hxxp://irisbutt[.]duckdns[.]org

Analysis

user interaction
yes
max time kernel
287s
max time network
291s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://irisbutt.duckdns.org
Sample260724-tgf6ystdng

Score

5^/10

adware discovery execution persistence ransomware spyware

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs

execution

Visual Basic

T1059.005

pid	Process
1736	WScript.exe
4388	WScript.exe
3320	WScript.exe
4448	WScript.exe
4380	WScript.exe
1312	WScript.exe
3576	WScript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2516	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293825051818512"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
4080	chrome.exe
4080	chrome.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1184	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe
Token: SeShutdownPrivilege	3016	chrome.exe
Token: SeCreatePagefilePrivilege	3016	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
3016	chrome.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe
1184	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 5592	3016	chrome.exe	87
PID 3016 wrote to memory of 5316	3016	chrome.exe	90
PID 3016 wrote to memory of 2516	3016	chrome.exe	89
PID 3016 wrote to memory of 5316	3016	chrome.exe	90
PID 3016 wrote to memory of 1324	3016	chrome.exe	92
PID 3016 wrote to memory of 1324	3016	chrome.exe	92
PID 3016 wrote to memory of 3816	3016	chrome.exe	93
PID 3016 wrote to memory of 3816	3016	chrome.exe	93
PID 3016 wrote to memory of 5000	3016	chrome.exe	94
PID 3016 wrote to memory of 5000	3016	chrome.exe	94
PID 3016 wrote to memory of 5044	3016	chrome.exe	95
PID 3016 wrote to memory of 5044	3016	chrome.exe	95
PID 3016 wrote to memory of 6084	3016	chrome.exe	96
PID 3016 wrote to memory of 6084	3016	chrome.exe	96
PID 3016 wrote to memory of 2332	3016	chrome.exe	97
PID 3016 wrote to memory of 1272	3016	chrome.exe	98
PID 3016 wrote to memory of 2960	3016	chrome.exe	99
PID 3016 wrote to memory of 1272	3016	chrome.exe	98
PID 3016 wrote to memory of 2960	3016	chrome.exe	99
PID 3016 wrote to memory of 200	3016	chrome.exe	103
PID 3016 wrote to memory of 3224	3016	chrome.exe	104
PID 3016 wrote to memory of 200	3016	chrome.exe	103
PID 3016 wrote to memory of 3224	3016	chrome.exe	104
PID 3016 wrote to memory of 4976	3016	chrome.exe	105
PID 3016 wrote to memory of 4976	3016	chrome.exe	105
PID 3016 wrote to memory of 3288	3016	chrome.exe	106
PID 3016 wrote to memory of 3288	3016	chrome.exe	106
PID 3016 wrote to memory of 6116	3016	chrome.exe	107
PID 3016 wrote to memory of 2388	3016	chrome.exe	108
PID 3016 wrote to memory of 6116	3016	chrome.exe	107
PID 3016 wrote to memory of 2388	3016	chrome.exe	108
PID 3016 wrote to memory of 4088	3016	chrome.exe	109
PID 3016 wrote to memory of 4088	3016	chrome.exe	109
PID 3016 wrote to memory of 5720	3016	chrome.exe	110
PID 3016 wrote to memory of 5720	3016	chrome.exe	110
PID 3016 wrote to memory of 5964	3016	chrome.exe	112
PID 3016 wrote to memory of 5964	3016	chrome.exe	112
PID 3016 wrote to memory of 5580	3016	chrome.exe	113
PID 3016 wrote to memory of 5580	3016	chrome.exe	113
PID 3016 wrote to memory of 1588	3016	chrome.exe	114
PID 3016 wrote to memory of 1588	3016	chrome.exe	114
PID 3016 wrote to memory of 3956	3016	chrome.exe	115
PID 3016 wrote to memory of 3956	3016	chrome.exe	115
PID 3016 wrote to memory of 4456	3016	chrome.exe	116
PID 3016 wrote to memory of 4456	3016	chrome.exe	116
PID 3016 wrote to memory of 2708	3016	chrome.exe	118
PID 3016 wrote to memory of 4440	3016	chrome.exe	119
PID 3016 wrote to memory of 4624	3016	chrome.exe	120
PID 3016 wrote to memory of 4788	3016	chrome.exe	121
PID 3016 wrote to memory of 4788	3016	chrome.exe	121
PID 3016 wrote to memory of 1536	3016	chrome.exe	122
PID 3016 wrote to memory of 1536	3016	chrome.exe	122
PID 3016 wrote to memory of 5956	3016	chrome.exe	123
PID 3016 wrote to memory of 5956	3016	chrome.exe	123
PID 3016 wrote to memory of 1352	3016	chrome.exe	124
PID 3016 wrote to memory of 1352	3016	chrome.exe	124
PID 3016 wrote to memory of 264	3016	chrome.exe	125
PID 3016 wrote to memory of 264	3016	chrome.exe	125
PID 3016 wrote to memory of 4768	3016	chrome.exe	126
PID 3016 wrote to memory of 4768	3016	chrome.exe	126
PID 3016 wrote to memory of 3652	3016	chrome.exe	127
PID 3016 wrote to memory of 3652	3016	chrome.exe	127
PID 3016 wrote to memory of 3096	3016	chrome.exe	128
PID 3016 wrote to memory of 3096	3016	chrome.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://irisbutt.duckdns.org
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc81a6c728,0x7ffc81a6c734,0x7ffc81a6c740
  2⤵
