bcb21f1b4b14892370d2e935bcdb20feae7ff36d8d7eab8bf24a72ef43b01f89

Resubmissions

20/07/2026, 13:04

260720-qa671sds6110

20/07/2026, 12:57

260720-p6546acz9y8

Analysis

user interaction
yes
max time kernel
34s
max time network
33s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/07/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDM_6.4x_Crack_v20.6.exe
Size 66KB
Sample260720-qa671sds61
SHA256 bcb21f1b4b14892370d2e935bcdb20feae7ff36d8d7eab8bf24a72ef43b01f89
MD5 99e93f400964b6c8bab5a18e0e216500
SHA1 2cfa756887ba67240c73791782386bd389a83454
SHA512 da8e355bd93692cec82ac59cd899f25112be270fc69b7aac49d4abe7e95428b3ffd9f18ebdc5cfbc196c2fb8290ff5051ebeb639ac56e4cad4762ea437f43af1
SSDEEP 1536:/RGKmid3B3HHF49xGwwjE/kzOhB0a4oPkcTLa:/AhC3tHHF4kjYkzOB0a4Ncfa
TLSH
T1FA63F151C3E85D23F7FA0471839AEF91E2469DF690854623312FAD0E17BF4D00BAAD58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://get-activated-win.translate.goog/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en-US

Extracted

Language

Source

URLs

exe.dropper
https://massgrave.dev/troubleshoot

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5072	wscript.exe
3	3236	powershell.exe
11	5820	powershell.exe
12	5072	wscript.exe
13	5072	wscript.exe

Blocks application from running via registry modification 1 IoCs

Adds application to list of disallowed applications.

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "0"	IDM_6.4x_Crack_v20.6.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3236	powershell.exe
5820	powershell.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	IDM_6.4x_Crack_v20.6.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	IDM_6.4x_Crack_v20.6.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs

