 972	2208	chrome.exe	123
PID 2208 wrote to memory of 1548	2208	chrome.exe	124
PID 2208 wrote to memory of 3056	2208	chrome.exe	125
PID 2208 wrote to memory of 1388	2208	chrome.exe	126
PID 2208 wrote to memory of 1388	2208	chrome.exe	126

C:\Users\Admin\AppData\Local\Temp\XhangerCS2Lite.exe
"C:\Users\Admin\AppData\Local\Temp\XhangerCS2Lite.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff91eaec728,0x7ff91eaec734,0x7ff91eaec740
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,15454646396490311023,12620445120666093310,262144 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,18091291678376062689,14720689435604122678,524288 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,6566747781966826394,10983224561429885243,524288 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,3544572563427013521,10524840323899134332,2097152 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,8154446913644872786,13815548783562333499,2097152 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,9272078515710668042,14010286179546748186,2097152 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,10620700168871734991,15133078024089347551,2097152 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,3093685217644825781,3566175416231354634,524288 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5008,i,1058339245844736990,3581054454264763737,524288 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,8144142992315422375,8077261783033407102,524288 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,7266776476082621321,16904715177849019985,524288 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,8658489825271401068,5021040690126548240,524288 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5972,i,6543964914413038366,14808512746527202024,524288 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4484,i,15902256221787154423,515346040770086394,262144 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=864,i,1991368073782036955,3491311668679275346,524288 --field-trial-handle=1972,i,3976797040838897922,2041200425206230873,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1272 /prefetch:8
  2⤵
  PID:1388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c3a26cf4e5aee44fc871c046fc9c82eecd9a5042f020988fb70c01d68457dd66
MD5 f561b78f83150a153e543d7f991df2cd
SHA1 081664409bcc6be023673cd809e6a28fbe429fb5
SHA512 006ac6e4ff8b19937e138ea26fb00e5ad37eb70dd1efb13d266261f3c0a45f01ca912fec78d482a7f7c512aa0226db7398d87467c919097bae0458bb27fe3f0c
TLSH
T1D6E022AACA219C2708F91B2834144746F741131B3F90C80F3A3E92088FB5A3A82A686C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8db4e44e1cc8fb67c85b107c9b0dbd0e62e3f36f1a69de25ad6a82e81b5028d3
MD5 b9a3f742077845c8065c465848825112
SHA1 42071d17245298472b8fee0dfee31725b8154a41
SHA512 d2d5b22441f3139b22d1ea147089dacd8a49caed7a201113b26ee8c6d4c8410e9645d9b594dbc0f3f550072550abfd34740ccb4021e031da6cfb1d751ecca292
TLSH
T1F8519BB7D3E4C66E891196F4AB216E2FCE290A14431D3C62C8D4AF4B53F2872D21139E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 baa9f65f193934c524bea79a109c626c8b6d2186e28f7584f9a5e35a3d34ef88
MD5 aa88fa80f8c7cf60dc8d24fd9e76df61
SHA1 76c404447f5094f687788bf3c330fdd0e92cc739
SHA512 b44eba03ba89562ee9decb6f3e2269837f1dfef246f2702d5c489a79f12816f87d3d808334b10e50b40b865b4cc8158ef473a0ad0264bc8b89daab737e1da1ac
SSDEEP 192:mRkn7laCzDZv7chAPRp2qg9BHsb+WNnec0m4ykwVo9AVyIsnAUgtaJ:mRknpaK5w8XlgrwF0jyYE8
TLSH
T1DE42D72EAE1465BB9CD6D219FE157B53D7F5202226842DC4E6FC8E2C19F7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c3685182272acd929f9702fc595b5f694271393cf4f6ed3b40eab7c26a2a5881
MD5 b3c832249aec19da7cbc7e963c6cc55b
SHA1 9c3648656624cb0e9b09db1d795265cff28842eb