  PID:5592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,6427042691265612064,7214777162320697579,524288 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,9477856476592778367,747805574610012476,262144 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2028,i,7051760849859430988,13591088824178163953,524288 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,14442083926092867781,5737910347942604867,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,4890248060790988090,14975909687035703750,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4656,i,5928745996582078025,9187065291628966332,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3164,i,14327217691413886053,11233811937627930976,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,15390975269082471539,2747552203162676343,524288 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5268,i,4076499048020909276,5270664918488562515,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5224,i,8866845906206267283,5037709787284185960,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5560,i,4731981024512499201,11763747730470921093,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5260,i,5681455791051329025,10292400404136853866,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5884,i,3285288639809812223,11567116141300963820,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5384,i,8189938726445767767,15708766250894247183,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6128,i,1186599362528732491,17616025375592916970,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6088,i,4144060176565990631,16103772482147904255,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5496,i,10531401615117035130,11772705463893507359,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5972,i,17821346055545031231,4228884954825025315,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5380,i,6809894504154541277,11624614190197712214,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5832,i,16031274456964017580,16670978415856996634,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6104,i,1000575143787408082,3743000983957343806,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5840,i,8641689880628004068,13259746205112873500,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5296,i,13015185450574561748,11812210405874538808,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,7694230851696540634,16766930001647312590,524288 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,6354968848152915781,5641117672139377576,524288 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:14
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,4399837029547606800,1240037820328439854,524288 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5964,i,17557050041987538189,11273835781293056252,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5444,i,9694417715308768942,1258794354697627128,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=3120,i,7492994503167698520,16209827150714701754,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5292,i,10105907653976494068,8627341975924966292,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5976,i,15033298980276112913,17606593041989224811,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5856,i,4459711282644359512,15035256745797606621,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=5276,i,17347947625352718779,4587301880742366024,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5224,i,10005757747617840661,10551199053033862993,2097152 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,13593972221799701467,4081342916259106277,524288 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5852,i,4520564065547983085,14890398199125243125,262144 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,3583559029543726615,6708698837837430633,524288 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:14
  2⤵
  PID:3280
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\PWSS.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,3766835158500565172,7421776687700226456,524288 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:3468
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\PWS.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4388
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\PWS.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3320
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\PWS.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,4154988093983523033,4179088888506517311,524288 --field-trial-handle=2476,i,11102306829291390131,5550437259381468962,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
  2⤵
  PID:5160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4916