execution

Visual Basic

T1059.005

pid	Process
4828	cscript.exe
6036	cscript.exe
5072	wscript.exe
3620	cscript.exe
3808	cscript.exe
5824	cscript.exe
3740	cscript.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\rarreg.key	IDM_6.4x_Crack_v20.6.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5208	sc.exe
988	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4532	cmd.exe
4344	cmd.exe
4704	cmd.exe
4048	cmd.exe
396	cmd.exe
2432	cmd.exe
1960	cmd.exe
4444	cmd.exe
5256	cmd.exe
1724	cmd.exe
1756	cmd.exe
5224	cmd.exe
4328	cmd.exe
4824	cmd.exe
4952	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDM_6.4x_Crack_v20.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1724	cmd.exe
1168	PING.EXE
4704	cmd.exe
4900	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2656	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
3904	reg.exe
2152	reg.exe
4844	reg.exe
3508	reg.exe
4976	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1168	PING.EXE
4900	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
3236	powershell.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
3236	powershell.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
5820	powershell.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
5820	powershell.exe
3452	chrome.exe
3452	chrome.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
624	powershell.exe
624	powershell.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
1560	powershell.exe
1560	powershell.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe
4872	IDM_6.4x_Crack_v20.6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeDebugPrivilege	5820	powershell.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeShutdownPrivilege	3452	chrome.exe
Token: SeCreatePagefilePrivilege	3452	chrome.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe
3452	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 6036	4872	IDM_6.4x_Crack_v20.6.exe	80
PID 4872 wrote to memory of 5072	4872	IDM_6.4x_Crack_v20.6.exe	82
PID 4872 wrote to memory of 3236	4872	IDM_6.4x_Crack_v20.6.exe	85
PID 4872 wrote to memory of 3620	4872	IDM_6.4x_Crack_v20.6.exe	87
PID 3236 wrote to memory of 5820	3236	powershell.exe	89
PID 4872 wrote to memory of 3452	4872	IDM_6.4x_Crack_v20.6.exe	91
PID 3452 wrote to memory of 3248	3452	chrome.exe	92
PID 3452 wrote to memory of 2656	3452	chrome.exe	93
PID 3452 wrote to memory of 5972	3452	chrome.exe	94
PID 3452 wrote to memory of 5884	3452	chrome.exe	95
PID 3452 wrote to memory of 5972	3452	chrome.exe	94
PID 3452 wrote to memory of 5884	3452	chrome.exe	95
PID 3452 wrote to memory of 5992	3452	chrome.exe	97
PID 3452 wrote to memory of 1684	3452	chrome.exe	98
PID 3452 wrote to memory of 5992	3452	chrome.exe	97
PID 3452 wrote to memory of 1684	3452	chrome.exe	98
PID 3452 wrote to memory of 544	3452	chrome.exe	99
PID 3452 wrote to memory of 544	3452	chrome.exe	99
PID 4872 wrote to memory of 3808	4872	IDM_6.4x_Crack_v20.6.exe	100
PID 5820 wrote to memory of 4532	5820	powershell.exe	102
PID 5820 wrote to memory of 4048	5820	powershell.exe	103
PID 4048 wrote to memory of 396	4048	cmd.exe	105
PID 396 wrote to memory of 988	396	cmd.exe	107
PID 396 wrote to memory of 1856	396	cmd.exe	108
PID 396 wrote to memory of 2716	396	cmd.exe	109
PID 396 wrote to memory of 1956	396	cmd.exe	110
PID 396 wrote to memory of 5000	396	cmd.exe	111
PID 396 wrote to memory of 5224	396	cmd.exe	112
PID 396 wrote to memory of 5520	396	cmd.exe	113
PID 396 wrote to memory of 2972	396	cmd.exe	114
PID 396 wrote to memory of 5612	396	cmd.exe	115
PID 396 wrote to memory of 4396	396	cmd.exe	116
PID 396 wrote to memory of 4328	396	cmd.exe	117
PID 4328 wrote to memory of 576	4328	cmd.exe	118
PID 4328 wrote to memory of 2404	4328	cmd.exe	119
PID 396 wrote to memory of 4928	396	cmd.exe	120
PID 396 wrote to memory of 4988	396	cmd.exe	121
PID 396 wrote to memory of 2004	396	cmd.exe	122
PID 396 wrote to memory of 4824	396	cmd.exe	123
PID 4824 wrote to memory of 624	4824	cmd.exe	124
PID 396 wrote to memory of 4344	396	cmd.exe	125
PID 4344 wrote to memory of 2308	4344	cmd.exe	126
PID 396 wrote to memory of 3904	396	cmd.exe	127
PID 396 wrote to memory of 4964	396	cmd.exe	128
PID 396 wrote to memory of 2152	396	cmd.exe	129
PID 396 wrote to memory of 1960	396	cmd.exe	130
PID 396 wrote to memory of 4844	396	cmd.exe	131
PID 1960 wrote to memory of 5208	1960	cmd.exe	134
PID 1960 wrote to memory of 5608	1960	cmd.exe	135
PID 1960 wrote to memory of 2300	1960	cmd.exe	136
PID 1960 wrote to memory of 3952	1960	cmd.exe	137
PID 1960 wrote to memory of 5288	1960	cmd.exe	138
PID 1960 wrote to memory of 4952	1960	cmd.exe	139
PID 1960 wrote to memory of 916	1960	cmd.exe	140
PID 1960 wrote to memory of 1104	1960	cmd.exe	141
PID 1960 wrote to memory of 4660	1960	cmd.exe	142
PID 1960 wrote to memory of 5868	1960	cmd.exe	143
PID 1960 wrote to memory of 2432	1960	cmd.exe	144
PID 2432 wrote to memory of 3620	2432	cmd.exe	145
PID 2432 wrote to memory of 5848	2432	cmd.exe	146
PID 1960 wrote to memory of 3804	1960	cmd.exe	147
PID 1960 wrote to memory of 2108	1960	cmd.exe	148
PID 1960 wrote to memory of 5380	1960	cmd.exe	149
PID 1960 wrote to memory of 4444	1960	cmd.exe	150

C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.6.exe
"C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.6.exe"
1⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:6036
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\\CRK_UPDT_d2xbyf9.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.6" "Crack" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent
  2⤵
  - Badlisted process makes network request
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5072
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -WindowStyle Minimized -File "C:\Users\Admin\AppData\Local\Temp\\MASAIO.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -NoLogo -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\MAS_AIO_WIN.ps1"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo CMD is working"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4532
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd" -el "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /c ""C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd" -el re1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:396
      - C:\Windows\System32\sc.exe
        
        sc query Null
        6⤵
        Launches sc.exe
        
        PID:988
      - C:\Windows\System32\find.exe
        
        find /i "RUNNING"
        6⤵
        
        PID:1856
      - C:\Windows\System32\findstr.exe
        
        findstr /v "$" "C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd"
        6⤵
        
