Overview
overview
8Static
static
3Weed-Hack-V1.rar
windows10-2004-x64
7Weed-Hack-V1.rar
windows11-ltsc_2024-x64
1Weed-Hack-....5.exe
windows10-2004-x64
Weed-Hack-....5.exe
windows11-ltsc_2024-x64
8Weed-Hack-...fig.py
ubuntu-18.04-amd64
1Weed-Hack-...fig.py
debian-9-armhf
1Weed-Hack-...fig.py
debian-9-mips
Weed-Hack-...fig.py
debian-9-mipsel
Weed-Hack-...ts.txt
windows10-2004-x64
1Weed-Hack-...ts.txt
windows11-ltsc_2024-x64
1Weed-Hack-...rt.bat
windows10-2004-x64
3Weed-Hack-...rt.bat
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
420s - max time network
422s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Weed-Hack-V1.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Weed-Hack-V1.rar
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Weed-Hack-V1/WeedHack_Injector_V6.5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
Weed-Hack-V1/WeedHack_Injector_V6.5.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
Behavioral task
behavioral5
Sample
Weed-Hack-V1/config.py
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Weed-Hack-V1/config.py
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Weed-Hack-V1/config.py
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Weed-Hack-V1/config.py
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Weed-Hack-V1/requirements.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Weed-Hack-V1/requirements.txt
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Weed-Hack-V1/start.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
Weed-Hack-V1/start.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Weed-Hack-V1.rar
- Size 78.8MB
- Sample260718-e7g4lsgv5m
- SHA256 cf8e3e77855ad2be9e0caa65340655bfd19a259fd62ef8a245a09e236422b097
- MD5 9e34e317ebb751c3f9506ded56ff50f3
- SHA1 9989161e85dd324b753f66fa9047cc62f885b0db
- SHA512 9bcad50eb0f3b49c702a5bc0823262ef1ea667d83d42b6533f725d2cc5209f6e3a3fe567b5af9243805df81a5de6e3d9284dcc4f238660294ac54ee7aeb2fd44
- SSDEEP 1572864:/gffKUejNWsiZXW0LArBHLATDk2rVNjfzWoVNEI8E8UXdl+lBsOihX:/gfyUE7iUKAFHLek4VNjzzyUXdl+8hX
- TLSH T1650833C31A7DEC2B866FCD525CDDD9ADA6D00B38EC369A4201E606375DEF7533858A80
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 4 IoCs
pid Process 3664 MsiExec.exe 408 MsiExec.exe 3980 MsiExec.exe 2888 MsiExec.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 160 2004 msiexec.exe 162 2004 msiexec.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Program Files directory 26 IoCs
description ioc Process File created C:\Program Files\PyManager\runtime\_native.cp314-win_amd64.pyd msiexec.exe File created C:\Program Files\PyManager\py.ico msiexec.exe File created C:\Program Files\PyManager\pymanager.exe msiexec.exe File created C:\Program Files\PyManager\templates\launcher-arm64.exe msiexec.exe File created C:\Program Files\PyManager\templates\launcherw-32.exe msiexec.exe File created C:\Program Files\PyManager\templates\launcherw-arm64.exe msiexec.exe File created C:\Program Files\PyManager\pyd.ico msiexec.exe File created C:\Program Files\PyManager\pyshellext-64.dll msiexec.exe File created C:\Program Files\PyManager\pyw.exe msiexec.exe File created C:\Program Files\PyManager\runtime\manage.cp314-win_amd64.pyd msiexec.exe File created C:\Program Files\PyManager\runtime\python314.dll msiexec.exe File created C:\Program Files\PyManager\templates\launcher-32.exe msiexec.exe File created C:\Program Files\PyManager\py.exe msiexec.exe File created C:\Program Files\PyManager\pyc.ico msiexec.exe File created C:\Program Files\PyManager\vcruntime140.dll msiexec.exe File created C:\Program Files\PyManager\runtime\python314._pth msiexec.exe File created C:\Program Files\PyManager\runtime\python314.zip msiexec.exe File created C:\Program Files\PyManager\templates\launcher-64.exe msiexec.exe File created C:\Program Files\PyManager\templates\launcherw-64.exe msiexec.exe File created C:\Program Files\PyManager\vcruntime140_1.dll msiexec.exe File created C:\Program Files\PyManager\pymanager.json msiexec.exe File created C:\Program Files\PyManager\python.exe msiexec.exe File created C:\Program Files\PyManager\python3.exe msiexec.exe File created C:\Program Files\PyManager\pythonw.exe msiexec.exe File created C:\Program Files\PyManager\pywmanager.exe msiexec.exe File created C:\Program Files\PyManager\version.txt msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{ED42BC08-6BE8-4CB2-A804-46B810C75087} msiexec.exe File created C:\Windows\Installer\{ED42BC08-6BE8-4CB2-A804-46B810C75087}\ARPIcon msiexec.exe File opened for modification C:\Windows\Installer\{ED42BC08-6BE8-4CB2-A804-46B810C75087}\ARPIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI7976.