SHA512 7ea3479b94596c56a45d1b310b0054c62674c92426c23941d4010915d769528baf5ec92138e39711c518c475cf83110994a87448f58f8e9c6da950d3461a0d61
SSDEEP 192:mRkn7laCzDwv7chAPRp2qg9BHsb+WNnec0x4ykwVoIAVyIsnAUgraJ:mRknpaKsw8XlgrwF0KyVEe
TLSH
T1BD42E82EAD1465BB9CD6D219FE157B53E7F5202222842EC4E6FC8E2C19F7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 020750578acae9e04498d0acddfb54403af970e6ce7a0b3d5f776b9cd4d014df
MD5 17cff4755e1e4bc2dc104fcafc9446c3
SHA1 46eaa6596fd2f275744e2b498e8d574cf5f56f82
SHA512 135726e7fefc25670e1320297d8dbef5510e70a0fd75bb69baa0f3b8213d5043bc8c0ea647224fd76dae4703ce9cad773000c96d0ba5d8f7322f92d15af7d366
TLSH
T1F1B0124084019253C44202B4214278DC7115AF569A0A270643E0AD22C8252618015050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0541.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a0541.TMP
Size 96B
SHA256 f803a2d67856de5a27ac4dd1e74ea5e01d6711c0daa1e2305a9543db75843c17
MD5 2f06939c92852e796706863151a4f428
SHA1 7bc5ba36ed7ea487cd85abe42f5ef2fba0cef7f7
SHA512 2c8690c04901a9d8bda0befeb147200b736149aab85d61632e64c321e653c0e5199bc5f470b75121daeb9cd7588fa2ae7d4be2a587ee9f80b2f6aaf8f81ef6b6
TLSH
T1E8B02280C2022222C0820BB0288083E8F020CFA0CA0B330282E00AA2CC2C2302022023
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 a9c5616c019070d86c3b6bd46d06d967bc388562669edcce06896c7cdf2cd366
MD5 9cc3e3673bd0fec8c1034035cb0c243f
SHA1 158031e882b50e82da2ebf5f59a4091ccab915e8
SHA512 f0d72ebc74c69711ecdc69bc02ef7c1d61efa8887339537255718d914b9be5f91482ce56655195073dc6f4eec989ec35a0bdd8de0e0b30772315b374ca5654dc
SSDEEP 6144:kxX/BFY+GemGoCqzBkvuoVfxRtU6rFmUi21rSm8uUVNSlzYg:ovKGeBArPVfi21b8j8z9
TLSH
T1353423729D99B9B0EF1A21A074CA3B1D0EFC6E974E80C28053B19E554DED3499FF6C60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 af896e7f8058cfb7a942b5e5607d250404f048230cb63378bd68dccdad8e0a37
MD5 79ad2c05eda9615107f1046fd6a7eb79
SHA1 6368af173948ea0fcff92da389c941fdc3f67d56
SHA512 83636994b25d8e64f06c158dcd582a90ae1aa7ea8534827cfb70a0cab0642da9102ccf142d8052904952d17dfa285294e7818d4ceac39c74403f0be0f40e3ca3
SSDEEP 3072:SiFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:jFmUi21rSm8uUVNSlzY/
TLSH
T18AC31300BAE3F9F2EE5930447BEE2A145D6C4D818291C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 933e1bda490e71e9d8f869a084de83b29f70b9eaa54d626e6cbccba386586161
MD5 6ecbcbf4cf6369e700ee5b8c3f14752b
SHA1 f0af0ea1f5d8992db5298cedc8ba5d5756bf44c9
SHA512 a57491b5f69377e1b919cdfcb3830dc342e48064a21077bd3e77a277c9669c3949ee6ec9e22e90570e7ebcd3364be189bef01c575108397972118de8e70e2f1c
SSDEEP 6144:HX/BFY+GemGoCqzBkvuoVfxRtU6rFmUi21rSm8uUVNSlzYg:HvKGeBArPVfi21b8j8z9
TLSH
T1F83423619D9AB970EE5A21B074CA3B1D0FBC2E9109C1C2C053B29E958AED3895FF5C61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 ae6e10424cb86bf950df84578df40cf8dd2d2795845c285289970f35a931fcc9
MD5 b99e5bb64e153325649b0f1370069530
SHA1 85b62c04d27789de9c0c1b3a98f3387724bd11b8
SHA512 603d31fc8f46947a5c2f2bcb7bc16053650fec44764c852661ee1967ee4f5735d4c0d1c2add842a342ff950f41288039637e1b3ce7de8950af10dcf1d099c07f
SSDEEP 6144:UxX/BFY+GemGoCqzBkvuoVfxRtU6rFmUi21rSm8uUVNSlzYg:4vKGeBArPVfi21b8j8z9
TLSH
T1473423729D99B9B0EF1A21A074CA3B1D0EFC6E974E80C28053B19E554DED3499FF5C60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 40ad40e0e12db978bc31000d6826cd82de0bc253c0f194bd8141b6e0ddd03e83
MD5 935d31e583f95016ba4e2ccce90ddcda
SHA1 e2d5c5ac66bc97f5148f7cfdfe401b0e3884edcd
SHA512 4a1d784977548d50e2a2cac727e8af4c7a1c7a7d274f780ab676484d5670f23b2cf27c830e22114e4798629de457be7acd1e41a23dcac41b949419088153faaa
SSDEEP 6144:qX/BFY+GemGoCqzBkvuoVfxRtU6rFmUi21rSm8uUVNSlzYg:qvKGeBArPVfi21b8j8z9
TLSH
T1E13423619D9AB970EE5A21B074CA3B1D0FBC2E9109C1C2C053B29E958EED3895FF5C61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockRemove.shtml