        PID:2716
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "-el " "
        6⤵
        
        PID:1956
      - C:\Windows\System32\find.exe
        
        find /i "/"
        6⤵
        
        PID:5000
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ver
        6⤵
        Executes a command shell one-liner
        
        PID:5224
      - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Console" /v ForceV2
        6⤵
        
        PID:5520
      - C:\Windows\System32\find.exe
        
        find /i "0x0"
        6⤵
        
        PID:2972
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
        6⤵
        
        PID:5612
      - C:\Windows\System32\find.exe
        
        find /i "ARM64"
        6⤵
        
        PID:4396
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        7⤵
        
        PID:576
        
        C:\Windows\System32\cmd.exe
        
        cmd
        7⤵
        
        PID:2404
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd" "
        6⤵
        
        PID:4928
      - C:\Windows\System32\find.exe
        
        find /i "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        
        PID:4988
      - C:\Windows\System32\fltMC.exe
        
        fltmc
        6⤵
        
        PID:2004
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c mode con
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\System32\mode.com
        
        mode con
        7⤵
        
        PID:2308
      - C:\Windows\System32\reg.exe
        
        reg query HKCU\Console /v QuickEdit
        6⤵
        Modifies registry key
        
        PID:3904
      - C:\Windows\System32\find.exe
        
        find /i "0x0"
        6⤵
        
        PID:4964
      - C:\Windows\System32\reg.exe
        
        reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
        6⤵
        Modifies registry key
        
        PID:2152
      - C:\Windows\System32\cmd.exe
        
        cmd.exe /c ""C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd" -el -qedit"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\System32\sc.exe
        
        sc query Null
        7⤵
        Launches sc.exe
        
        PID:5208
        
        C:\Windows\System32\find.exe
        
        find /i "RUNNING"
        7⤵
        
        PID:5608
        
        C:\Windows\System32\findstr.exe
        
        findstr /v "$" "C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd"
        7⤵
        
        PID:2300
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
        7⤵
        
        PID:3952
        
        C:\Windows\System32\find.exe
        
        find /i "/"
        7⤵
        
        PID:5288
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ver
        7⤵
        Executes a command shell one-liner
        
        PID:4952
        
        C:\Windows\System32\reg.exe
        
        reg query "HKCU\Console" /v ForceV2
        7⤵
        
        PID:916
        
        C:\Windows\System32\find.exe
        
        find /i "0x0"
        7⤵
        
        PID:1104
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
        7⤵
        
        PID:4660
        
        C:\Windows\System32\find.exe
        
        find /i "ARM64"
        7⤵
        
        PID:5868
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        8⤵
        
        PID:3620
        
        C:\Windows\System32\cmd.exe
        
        cmd
        8⤵
        
        PID:5848
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd" "
        7⤵
        
        PID:3804
        
        C:\Windows\System32\find.exe
        
        find /i "C:\Users\Admin\AppData\Local\Temp"
        7⤵
        
        PID:2108
        
        C:\Windows\System32\fltMC.exe
        
        fltmc
        7⤵
        
        PID:5380
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
        7⤵
        Executes a command shell one-liner
        
        PID:4444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c mode con
        7⤵
        Executes a command shell one-liner
        
        PID:5256
        
        C:\Windows\System32\mode.com
        
        mode con
        8⤵
        
        PID:5624
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
        7⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4704
        
        C:\Windows\System32\PING.EXE
        
        ping -n 1 activated.win
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4900
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
        7⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:1724
        
        C:\Windows\System32\PING.EXE
        
        ping -n 1 updatecheck312.activated.win
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1168
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
        7⤵
        
        PID:3192
        
        C:\Windows\System32\find.exe
        
        find /i "/S"
        7⤵
        
        PID:3020
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
        7⤵
        
        PID:4388
        
        C:\Windows\System32\find.exe
        
        find /i "/"
        7⤵
        
        PID:584
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        7⤵
        Executes a command shell one-liner
        
        PID:1756
        
        C:\Windows\System32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        8⤵
        