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5ce5e3.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIE76A.tmp msiexec.exe File created C:\Windows\Installer\e5ce5e5.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEB82.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI79D4.tmp msiexec.exe File created C:\Windows\Installer\e5ce5e3.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2436 cmd.exe 1920 cmd.exe 3896 cmd.exe 2564 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1864 chrome.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288231171604373" chrome.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{C7E29CB0-9691-4DE8-B72B-6719DDC0B4A1}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.pyw msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex\DropHandler\ = "{EAF5E48F-F54A-4A03-824B-CA880772EE20}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open\command\ = "\"C:\\Program Files\\PyManager\\pythonw.exe\" \"%1\" %*" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E81C0B8EDF5336D4DBFEECB8E923F25E\80CB24DE8EB62BC48A40648B017C0578 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pyz\ = "Python.ArchiveFile" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pyz\Content Type = "application/x-python-zipapp" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\open\command\ = "\"C:\\Program Files\\PyManager\\pythonw.exe\" \"%1\" %*" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.NoConFile\shellex\DropHandler msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EAF5E48F-F54A-4A03-824B-CA880772EE20}\InprocServer32\ = "C:\\Program Files\\PyManager\\pyshellext-64.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.File msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\ = "Python Script" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.ArchiveFile\DefaultIcon msiexec.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EAF5E48F-F54A-4A03-824B-CA880772EE20}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\80CB24DE8EB62BC48A40648B017C0578 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.File\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.CompiledFile msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile msiexec.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\open msiexec.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.Extension\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.py\ = "Python.File" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.ArchiveFile msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\ = "Python Application (Windowed)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shellex\DropHandler\ = "{EAF5E48F-F54A-4A03-824B-CA880772EE20}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Program Files\\PyManager\\python.exe\" \"%1\" %*" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7E29CB0-9691-4DE8-B72B-6719DDC0B4A1}\InprocServer32\ = "C:\\Program Files\\PyManager\\pyshellext-64.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{EAF5E48F-F54A-4A03-824B-CA880772EE20}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shellex\DropHandler msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile msiexec.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings 7zFM.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\PackageCode = "0B096AF959AC86F4B95815FA5F0CB4C9" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pyc\ = "Python.CompiledFile" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pyd\ = "Python.Extension" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.Extension\DefaultIcon\ = "\"C:\\Program Files\\PyManager\\pyd.ico\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\80CB24DE8EB62BC48A40648B017C0578\Core msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.NoConFile\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\EditWithIDLE\ExplorerCommandHandler = "{C7E29CB0-9691-4DE8-B72B-6719DDC0B4A1}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\EditWithIDLE\ExplorerCommandHandler = "{C7E29CB0-9691-4DE8-B72B-6719DDC0B4A1}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pyd\Content Type = "application/x-python-pyd" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.Extension msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.pyz msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.py msiexec.exe - Opens file in notepad (likely ransom note) 2 IoCs