Path C:\Users\Admin\Desktop\BlockRemove.shtml
Size 473KB
SHA256 6dc20cd3d5e951613c42f7a30d3d085b5de676ca8c400bb306251fb8b3038865
MD5 4bc8f66f887943fdf727fa37ceedcd07
SHA1 783815ccece9b6ca4f63895f3227d1a69636e247
SHA512 a281238f4c35c1723da60ab69581446409011bd7d037042b2a6fa98366b1370417e3ba3a0a53d6bcb16faedd641401a7830aaae8b904995181044d73b22e3e2d
SSDEEP 12288:ulJqEZ7BNUm7/VNi1xP76CCcoOI9Ej6IY4:ulJFZ7BK8/4C39me4
TLSH
T1E9A4237E04B362A590984D2BE4E7FFA7921EB9F02941C3B27A752467ED5D06DE13F020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeUninstall.ico

Path C:\Users\Admin\Desktop\InitializeUninstall.ico
Size 677KB
SHA256 99e9db606b8266e04d07826e1a13089cb851121500d5ae5577265f934c89d0af
MD5 235c5966159da0ce3a9be573db8f9f67
SHA1 82f0ebf600e079e5f136eeb1541ad12784c6c1ae
SHA512 ff0ddc1bcb42ffeb3e7a734f28634a8f869b80c1c1e27d2e0891b0fe7007b8962b90d0515a2bdb0ea5f7e1ad3731c13ddf1104e76186e7dd5f74e19db21addb2
SSDEEP 12288:2V4V1mQkkGOVDVSL+H3T+Q78fX2EXnAbj0UEGWywuGRxjFmBsUDOzn0jw:3mQkYDkL+Kso5Cj0UEbJj3jkHDe0E
TLSH
T187E42362DEF3C8D78948959A8DF8E740AE3041A733B88CDC4993545694974EDEEE3A0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockRepair.dotx

Path C:\Users\Admin\Desktop\LockRepair.dotx
Size 947KB
SHA256 9cca85408e5866b001af801b882f6e37890b77b743e7d3649dcd691c9e01551e
MD5 def7563458db4d600b03f05b64000a6e
SHA1 e011c6615f15491f7e23a01622a57c7c1ff1bdc8
SHA512 c2536f980bcb71671f3ec257ac78e433154afecbc97a843255eb1224fad709285da27168e6fa8a39d5ee025b9275d63bcf7d992ced3a96a05869600deea33773
SSDEEP 24576:hZkdUzf+Q/HY6/IC1OIjq9jXU/fm+JiKDXKhkHv+A+VHOh2:hZkdUT+Q/cC1OHIm+XyUv+Vn
TLSH
T1DC25338669BC732D94D33226EE1AEFCF694211FD4C8323E576118D62C3A3737A719990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OutInvoke.css

Path C:\Users\Admin\Desktop\OutInvoke.css
Size 1015KB
SHA256 a9ce655149ad67f958c6680eec7e81ccfba5b9db38e5215892a86073ed915dba
MD5 16980fd7fb66f7a7bc21ae99f53a9a3f
SHA1 1891ad81996d5246422ae2fd9bed20b6ec7c1b13
SHA512 8f00322e79e94862a756bcde3eca04f8d21f49318ac813359f5554ae701c736653ab4f4d70f125af2404991e7bbb65a5f5d9cb46c4709a909d4e6973ac031851
SSDEEP 24576:/qQSY/LHqqXEGl6WLb8rvkxPGxvpxyapZhVYH8m:/qQl/z6Gl6WLbav1xyYP7m
TLSH
T1362533F7B09071EBBA53E4C6A5A6C8F0E853ED500E5C455189FB433BBE27D462108E8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PublishUnblock.m3u