        PID:4984
        
        C:\Windows\System32\mode.com
        
        mode 76, 34
        7⤵
        
        PID:3388
        
        C:\Windows\System32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
        7⤵
        Modifies registry key
        
        PID:3508
        
        C:\Windows\System32\find.exe
        
        find /i "O365"
        7⤵
        
        PID:4860
        
        C:\Windows\System32\reg.exe
        
        reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
        7⤵
        Modifies registry key
        
        PID:4976
        
        C:\Windows\System32\find.exe
        
        find /i "O365"
        7⤵
        
        PID:5556
        
        C:\Windows\System32\choice.exe
        
        choice /C:12345678EH0 /N
        7⤵
        
        PID:124
      - C:\Windows\System32\reg.exe
        
        reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
        6⤵
        Modifies registry key
        
        PID:4844
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://internetdownloadmanager.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff96633c728,0x7ff96633c734,0x7ff96633c740
    3⤵
    PID:3248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1884,i,3694481117789158926,12672167430622182522,524288 --field-trial-handle=2380,i,17180333320549779637,13856300005045680231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2408 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1572,i,13215359454747061974,2327849078330115747,262144 --field-trial-handle=2380,i,17180333320549779637,13856300005045680231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2376 /prefetch:2
    3⤵
    PID:5972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1964,i,16756110060467749060,11006452610868576020,524288 --field-trial-handle=2380,i,17180333320549779637,13856300005045680231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:13
    3⤵
    PID:5884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,17587568878634063620,13435325432250297630,2097152 --field-trial-handle=2380,i,17180333320549779637,13856300005045680231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:5992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,13043663944378226250,10256371665395456624,2097152 --field-trial-handle=2380,i,17180333320549779637,13856300005045680231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:1684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,5763902025683827981,7257332991290047814,2097152 --field-trial-handle=2380,i,17180333320549779637,13856300005045680231,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4340 /prefetch:9
    3⤵
    PID:544
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3808
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5824
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3740
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /f /q "%TEMP%\MAS*.ps1" "%TEMP%\*UPDT.vbs" "%TEMP%\*WININF.vbs" 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7dada1c3e90fff6a1c19722bed7978b5439e2dade012d41268e3692a1aca8413
MD5 e6f9d0bbee3d14de54e3c13cde58dcc3
SHA1 c7968bf033fc5a493502b078a37ee5367a61b34f
SHA512 1aa818e72dc979ad645f9b8b812bf9f752b08fe83081391f8731572452e8a71401c705bd16ba573f4e86f0e24102619cdb7048c24d0f6c9a5ba2ababaed1e7fe
TLSH
T1CF3144FB5370997E8A11D2E4EA15AE1FCEB90521131C78B689E46D2783F29B2D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a8912026c70fcd799f54044001efa8a37f262c7a883ee939132fc0bc7aa9135b
MD5 f413130a3a81f9a82cfd1b9875fc48c3
SHA1 d10496111577f4aed0a424b52aec0e1f71591b9e
SHA512 516263332069929ec9b862d3ef58a473214693078607e4ba2ab32720d02445470ef6f9bedbc0fdbcf834060280fb1089eea224bed4687dba975496014999ff84
SSDEEP 192:sROZvAnrjwp8dv7HpAPRp2y9DHsb+WNn8HbP6KPyIsnAUge:sROZ98djUXR5wUbPve
TLSH