pid Process 2604 NOTEPAD.EXE 4448 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 1288 msiexec.exe 1288 msiexec.exe 4052 chrome.exe 4052 chrome.exe 4624 7zFM.exe 4624 7zFM.exe 4624 7zFM.exe 4624 7zFM.exe 1288 msiexec.exe 1288 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4624 7zFM.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 4624 7zFM.exe Token: 35 4624 7zFM.exe Token: SeSecurityPrivilege 4624 7zFM.exe Token: SeSecurityPrivilege 4624 7zFM.exe Token: SeSecurityPrivilege 4624 7zFM.exe Token: SeSecurityPrivilege 4624 7zFM.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe Token: SeShutdownPrivilege 4188 chrome.exe Token: SeCreatePagefilePrivilege 4188 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4624 7zFM.exe 4624 7zFM.exe 4448 NOTEPAD.EXE 4624 7zFM.exe 4624 7zFM.exe 4624 7zFM.exe 4624 7zFM.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe 4188 chrome.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 364 OpenWith.exe 5076 OpenWith.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4624 wrote to memory of 4448 4624 7zFM.exe 108 PID 4624 wrote to memory of 2604 4624 7zFM.exe 120 PID 4624 wrote to memory of 2436 4624 7zFM.exe 126 PID 2436 wrote to memory of 1920 2436 cmd.exe 129 PID 1920 wrote to memory of 4548 1920 cmd.exe 130 PID 1920 wrote to memory of 1608 1920 cmd.exe 131 PID 4188 wrote to memory of 4212 4188 chrome.exe 133 PID 4188 wrote to memory of 4944 4188 chrome.exe 134 PID 4188 wrote to memory of 4944 4188 chrome.exe 134 PID 4188 wrote to memory of 1864 4188 chrome.exe 135 PID 4188 wrote to memory of 400 4188 chrome.exe 137 PID 4188 wrote to memory of 400 4188 chrome.exe 137 PID 4188 wrote to memory of 3676 4188 chrome.exe 138 PID 4188 wrote to memory of 3660 4188 chrome.exe 139 PID 4188 wrote to memory of 3676 4188 chrome.exe 138 PID 4188 wrote to memory of 3660 4188 chrome.exe 139 PID 4188 wrote to memory of 568 4188 chrome.exe 140 PID 4188 wrote to memory of 568 4188 chrome.exe 140 PID 4188 wrote to memory of 2660 4188 chrome.exe 142 PID 4188 wrote to memory of 2660 4188 chrome.exe 142 PID 4188 wrote to memory of 3612 4188 chrome.exe 143 PID 4188 wrote to memory of 2848 4188 chrome.exe 147 PID 4188 wrote to memory of 2848 4188 chrome.exe 147 PID 4188 wrote to memory of 1020 4188 chrome.exe 148 PID 4188 wrote to memory of 1020 4188 chrome.exe 148 PID 4188 wrote to memory of 4688 4188 chrome.exe 149 PID 4188 wrote to memory of 1536 4188 chrome.exe 150 PID 4188 wrote to memory of 2012 4188 chrome.exe 151 PID 4188 wrote to memory of 1636 4188 chrome.exe 152 PID 4188 wrote to memory of 1204 4188 chrome.exe 154 PID 4188 wrote to memory of 2004 4188 chrome.exe 155 PID 1288 wrote to memory of 3664 1288 msiexec.exe 158 PID 1288 wrote to memory of 3524 1288 msiexec.exe 163 PID 1288 wrote to memory of 408 1288 msiexec.exe 166 PID 4188 wrote to memory of 4052 4188 chrome.exe 168 PID 4624 wrote to memory of 3896 4624 7zFM.exe 171 PID 3896 wrote to memory of 2564 3896 cmd.exe 173 PID 2564 wrote to memory of 984 2564 cmd.exe 174 PID 2564 wrote to memory of 3148 2564 cmd.exe 175 PID 4188 wrote to memory of 3532 4188 chrome.exe 177 PID 4188 wrote to memory of 3532 4188 chrome.exe 177 PID 4188 wrote to memory of 4360 4188 chrome.exe 180 PID 1288 wrote to memory of 3980 1288 msiexec.exe 181 PID 1288 wrote to memory of 2888 1288 msiexec.exe 182 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Weed-Hack-V1.rar"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO012A50D9\requirements.txt2⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:4448
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO012F1AEA\requirements.txt2⤵
- Opens file in notepad (likely ransom note)
PID:2604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO0128A6BA\start.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E| cmd3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E"4⤵PID:4548
-
-
C:\Windows\system32\cmd.execmd4⤵PID:1608
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO012ABF8D\start.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $E| cmd3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $E"4⤵PID:984
-
-
C:\Windows\system32\cmd.execmd4⤵PID:3148
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:4036
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:364