Path C:\Users\Admin\Desktop\PublishUnblock.m3u
Size 812KB
SHA256 08ec5aead7d9390512b19039f626e82349b5e7ddb1b30d24d93cccdba522ddd7
MD5 8784f6cb12c3b016a0dd265e509b8d7a
SHA1 1e80b68658db4091ccdcd3a8c347944675660fa3
SHA512 d9137457b3e43fc1f0496dd4b91f5df06be94a865edbac965bcc6e1f60c780b2598be9de6508ffd6cb73d77ffe53745185cf024d89b0897bf754cff4c290575d
SSDEEP 24576:Gf3qldSoJcNcLynLbcZXvljzToUkd/E5KY7i:A2nKbnLbcZXvDkNcKY7i
TLSH
T18305331914DC52C6BBCF889E579FD2281212E73E13B39824FBBB3519A86066FC485F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadCompare.ico

Path C:\Users\Admin\Desktop\ReadCompare.ico
Size 643KB
SHA256 9faa770d16aa59c0a71c699cbfb84962768e3f916a6697107fd50e8123512ae4
MD5 221f45c3e332fbe54432d1ab24d81de0
SHA1 cb52ea87f57e0ba1eab7d8aaf13891b23b8976c5
SHA512 2840de11928a274c03276c906b55068705bb16df699f6a828d9ebeaea0e4c2ac6ad952f12e6f624b9324a1325efe611d1b34ed299a00f00fc0e8680c5d6755f0
SSDEEP 12288:ZHBKdqhcGbJSu64HDZd0LqMJdTSp1OyTuOo3YeiIBcLBqpnv+BP95:B4dqWGVLH0tS3oIeiIK1qpnG995
TLSH
T17CE423C7D534281CF2AF97DD3751988F12E8EBC107E523E51196F4A456F4002ACBAA7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallRestart.ods

Path C:\Users\Admin\Desktop\UninstallRestart.ods
Size 575KB
SHA256 2348ab22673256e4eed030909d8210a416c3b1fc05625e603e19b672f9d0460f
MD5 8b95b0e420752ae20b532c15295743eb
SHA1 1d6b88bf35707301246fd18ef001a30850b1739e
SHA512 ee383e828232e08581d07e3f52dda860f1acd66aa6c04194be900e11030559ba50d9a706d08f8430051e40133ffc96f29d4ad1d6a1e9c6a16d72f9db761b8ca8
SSDEEP 12288:/X+Jx/+Cg9X+jK9luqkvVfgaR8AO+8MX7iQqtf2HZs8Cq:/fTujohQtRN8sGQqt18Cq
TLSH
T14AC423C6A643C307D326417B16D287D9B4F3D90FC3984B2A6695F601C834AF68AD97F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterJoin.vdw

Path C:\Users\Admin\Desktop\UnregisterJoin.vdw
Size 609KB
SHA256 384542695ce9ae0aa50e917da5db8d4cbce5af9a4c0a4c47ed42f2ee71990566
MD5 405f8cb51cf8a1181349e4bed33a1673
SHA1 54b106656772e3bd927b9e283bbfd73ef6479947
SHA512 7c92ac3e1d6c8bf418648e4646b36c4665546ac7a58939d59c2570755764eff225452142417600eaf237077ee5090fd6376140ba6139992cbd82fc361897ab2e
SSDEEP 12288:9PnpRf6GVQAni0E8xQLkP/SDE/M5oTjR3A2ze9mAMS3FbHnTSU:PRyGpi2akyLIbe9GwFbHn2U
TLSH
T1BFD423BA8D24CD0D29D453E01A0CC513D57CE2BC292A7BCA1F487D5D6B20E3B798B676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateFormat.wmf

Path C:\Users\Admin\Desktop\UpdateFormat.wmf
Size 440KB
SHA256 86657f03cd45ba46ea27e75a80f52742fb4e525db4af4e9d3a4ebbf10e2ca6dc
MD5 f22496b3b83fda7fc8d1a1739d3f21e8
SHA1 e2adfa4bec9e192f919e8d8e130cae8bd13003f7
SHA512 ad92ef43bb48b416f17df602647e3ea8426838d503bbfed13d4e4c87380aaf6f7a9904f803eac0fa7adbbb2c97b05ae5199ce719da3d3cf7858a5b078c071b23
SSDEEP 12288:l8w0Nm/5s612R3hCW3X1FX08KMrzHMXoddQ4Tewmw:lYcBr1hWFXrKMrUovQqe1w
TLSH
T176A4230CED5A6B2612B4E7FB523DDBDF9A2CA44FC15AF58DB4082956107943FBC8480B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitRevoke.pps