T18332C72EAD14AA3B5CCBC26AFA6577A3E7F5103175D02E84E6FC8A2C05DB5CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2405d279614e57a7f98c1aff89ea0064c30394162e4bae1b34b36fc40c351234
MD5 fa482a5d7bbc436546fb16abbaee019f
SHA1 60f514236c7aec824af8d37100f7cc8a6e398cc9
SHA512 3ebbc57fe9b0093936fec5d904decfea356f7c5c61941eaf303bfa6f42afa75f249f6ef37db505d4fa172886712ea6537dd619c449fdca455ba51494f97bd58c
TLSH
T1D5B012418001A510C00301BC1103548872149F10E70A270153E06A26D8250A18C14090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58656c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58656c.TMP
Size 96B
SHA256 7aebcfa0230f558faa78846cb0126a162b7e0b7c26320d0953d81f712c594e87
MD5 f9c3b5e459fbad3e896c9334e3aab9ec
SHA1 d845dfb3014eb54abe0c241a932067e504341f3e
SHA512 1e089415a85f121c07ed60c801ebc2786ff4228f3b7c1381257d3a92b4d19a0bdfa9ac2f5ae0a29527a687c7f0f834742e085a20e187fa61ccb65b8e67b63d8f
TLSH
T1D9B02200C002A202C0A303F0228AC0E832B0EF20CE03220282E00F22CCA023000A0020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 eb18314ae8762c6425516d1c8c1df0d26a08ba154404a0f27c1922fc06379719
MD5 b2e6791b5a6896c83bba48ae9221682b
SHA1 e9f9defc253b3adc34dcc298fa09f5d43a67693c
SHA512 73f0d9e2810f1abb1554ee8962df397e98393a78c638455fa0dc8579c82df1acec93ae8a6b10b3c09abb95ab6563bfc649ba83c9907ba95a7395db1a1eb2898b
SSDEEP 3072:DGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:6m7Rkm1tYpBeh2BAo+
TLSH
T14DC3122B5D71A93658B9B74EB08D0B1F2EF14DA6C930DE82C8D85B0477FA7CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 005cdbe7df51217c481fdcfbf46772b6531201959414ade1a073ff7801ba3df3
MD5 306c1b876dd8aa031f5ff3f1956c2a7e
SHA1 140b71ecd14cace06c29b1868493fba0dc4f7b29
SHA512 69ffd51d544d5c2edc14e2dc2fe6b963a8b1ac9e9a54dca2b74a0b8d53c1bb59f2b87ad73812c88a0227ff68277ecb36ec98fad703286bce87f4c14f0874482e
SSDEEP 3072:/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMP:um7Rkm1tYpBeh2BAoP
TLSH
T1BBC3122B9D75A93659B9BB0EB04E0B1F1EF149A7C930DE92C8D85F0423F97CD0A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 701a1aac028860b5fd28165de981f5487e5018a2f565bb79535ed2468aca7450
MD5 1507e13c12e4fd0d6ea8c165fa3be74d
SHA1 8c36eee6c866c3ab8858723486ea50aeb5ea6ffc
SHA512 ac0ff7646c888e1bb2461eb3ed73ee2c51b83d175d735a00c004fbe7706553ccc19ae6c60fcad7106fbb00cee6042d9776d45797a1895d2d899dd9de328bdc4c
TLSH
T197414B303161A5D84D435F1209286EC5A2EF478AAFBC9F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 39a6a65921ad81a0043f46839045fa390ae4d285382154bbe2fbbb76a517b1ca
MD5 0c159e4c27795e9d644b50aac83df3e1
SHA1 4b00e8b21f23f127e8f3917286d889c81a939786
SHA512 9840f77d45a06bffffec1bffd19c52a1a16de335d1dcce6cf6e4c6a668f0ef1f648661918ffe70a4bd7fa16334a73dcce0cb59f1b036c269a50827f8dab794f1
TLSH
T164112B33F79CC0B4C9D5157A1489AD01B1B6C7CB009EDECB7A84C514DA7F989EF541A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 7273ae444d18982416586cbd6c29291bd965acc3405bededd8795485d0c332b2
MD5 b1e5c56251dbd4e706625c31789cd681
SHA1 06737224c8295659b70e78408565a40bf2c9d278
SHA512 cd37f2c2f3e8e64fdc3af3c5e3a82a9060ab3f0d8ac755d4c356607a792692ad68acb581f892cef20f603fffed1c3437025afd7d0d14e191e57eb258c6ce9afe
SSDEEP 384:2QHwHB1GAjb25NFRHEME9czn2ab5/Z1zZFWeKXceSRsu8Bud7q:w1krRPEuVhP7ZKzSKJBX
TLSH
T145924B5D715F52C7C0A853B8D002074FF9F28ACEC384AECD7B5C4D3784AAA6580AE5E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 576a6acb964aadc57e8cd155db388719a2e0b54b6526d33597ec5d2964292b77
MD5 75e51d3e00a750be062b04a1c7c39d6f
SHA1 2af248740d75ef74864a4ef03e8551d93ee2fd6f
SHA512 420e8776dd39b85e10a393b0c25fc062a39e630f2a4446c64c41c2eee13ddf13e4fc7e70b0de84716eba61f56c1ef032936e28d798fefee818c35eaa90ea0abe
SSDEEP 384:NL3HJ41S1ZhJ2hjwK8YFRKEoEeHnnNfjs2llYgkMJc32L8zCEFQBUzAg18DI:Fi1SZJ2iK5RaE+Nfj7vYgkMu3PzCPBUD
TLSH
T10982B4AE614F22C3C8D91378D107050FE4F2DE8D03292BD9B72A9E7BCDACA5A416D558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRK_UPDT_d2xbyf9.vbs