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff4ebcc728,0x7fff4ebcc734,0x7fff4ebcc7402⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,14382017945139967335,4487965387922983897,262144 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:22⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,13247314321935434635,9600714878920177700,524288 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:32⤵
- System Time Discovery
PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,17957087381115411898,7398375957878130389,524288 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2412 /prefetch:82⤵PID:400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,9685969494805879806,10805152728732561857,2097152 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3456,i,18190199148026518046,8195508498179170682,2097152 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3472 /prefetch:12⤵PID:3660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,16653327481537782223,13927414385362339988,2097152 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:22⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,18147602684134722507,4401280848607259630,2097152 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:12⤵PID:2660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,4038002022608989508,13925813464137256322,524288 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5492 /prefetch:82⤵PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5924,i,8362387062036134373,13118746221331056511,2097152 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:12⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4716,i,10428704020833867884,11847209598629827189,2097152 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:1020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3648,i,8663915696133878401,2731076528292218960,524288 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3628 /prefetch:82⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3656,i,6539984153639135620,8619268567431268619,524288 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:82⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3524,i,8097961023113813059,1195920986763173380,524288 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4844 /prefetch:82⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4496,i,6581130855902319142,4440119891968232432,524288 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:82⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,13339030062812167366,411541680816748738,524288 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4820 /prefetch:82⤵PID:1204
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\python-manager-26.3.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
PID:2004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4624,i,5650394974772860276,8486389359648984278,262144 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4804 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3452,i,12771013196826567264,14516226736371413960,524288 --field-trial-handle=1960,i,2128071662278172571,217788409961356333,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:82⤵PID:3532
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\python-manager-26.3.msi"2⤵
- Enumerates connected drives
PID:4360
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4620
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2428
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:5076
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding A239E0083C364EF77C7DBA6E754F0AF0 C2⤵
- Loads dropped DLL
PID:3664
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3524
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D62F6B3CF8E37A79DF5469A9866607A32⤵
- Loads dropped DLL
PID:408
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 9C28971CFC04277EDD1EC6D67A3447C7 C2⤵
- Loads dropped DLL
PID:3980
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 44BCF3E074C1449B54E7847A0632EBDA2⤵
- Loads dropped DLL
PID:2888
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5ce5e4.rbs
- Size 14KB
- SHA256 65b4b57b8e78b33eeeb9fcc2774e6adaa4cdfac8ae39c37830b9d77cc26e3795
- MD5 0d68ee142a365709751eec4c1798a3c2
- SHA1 800ef6a4ad22716d56ec0c0d3af149bb5d215eca
- SHA512 981f3522bf9e6c253c26b4068e1d86fa5c690084f29e1773d773a93808b28ad9b113190e968dd016921143f0b86f6ec22eb4108f31029b6b93ae08fbcd42db58
- SSDEEP 192:iNSFaXWSpy4+j8XmkPdx7EMQeebIhv3gzIh3gzxBEOxw2EbORGpIBN:iNSFaXWSpyKWqv7ubIt3gE3gFeAabOnj
- TLSH T1AE524242BE84C1C2F1D62A3AC35B2B5437A2C7AD8B44035742CCC275AE43B566F7B989