Path C:\Users\Admin\Desktop\WaitRevoke.pps
Size 880KB
SHA256 b3b6c342a3b1866a3cf39996071eecbc853b169bb61f5ba98f602d6aa2da2e51
MD5 e85e25001bb876ce5f8c0836399fef90
SHA1 957565e231a76408ccad309d7ce317a47b7cd1b4
SHA512 44f3860b74a418737e133285e4a2350982ca592ff4d0cb668195f4954ab513a6800171dd5c48db241e45094e6bda55d6aaf9d1dc214bea19a08c8c8ccc09a1bd
SSDEEP 12288:P1Z94VLM5/3KM5u8WbvFf+ckkuQy154oAGSgj0qy1jKq3QFQ2ckn61fheuhtSjk7:tZ360uls54oPjx7eQxc/1fh5QkoZo2W
TLSH
T17D15331D5BFEBCB9C7CB2DC8F9408B3E406BC78A7189478A6349DFC2394892E5493455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchUndo.txt

Path C:\Users\Admin\Desktop\WatchUndo.txt
Size 913KB
SHA256 b6eea2e977edbec6ec895f104e4647dcb12ec899c0175bd9bbea781392c95ced
MD5 d185fb85222aa58bda80efeee95d48ce
SHA1 e4bcae41e6ce9ee43bce383068a8cef53bb1c0b5
SHA512 7323a4d0175cc0a1b6d45ac6c7c06fe7fe456b3e99bc515619d0c7abda46249c1f52a1dd4b255f5ee3ccb6cf5d44945f6e25c19bea1c576621e8b3f0838c67ea
SSDEEP 24576:2kaiH60P3BXY0kLc+RzlKDTCj07W394Pj1OWEVe7Q:2S60PxXYvJRRKMt471Ones
TLSH
T1CD1533DD64280B2FBE2354D7C3073E9510CE13DB938206AF9DB891965312ADFF9692C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 0da02e94429367ccade7e6840d2e7722d13c806c293e1441efd13554eff62c01
MD5 7d1e2f95ff1dcbfa1140e78f3340522f
SHA1 9953f5c43122abe1de81a5bcc97f6d23519e76c4
SHA512 6697efef41ff10c34965694952460496349ca9766f0567b09ded3eb637bba00aa18c43c92a560ac5e893ed700130288e92f91a5e05fb29e8f6f09714d115b253
TLSH
T10C4194408AF61756F173DAF69AF215259EA3FD0295159F1E408483470962700F559F1F
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 1KB
SHA256 70387db43cfb79e7543e13e91a76fcffb1a91c7a807a9df0e6fd094b900eb1c6
MD5 5deab5a4d5b355a47f26c300cfc4ea56
SHA1 87b21f6ed38d3bbca33a803283c8f0e5ae158b33
SHA512 62bfbd9f3726095facb0491850109bc01f7e1f1bb9bf0b45b2736ebfffef2248685e305b69f1e6eb74b57040724126a2aca3274ff74a17d737e86dfcfa5d9ade
TLSH
T14C1199000BF6059AF4F385302A723B676373FD02AA6A472EC48AA28509772108529F63
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 7ab17b4e9c414ede7b2ad1628d10c0ecb515ae875fcb7b399a8b888254508578
MD5 adf868c161ee40bb786391cc5ad7c828
SHA1 3b9c1e6e2f48b56cc7ef365a166b503cb6d7661b
SHA512 de21cf62e356a79fb898fe8c30c4227e5bd4ec579645c9cd65e1d9698077f803ee07978de7170c6afac227289f299f53c68c72931c28757740d1126d111af32e
TLSH
T1594187113BF9265AF3F38A316A733B200FBBF813D5651B1EA085824508F1514499CF77
MD5 SHA1 SHA512 TLSH

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 923B
SHA256 bef677b7f15f25636153cedf5b2a87a909cfeac284c493801f20eb60ee182f9c
MD5 e3177e121010e831ee3812efcaab5c95
SHA1 31922889681160b2463fae34f6d97bd8db228205
SHA512 812bf8a82880c7af344beace9eae83b40f84f77fd2f7b9faf64ef407be92646fd5ac575393cb2c4d718f74e49ffbb50afc224d8d8fc3c33af12078d2175fb1c1
TLSH
T16D119C4126F26B4BE3D3C4F0653B1A699BB7F4119B47272E8081824B2875201D679FAB
MD5 SHA1 SHA512 TLSH

Submit Download