Path C:\Users\Admin\AppData\Local\Temp\CRK_UPDT_d2xbyf9.vbs
Size 2KB
SHA256 92fe72cceb630c7eff3b2d3bed9c6969f53e5b9dff1f481888754e59b3c76ab7
MD5 b91c1157d6f1e605cc965d092551b307
SHA1 02469c313acdea89c3a669741093e9fe09dfcdfb
SHA512 bc3174aa8962d92910c6183dbefdac6987893eaf10a7dce029cc5bf4133f9b23af7b440c3ed0ed7a499a2049f72d331344ad7472241bcc737aa4dcf878000a6f
TLSH
T1BA519A5DBB0FC53905011AE04DB905096FFCC723D157CA29794FC88E0B1A57DC6E6AE6
MD5 SHA1 SHA512 TLSH

Submit Download

MASAIO.ps1

Path C:\Users\Admin\AppData\Local\Temp\MASAIO.ps1
Size 838B
SHA256 5368da434b56d4106b79588a74e84dd883b64c735b9a9c8b79563a9756a48c74
MD5 7e244ffd04934b4926ad298c867e0518
SHA1 522af5ba5c4cabb7b90af763fd39e5ec8fc04c19
SHA512 b6905092d0deaf06e9295005ad6495924eb1bb3cffa78a87234782a83ddceb1abdf161ec8b678d365e8acac80512226fb85be98d249f699e8c48675be7904e40
TLSH
T13C014613B20881E59D93855B60EEE2AE8D75755F41072D1036B0D18CBAB03ECC3D4094
MD5 SHA1 SHA512 TLSH

Submit Download

MAS_AIO_WIN.ps1

Path C:\Users\Admin\AppData\Local\Temp\MAS_AIO_WIN.ps1
Size 5KB
SHA256 5007bbfb871abb16381ff2df4f742962faebf5caf5fdb036339499b1ee02a14c
MD5 cf011bfc53345144bb698288be035a9a
SHA1 c70a5b99d65dd6f9a84dc978b96072a03fa127c6
SHA512 c3008cc3141f8a66186ad32d0953861975f4137ed264b0115c19fa9350804f242b060508a3f91880f72332b5841b5369977fdcb2b497ed92a2f70509817c2086
SSDEEP 96:p3SIOhuC+EZZdF3KhX7PSxSSS2SSw10qFBTfzlYlieQIRGe1kE5CrJ9:xSIOhuiZY+Iz2zPyBbzlYlx7RGEkt
TLSH
T193C18629E908426A12B373BF4C569C08FBDB422FC2515D44796CF4A46FF505EC6B0E7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WININF.vbs

Path C:\Users\Admin\AppData\Local\Temp\WININF.vbs
Size 2KB
SHA256 14f12199c930e4d4d6671dd9565423aac5ae259668c64298e194f329895d670a
MD5 ed182dc22e8b528b90631fd660782168
SHA1 8af052394d4fcb016f2d205bc18cd88d8f8667f0
SHA512 42f61103935f51fe7f9a2141458798ba4a1c6ea486ba07950527881edabe25e5e3d809139bf353f78eb568dd9ac3f24ecb6a3c10324fa2be096f3070e218e633
TLSH
T1CC414F163A01E2B5D1331EF09D7F655ECAB8011B38A689C43584CAC90F3607F9AB12B8
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vlos5ojt.lp2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vlos5ojt.lp2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 6KB
SHA256 92e2836cadf533d7b4c97eaa45ecb95a6c56a11716072fb342283456aae280a2
MD5 ddef96582379f7c3cadbae901f3bae35
SHA1 f9dca9fa232a77cf39cd090ba9e71e23dd622994
SHA512 f704f276b690b6a00b4b1651a4eda9962fd1578782f4281867d5f8d8e8ff48014d17850e973b9ad14058f9ecbf8036b26df9a44b1c112445a2593b4932060204
SSDEEP 96:4kOmDxCaSMtFukvhkvCCtUBdMuQQH3MuQQH2:4kOgzPc0M/EM//
TLSH
T1D3D1AA1053F25618E1BA8E3A68B6E3219375B845EF16EBCF2240616D9C30629F53876F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 6KB
SHA256 b7390f97e9a94fc9684f731a51415d97d798e30dfe876a9b286da3f22f73bdce
MD5 ab18639c1b42786e1753f470d661759b
SHA1 74fd556382df29f9ccb167233770ebc1d857886b
SHA512 ee57029eaa3656f99e76cf4fded8e986052bbb17706d13eaaa4e0eb46cbe728b24bb2c15966d2780f5180201d32595fb4090fd77ce2a5807753ed7ae801c3942
SSDEEP 96:4OOJDZCqSI+FukvhkvCCtUBdMuQQH3MuQQH2:4OOBnsc0M/EM//
TLSH
T125D1CD1113F25718E1BB8E3A68B6E3219375B845EF16DBCF2240616D9C30629F53876F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd