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5ce5e6.rbs
- Size 3KB
- SHA256 a22ab470a591e26063b90c4df0d5b210024b16bbdf033be1c2773157c02bf229
- MD5 5c5f27f9c0ab41f2ff11ba51554d4282
- SHA1 41d30175f0cd29d0804441de05d326ae1d639a14
- SHA512 7a83eb5a9d2e805ee41365d9462ba430fe3feaa1e30b52793a08ba31a15cc8abe0cddc1acabafff8d1ae7210b8da0c82edd142c4c3003b1c7691005670a9cb15
- TLSH T1E4715A42AA08D687ECA72F71CE2B171133B7C6F9C7254387458C90711F47BA66FE618A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5A6896595A9B5FF7A8254147F2B2367B
- Size 8KB
- SHA256 160ad7c66b8dbafc5f0a142c9036dfc2886f223f71fc4062d295f9ac9f86b291
- MD5 970792ad25737f9ce0582dfe6233a0d4
- SHA1 c171eecd5bc701a3738e38e5d93debc32efc7e2e
- SHA512 2d781658e0bf2ae1d6e184c9607211f90b2912c74fa2600dd22322c2e05b9b9c4cd35e4729d1c896d67053fb714c2bf7e6f96090055eb3fb8fd995d342ac69ea
- SSDEEP 192:o1yZlpd7ntaqzbO6qOV7U5aNjeVNG47zelTo:oIlaYi695N6SKyJo
- TLSH T14A0200BC6A1C6A9380D52A71CACB8FE6D8F541A13BD0E11F41756F884428FC3DE97782
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
- Size 2KB
- SHA256 c58665ba70f924697f43e2ba343a36d9f9e13f47e791b23daa070abf0af27ac7
- MD5 25651e55650736737e66d82a0663d5dc
- SHA1 25ee09a048d3360d33b5140e40ec291f67720461
- SHA512 70f6c852795c5f5ac2cd92df23915ae64f93a4136a9e224d0ab6fff0c6eea4ae897354cb2d9383b0a8784c1736b8afa33d2b40cb18423f02e2e5bef6c5eeb243
- TLSH T165411A47983C1013DE86F9E2E6C1D0BD3CF4DEA33D011AA75567B190592F3A5B70822D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
- Size 785B
- SHA256 345fe296fe947276fc22f3a6e971fc4dd6c54869e2b898e7d5311077976c6691
- MD5 a199ec033f0a1077b0f84f20bff9e427
- SHA1 b5b860f87cb16bf2b747ce1c9a24c2558c249468
- SHA512 ef3436c0ec9ad536f39dff5b34634a95095c73c7655bbeef006523c2ec52564e8061ea891afa795df861e184b845b32dc76c67714c20e91e4e7c88a1d7e2fc7a
- TLSH T1A2014162A53CB24945410949AA38EDCA7AB4EFD40B10382F207B61181665F016A36144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5A6896595A9B5FF7A8254147F2B2367B
- Size 290B
- SHA256 fa8b255c336a2b06356502fbcbb4948fc83b2bfb6bba4f61aea2f08996ee131e
- MD5 aeeafcc94d7085f43acb030fa222a3bd
- SHA1 e38afe0f823f1b1e6feb63693b9ecb5dfa8f897c
- SHA512 ebfaa39d0034ab19d73e4af4af54ab758238df52342b7c90b6ffbdb088d7e32e1b29800d0ee3613800a4cf5607f5378dc1cd0686a9725bc1ec5a389ee175c16d
- TLSH T102D05E2CE3F50222F090853E59E01527AD3A6D298A0583680FF1C3087028E56BD31313
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
- Size 422B
- SHA256 b6c116ae761a8012efe1eb688ca0fb055f20ab0f1d947d986d18c3996e118d1f
- MD5 b5109e8fedb4a7811142add562e03275
- SHA1 4c7c22a93e0c10509c399ec0fc473e94b5093179
- SHA512 a90ee0511aa7f18b85b54abd10c0b5434d0b45b6da72c36fbf0365e2c7e5dc007ab667c55f4c9ecbd3775c77d17a5c4a9c92f50b4cad4276a9ac1d6e40ce1cac
- TLSH T1DBE0611424FF8109FB376C390785697F8A3FF753045876A2775400905545E028D31313
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
- Size 308B
- SHA256 22b935f2376c87cb83eb32ef7407d33aeb9e13daa33db081e1787a0567e444b1
- MD5 83321630d59ce43184d9cf8101a1d562
- SHA1 a3859d8fc38adef694a223940630b6c1bc383405
- SHA512 78202b0059885be77cbb27cb90b0bd320670d130b109d5c30868d981c26920a5ece23d1f36431fd4789fb9a127ae842ee8dcc89aa989e20885aa0e8c275a79e3
- TLSH T19CE0171CA7F50A22F181CA3E15E02A23B939AD608610834817F583487538993E930317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 f55ae1430bc62df7b21d6712349c9ac35cb685db8b78dfd625b0940cc0efab32
- MD5 432fb46c0e660427bca18c0d8142e287
- SHA1 5415f02683226d79a51f53ff0dd6179fb785bb09
- SHA512 a4274ff715014680a8b0d6a1628f793d11df2c99f05cf166fff5af8350f7355206158826b2aa41416887bfaebebce1d0d6234345f234c39882fb01d221f2af6c
- TLSH T113E02BAACE22EC275CFE471D60504A45DA51135B1760845F3F3C850C8FB4677068596C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
- Size 32KB
- SHA256 04c7f19e1ae294cc641f6c497653b5c13c41b258559f5f05b790032ccca16c82
- MD5 b582b2eca79a750948dbb3777aeaaadb
- SHA1 bf0ea1c8a7b4a55779cbb3df1f1d75cc19910e9f
- SHA512 35cfd88afe4e4e8091d3a5c53f0f3e2dcd92aa58b7544b94d4d9d7cdf508d429c5292aa97b813c9c8ad18e4d121d4e6595c49f5ddafbeab7b39f3a7c9d0b58dd
- SSDEEP 768:S5rsd4sFCihE6OYoEs/5pn7A8o690DW1d3zt0OG:+4d4CbdOjEQp7ho6x1djPG
- TLSH T143E2E2F9A6319A3CC9E9F3C983459F40F75EA449A50C11CA70A8FCE465824CD5F7AA0E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
- Size 66KB
- SHA256 274befc7b39609fed270e69335bc92b3d8251545594636eb408d5d93e0ae1a4f
- MD5 33411bb179575dfc40cc62c61899664f
- SHA1 d03c06d5893d632e1a7f826a6ffd9768ba885e11
- SHA512 dc830766c928ac84df16d094fc92586b9c2c25f819123dc9b5ec259220b4b1c45e2af28c89a710f047c00c9dcf7df8dd859a9a7a2d2228703f616df13caef2c7
- SSDEEP 1536:DQFVtT8CbB1R8u7uT2yW7tLkpVmWYK9XoTEPnq0K+XeooPpcmgK:6gI1kT2PiiuXoBSuoohKK
- TLSH T1706301B43270DBF4E089C49924E62B1CD4D3606FEABF94E4B146DEDD922BC773198848
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 240B
- SHA256 23ec3c6a6e73b792c82fdd5fca1b58f4a69c13caf9cb54fa0c9b53680dace307
- MD5 ef3d0c2acf09d3ea2e480bc4534a6d23
- SHA1 fba3dca653673ca8c860d39e4071a27b23d50368
- SHA512 225ca9828cf50e04ca29267b4cffa5244c5f1a5bd3e9394bd5883ffc6d76b82d5424c7d9deab18b80c9ae3552fe1f463c0a7688558a0a5f6a80aed54772df5e5
- TLSH T154D08C209BC28C33CF0083BA909C7E0C31E3103C02835B6341B504D4DCA3FEE87062A2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 360B
- SHA256 edc1d2d5695e10950281a6effd30ed9df2e1587770cebec9a11a18c2a0209551
- MD5 19ed567c7d9f61e3dc14d4592fd60109
- SHA1 57674f7941db4728228595c7b8e4b8782214ac39
- SHA512 70acaf2475c8c86871688c8e8e5b935a70c259d89fed5731235e5ad151d9c1f55ffd5ae6965078f70a21e0eab540b70057ce5da06410ca84fc5fc655e3a0bc00
- TLSH T130E0C2346BC16D32DF0042F950FF08A531B32A7D11070B56415698E0AC21F9F82C2722
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 360B
- SHA256 eb4ee53b3dabac3bbc62489a4ccad6c787f98b23e1d15c933ad8099d985ac581
- MD5 ac903a53f95f78cb36fc3f3d04d2f9a5
- SHA1 2d76aa55063e6392ef42fd8f44fd50f7acc396b0
- SHA512 98bc662861f2b86f06902c4f2c787eb43a9964af9e68ab89ece0742bc90ca6eb3846f8dab3053977371f4c5806b61a7346283bfaebd628b8ed6cd4058fc81b74
- TLSH T131E02B206BC15E33DF1046F910FF087470B72A7D120B0F5242569CF19C31F9F8682112
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 39593b5b570f336a0513662cb195012b1da718f086802400a2aa2a6ae8296ea4
- MD5 ee17880d5be68e75f1f433ed49786ae7
- SHA1 3f9bcf6243b06b0c4a7965a97519e0aa80ab061a
- SHA512 003489eace480aa863dce9672949add17bdc1a551980c6e7e661f41305dc6a5b4b176d15664633114b1288ff2de423cb0b7491494a49f9850a59f88348080d66
- SSDEEP 48:YALlqPqgWUthVWyaXYfoKsvgmzsC4s9fsWosFD7MsmvpsJHpgsPvzszsFsGKa:DsNFtnhaIAV9DB7KmH5asVN
- TLSH T146917DF7C3E8892DC91196F4DA156E1BCE6D0A28131C3C67C8D4AF4B63E2872D25174E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 a73486098cc224f0da08c76f42122dc6366e57775171a741dd5bc9b934a5ffe2
- MD5 c27122cc38a4926b692601fee4f767c6
- SHA1 22625765d22911fa015844fd1f750ef729f27bbe
- SHA512 5f4c667863422336aa6f42951e2a24116b6b8b97735adbf9413ec60024a9b45616ecde0a17e4d51e7cd6fa4fea7fa7462c6a41551eecb1be4733fee3e8eeb636
- SSDEEP 48:YALlqPqgWUthVWyaXYfoKsvgmzsC4s9fsWosFD7MsmvpsGRsNHpgsPvg1sLs+a:DsNFtnhaIAV9DB7K5SH5oEsR
- TLSH T10C918DF7C3E8892DC911A6F4DA156E1BCE6D0A28131C3C67C8D4AF4B63E2872D24174E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 0cf9fce607c280677ccc4cf17db8e2e2f5db79837d0000c404c11e90e88ff1fb
- MD5 64febab3b931168720a85c59ac383bbf
- SHA1 e6826465f816eea29e48c3c5d8830cb023f8726a
- SHA512 89763d18ebebc331e88f8951d10fe474b489e065131d7272e6c8da1ad5e8d69a8dabc6710c5f455282c81f6445342dbf814f9fd74cd7c204c7ef29400ee0099f
- SSDEEP 192:bRgf4u8fD9v7ApAPRp29+9qHsb+WNn6ZGauLgezn8oegyaa6VyIsnAUgtaJ:bRgfg9kUXRkwIJez8Daa68
- TLSH T13842C92EED14A93BACCBC219FA667757D7F5103925902D84EBFC8A1C19DB5CC211701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 3fcfabe0c3d82c742860e4bb5bf85609a1979145bc60f81549aa141e759e7142
- MD5 c33c85b00fb179beea6a8083b58d6cd1
- SHA1 885bb80089938ddd95b2360df53141ff47b21ee8
- SHA512 c4e35664318489b374096bb3c6b7a8b76452de5592091bdad9cca1705fa027bdb24b01297823cfb6740911f816e63f0fc326112713758b857e6346443e077f7b
- SSDEEP 192:bRgW4u8fDDv7ApiFPRpbE9w9qHsb+WNn6ZGauIfYxn8oegyaaDVyIsnAUgraJ:bRgWg7kmXBkwI5YF8Daale
- TLSH T12252C82EED10693BACCBD219F9667B67E7F1103525902D84EBFC8A1C19EB5CC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 d57b9ee15527f21f7865b5b2bd62a91fc4881afbf528d8a238fc6ff949806e0d
- MD5 3d0ab6073a7ecd0c25761a9541532fb1
- SHA1 cfea8c82b98c17c557da79eac529769135f19bf6
- SHA512 0d8f3966f382545b1dbb2879177191416a7de1fa826729504d19d36b5621bf24f37eaed6ca0b94eec3c5538c590876fa5a4413c3a85a65eddb827f46c7414b16
- SSDEEP 192:bRg94u8fDkv7ApAPRp29+9qHsb+WNn6ZGauUr2qn8oegyaa6VyIsnAUgtaJ:bRg9gAkUXRkwIZ2Y8Daa68
- TLSH T1E742B82EED14A93BACDBC219FA667B67D7F5103521942D84EBFC8A1C18DB5CC211701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 8faac32bc25aa93493d51f62bf8e31fbd2be6ed3c77a0ab59d5de872559538e3
- MD5 46b38968fe3196613328caf20473f3b4
- SHA1 b1ea4def90278f3588e289d5782e684623e091cf