Path C:\Windows\Temp\MAS_24feef5f-41de-4e4d-aec7-a2e52c7c387c.cmd
Size 744KB
SHA256 afd0d7a9bf2e9ee441ddfb89f09b97c96b65cfc5bf9adffc1d95480c81fab676
MD5 1c5a9e88075d2350548c76cd51c2780b
SHA1 dcae185b70d85f64aceaef7cb4d17a6a93ed089f
SHA512 7e888a2f89219af70e13ee28c197c3243e9d1d467c8e95346f0e0c48801d919ca51754719502490beaa613a487b4e2417cfc2838ddaafeb633893f78ecaf6efb
SSDEEP 6144:m3IufxkU5/8BcEvTGmFOE8THncQx4Oz0ykw7Au2:m3IuuhcEvTGGOEmcAXz0ykw7g
TLSH
T109F41A466D0261A601B3F379DE53814EFB2AC2638375526879ADC044BF36309A2FEF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-188-0x000002DFF11E0000-0x000002DFF1202000-memory.dmp

Download

memory/3236-37-0x00000000077D0000-0x00000000077EA000-memory.dmp

Download

memory/3236-36-0x0000000007E10000-0x000000000848A000-memory.dmp

Download

memory/3236-13-0x00000000057D0000-0x00000000057F2000-memory.dmp

Download

memory/3236-39-0x0000000007A90000-0x0000000007B26000-memory.dmp

Download

memory/3236-11-0x0000000003200000-0x0000000003236000-memory.dmp

Download

memory/3236-38-0x0000000007830000-0x000000000783A000-memory.dmp

Download

memory/3236-45-0x0000000008B40000-0x00000000090E6000-memory.dmp

Download

memory/3236-14-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Download

memory/3236-44-0x0000000007DA0000-0x0000000007DC2000-memory.dmp

Download

memory/3236-40-0x0000000007860000-0x0000000007871000-memory.dmp

Download

memory/3236-27-0x000000006F0C0000-0x000000006F10C000-memory.dmp

Download

memory/3236-12-0x00000000058C0000-0x0000000005EEA000-memory.dmp

Download

memory/3236-34-0x0000000007630000-0x000000000764E000-memory.dmp

Download

memory/3236-35-0x0000000007690000-0x0000000007734000-memory.dmp

Download

memory/3236-26-0x0000000007650000-0x0000000007684000-memory.dmp

Download

memory/3236-24-0x00000000064D0000-0x000000000651C000-memory.dmp

Download

memory/3236-23-0x0000000006480000-0x000000000649E000-memory.dmp

Download

memory/3236-22-0x0000000006080000-0x00000000063D7000-memory.dmp

Download

memory/3236-15-0x0000000005F60000-0x0000000005FC6000-memory.dmp

Download

memory/4872-42-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4872-204-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4872-206-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4872-0-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4872-41-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4872-201-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5820-62-0x0000000006330000-0x0000000006687000-memory.dmp

Download

memory/5820-95-0x0000000008810000-0x00000000089D2000-memory.dmp

Download

memory/5820-65-0x0000000006DA0000-0x0000000006DEC000-memory.dmp

Download