- SHA512 5e5d41ca173cf43cd6de73eaf72c9bb64adddf3bb7660a390351146bd940c697c6fc6dea5be85ebb71cf87bf9a1739646f09f840e36407dafc875559275be872
- SSDEEP 192:bRgW4u8fD+v7ApiFPRpbE9w9qHsb+WNn6ZGauIfYxn8oegyaaDVyIsnAUgraJ:bRgWg6kmXBkwI5YF8Daale
- TLSH T14E52C82EED10693BACCBD219F9667B67E7F5103525902D84EBFC8A1C19EB5CC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 620a660bf493c1ab83551ee8eff6bd0819698258112ab397701933b246d0e4ab
- MD5 83a5616df29da717b4e0238f7a86311c
- SHA1 7a4466988f999c571a96b0706efe823386ba9042
- SHA512 f6fb40b4dc0870a29f515d59321c968bfc93177893873e4ebb1d433b9fe40bf8fd0f2092dccf8c63f0b2248a8d083a6d0560041878d8da9d1ff3f8da7f76ac53
- SSDEEP 192:bRgW4u8fDjv7ApiFPRpbE9W9qHsb+WNn6ZGau8z+Zn8oegyaaDVyIsnAUgraJ:bRgWgbkmXLkwIt+98Daale
- TLSH T16852C82EF910693BACC7C219F9667B53E7F1103525902D84EBFC8A1C29DB5CC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 7b12bf2af62263bcffd7f7db387ad3ad500414a9e666a30dd0e698350a6b4aa5
- MD5 37794d32027dc7983d90c0db9af5448e
- SHA1 ced58a04d86e5434488405b080da083dc6c9d5b5
- SHA512 21d757d292a0ac5c18498ce02d9fe91bdde71075ff595b471386e9bc2b454f28020d03ce51da281148185ac8ff1e8e90a408cc10cab6bd946b5f08f8881917b9
- SSDEEP 192:bRgf4u8fDtv7ApAPRp29+9qHsb+WNn6ZGauLgezn8oegyaa3VyIsnAUgraJ:bRgfgNkUXRkwIJez8DaaRe
- TLSH T1AB52C92EFD14693BACCBD219FA667B53E7F5102525902E84EBFC8A1C15EB5CC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 da6dd41867b4310a0621f221a6cfd8c6de7e4404be48e4a886bf63afd92d365f
- MD5 2f94a991415ba2f2072ba576e4ec2f31
- SHA1 2178524c1096efb42228faa6f8ea158ef65f2780
- SHA512 2dbe0812acccb549441e720fa3a27af08f790f967f61fbb1caa0c2bcae6edd343158ba9f95a10fdb7f90ea253e4c1cef69b78cc8d4cdeaa7ba5e189b93451095
- SSDEEP 192:bRgW4u8fDTv7ApiFPRpbE9f9qHsb+WNn6ZGauOFIbn8oegyaaDVyIsnAUgraJ:bRgWgrkmXOkwINIr8Daale
- TLSH T10452C82EF910693BACD7D219FA667B67E7F1103522902D84EBFC8A1C19DB5CC221701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
- MD5 28aca1b912d001e337a9e715a111a353
- SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
- SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
- SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
- TLSH T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 aedccd0cccc7fbdf48990b7ad0c6f770aa008f0152b05a9de54bb4bca806366a
- MD5 dd4c7d3e4620600b1ec1796d092742d2
- SHA1 ddb07dd57461aa63ad2511e0f7cb97c8f2b1ad2b
- SHA512 b008efdd14393fbcfe95c27d8b93bb9b1d1c9d65d7a36ba469d0dbafea1511d5f839e556e019ceaa4f82cab78f1973420c348bc926a246100e06082d2ed888b2
- TLSH T15AB0121080015511C84302B02176248DB2165F21960A170643E4AE63D8265A68428090
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b8eb0.TMP
- Size 96B
- SHA256 7c63f5eecdafececad70e29e94867aeab36b485c38dbeea1b54b248b6c3b5512
- MD5 05aa65b4dec0d3c5417e4b472b492a6d
- SHA1 7f3fc40ac2569c21f9cfc3ed02da0da9c4a20ef6
- SHA512 4eb2f4e32a68a3549c9d4512aa7b354cc6bf78540241801a27525565cf3f1a5fd512e8698eb632acd7d62c0e9375c89431ffc1e6ae823d20021442c04e7ded20
- TLSH T1BBB00255C102E713C84203F4379995D87971DF29C6032312A6F0AAAADCA9AB54539361
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 233KB
- SHA256 d6de7c28db12de64977d6f188237c7deeb92360c1096647b93d6b891b281567d
- MD5 8cc6b0f94113c14f78e9093ca9400da0
- SHA1 0e56ceb4ffdc07e3629eb4011a678c9d2c5d6f74
- SHA512 063d3e10b3321300a89289159845636c50b7fec1807017b678d9b447c4998962f9b397244a6b710725f0c4c1924a2b90026b416e7a4197e682bb653834538c02
- SSDEEP 6144:jHYEHF27HSTmtV9rQtKm7Rkm1tYpBeh2BAov:UosH4muf9oBGcAov
- TLSH T17F3413239E749D7A6978F76E360F0B1E5FF11A22CE55D6D94484230827D8FC90E0D678
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 234KB
- SHA256 cd8301c34f593619d858d0b8f02552b6e11fa251e6a9583b7ec0dd1c2c5ede68
- MD5 8def341123b4ce549058b2d8a24e0544
- SHA1 170402459e168c6c29f3faae244d4e1723790955
- SHA512 a58145d8e925bc78a81e358baab0fd5e6a81ae50f6364896d8dafcd5995d5bf072188af42379ae160a0552b31058b131acacad4dadbc971917aa4f915558f52e
- SSDEEP 6144:F2HYEHF27HSTmtV9rQtKm7Rkm1tYpBeh2BAov:tosH4muf9oBGcAov
- TLSH T1FC3412339E749D7A6978F76E260F171E1EF11B22CE55CA999484330827DDBC80E0D6B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 233KB
- SHA256 dcb73cbf08d7a4e8c37ebe2085234636d7f145f6e3b4ab7d4dda8749ef4c524b
- MD5 75a42e1b72d79df2ef5af2e62ffde53c
- SHA1 f0e1c35eb12d5fd16b4c3898e1156eb32602dc24
- SHA512 582c3305fcdab531b38b4b0f542c19d9b49dafc1f285a7bd651c96461eee9134b28b04a380675c9b32454d7b5fc26fc157f1a27c2390cdf62e196f3bd1c41c7c
- SSDEEP 6144:qHYEHF27HSTmtV9rQtKm7Rkm1tYpBeh2BAov:fosH4muf9oBGcAov
- TLSH T1543413239E749D7A6978F76E3A0F0B1E5FF11A22CE55D6D94484230827D8FC90E0D678
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 234KB
- SHA256 f2d9d698e60736183e6f37103c6679ca89957412ef986f8d587f298435395dbe
- MD5 0b9eaae67295b10952350a6938a583b0
- SHA1 54a12e296748ba2273db02edba96fa5347d297ea
- SHA512 5faffb9768a2c3d785859e506c088b6bd209ba6f1e026765037367de0ea1095657bb8c273808540d39c155469bc91a0af4fb09b5f2b3912acac0974e89899fb9
- SSDEEP 6144:Z2HYEHF27HSTmtV9rQtKm7Rkm1tYpBeh2BAov:ZosH4muf9oBGcAov
- TLSH T1163412339E749D7A5978F76E260F171E1EF11B23CE55CA999484320827DDBC80E0D6B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 9e4fa8e842500a6a9c30b1b681c57627ed8131ff8952479cf10bd6e4bddd85bc
- MD5 e004214c33abedee32e66fdd29585ebf
- SHA1 66e756e803f28815167c5bf11453e4862582fa4a
- SHA512 bdd26937cb3b9389cfe605476310ad50be7ca4e46e1b9f2b80c341a6eb88aa6794dcd737eec70147b38ee07d0be30eb7079b9938a9438ad7f76c1c42ed1d4d53
- SSDEEP 3072:ABGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Tm7Rkm1tYpBeh2BAog
- TLSH T1A7C3023B5D75EC3B5CB5A74EB48E0F1E2EF149A6C920DE9288D85A0437F97CD0A44A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zO0128A6BA\start.bat
- Size 2KB
- SHA256 7a72a7be29ec13f0f05bec5ec12ed5e0ad75dffe62af91bcc6052727246d05ae
- MD5 ea74ca8e0a00819a211acdd16c0bc401
- SHA1 2b5b4a92689587d5731f741211b4d7290388b35f
- SHA512 387ba3d8fcabc4ba8f688f9d37e2247a2837166edb23c40cc1eb711ffb503143fd3a1429678de61212086cce5bce6a563c595427814f1486539157f3a35c560f
- TLSH T16851CC893201F03936B4C98B89794166F727D0F702415EAEB06B8039DF6778271FA7A9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zO012A50D9\requirements.txt
- Size 30B
- SHA256 cf6c51c88eee6d6bfea34dd7d0111a53e9b73d72c6e02beddf2d8e1350497267
- MD5 b9e1637e29fcb3acb570bf10f28184b0
- SHA1 a7be370adab82d3a18d75e4ef093a83b09f5a0c7
- SHA512 5c133519a153d40cf65f71444561cc84e613525f2fc93c54809b36ee9c6b8e475b52a9f1c0a1c009ebb4d1fea2f6f6ba4523d0f68e48966d220974016a17d62b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSIA531.tmp
- Size 390KB
- SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
- MD5 e8dc682f2c486075c6aba658971a62cc
- SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
- SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
- SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
- TLSH T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Unconfirmed 702950.crdownload
- Size 44.9MB
- SHA256 bdd1a4e0b485f674748b275095cc8e7132beb37a1ae91db080abb2661e3badec
- MD5 481108867e8640739f8202c83698cf3d
- SHA1 c69fdf0ae2375c6ee091a9d3b356f726193ed2a2
- SHA512 c4cae5cdb83185463a202144032490bd72d5e75023ce978060f69f49489ec2acac12d93ddef6f9aa844e63cfa9cb35ce14f74903f2c85efd9a8e3a056df29bb4
- SSDEEP 786432:g8wSX9ok1R1mf6r95KmXI/IQn8t0YbdD73Fv6VT6awNrxOrp6IFoQ7Ef/c7lbPOP:1tD71mke/lng0kdgGawNsrp6IL1POP
- TLSH T156A73321FA0D1EF7E1537E3D51418F268F2D9093224EF48E2EB846E415536CDAB9A70B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\python-manager-26.3.msi
- Size 9.4MB
- SHA256 259af5272c8f798786c1109b7ad287da519c58d43d7250ead8ed20fa3277a511
- MD5 c99b1705db384d0893449efc5fc4efc6
- SHA1 d04648b1a2ccc945853210cbdf5fe95dcf7567c3
- SHA512 726cad116663ef6127ba6ed48bbc638ea0a93fc44ea893cb28ad94cc8f41acabd4a70dcf3c6c26e067929a8b735a1afc8e21fd79071b53b048b50fffa00d10af
- SSDEEP 196608:uqJZZRk7q2ccNtjmb2hum6ZxwRp9gEk5DE3Wt8szIvvFYmainFJgCQw14a/lZ:VZeqOtjHhdO+pa5D4fsz6vqSgCrpb
- TLSH T1FFA63315F7D448EAE877833696A68230FE76BC4C3310904E67E4BA292F3BA707176355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 eeea7743908898ed848904226a6c08725fd8eb9895b0539570d07260c4bddcd1
- MD5 6cccf4d0c0f99d53580db9612d2da0c6
- SHA1 98ae4f6894b968db82def4f9a1ff1f1bc791cd6f
- SHA512 5bd0b8e1d28110b0065945674b87ee9531a4539f0676a05de9d4d4c60bc7181d3897348095148551130c264c479ce497dee262046178e83abf8c1ff27f561d6e
- SSDEEP 24576:pu8m+1z5doO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:H
- TLSH T1A747D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0a8127b1-0e52-4581-ac78-a82e7f91019e}_OnDiskSnapshotProp
- Size 6KB
- SHA256 9e55c4eb67fa5d2160db000401a3d329e495f5a9740b0c9f124a4312e3349b24
- MD5 6aa1cbf1def360b9af7b520fc27f26ba
- SHA1 fff753a3243c25d4aee5437f36659d82908750ee
- SHA512 70bcd716988bbc8f5a3cd4065acce3f37bfb069cbe9f896e1979220b5adcecae513b55cdb7ab325fc809221236f0afa5c4db1254bbef1a24c01782f7b893a29c
- SSDEEP 96:FQHU7VFvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:Gab++ZVm
- TLSH T17BD19A185AE54311E2B3AB7228F14557A477B911EF33CB8E0198238E2671910F876F6F
- MD5 SHA1 SHA512 SSDEEP TLSH