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1184
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:5376
- - C:\Users\Admin\Downloads\TG\python.exe
    python get-pip.py
    3⤵
    PID:3036
- - C:\Users\Admin\Downloads\TG\python.exe
    python tg.py
    3⤵
    PID:5452

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\PWSS.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\PWS.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4380

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\PWS.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1312

C:\Users\Admin\Downloads\TG\python.exe
"C:\Users\Admin\Downloads\TG\python.exe"
1⤵
PID:6044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

089eb096-783a-41f2-8021-9c320290d4e1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\089eb096-783a-41f2-8021-9c320290d4e1.tmp
Size 5KB
SHA256 96d8ef50975abb2ce818d0fbdf46921e76e06baa33082a8e91c85eea2c3c33b2
MD5 6567e88d63d6c4be54473f9ba6dbc887
SHA1 8c3f0f0c9feab213a75b1abe5dbc6d856e93ee84
SHA512 e631ea04a897920b2661fde4c875c09c836ec7658540c6c90202dc6c1aedfe479f584893d7f337014c022e764c830b169b1b914946ebffb653e7886a5229ac40
SSDEEP 96:CC0d+qKJku7fby2f2eaPphCLnvSl8h4otop5EItDPB6uCDdGyvODcyXxwzjQ4H1R:CC0AJr7fbyVlAiU2j5cwFcmxoQ4H1aDK
TLSH
T1C4C13B72F86E6C7759F7D151B4032E43CEB5A2E7AA11AE64CAEA0F0C00DB1EC1342116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 8fbc538d4063cc644478455a585be583b92f2250ed4faf2401ce282db7390702
MD5 112f14da050f026d1ea48a63da0d317a
SHA1 255d73fe3aaeafbe713eb171104addf4ebf8afa5
SHA512 69d170edfd54bd309640e9c3a726d944f080f32712fdab2542dfb31254710bd17523ec9ac1567e4ee6e090cf40f00c4276a9e90f8005415840fee322f3a588df
TLSH
T168B001505BF08457DA84077DB59629A532612D681B2273A6C3A1A0F8986B2E64942AC2
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 3d00122ad3de6ccb33f87b04edff86089e84848bfaeae852f208e95d59381c4f
MD5 b9476119b2f44f66d88a9dd4cbe0e3b7
SHA1 434a6bd85fbac86db49183e8a47a29572f62ba07
SHA512 4b54b3b1cdbf76e80e1a03610c909f5e99f82ea89a4f60b05bb661c1e8ceefcfa2a4620f5e01f3448c88962311fa42a5ce95fa48f20491fc3eecaf84d4b32bc9
SSDEEP 3:MsEllllkEthXllkl2zE1lED+/ll:/M/xT02znitl
TLSH
T19444041D7FC1541DC5101030C051C7743770F414051157D3357504535CCF5440D01041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

9e06f7d6-7d1a-48e1-90cd-8400e78f69a2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9e06f7d6-7d1a-48e1-90cd-8400e78f69a2.tmp
Size 523B
SHA256 3a18d6e9de9ba0f00603f11e5137606f1c6d94c6a90cc30431672d36d0c83483
MD5 996253c168a581835d6e75da071290aa
SHA1 ae92d239bbb5eddba01f4d323b26a8e405f7af03
SHA512 e035b9e476dfd88fc392826b64b4e53b92220def4ec570d5946a55098d96f654434dcb11b7fe920d81b4320da6f5a8bdcdcef1d0fd9eea1dac98adf31b8b1cda
TLSH
T17CF0246BAA7F7477007A89AE5F05B8096CB6A4350241A8F1CE9A82BDA0D59E71F02453
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9b2e5048e7354c69fb4d960b6fcf2bbe6426e1e5e334edfd402ef5c42e655656
MD5 ce99b61d2781b3d355d848a7098b30a4
SHA1 64bca72bb7fea912decbc842808d4286b8384eb7
SHA512 8326cc074d32e3edb9719fee293598db329b8c4f5f5e37b0cea0a7c224b35ddd2dd6197f3ed26960da91a2ed9013e211472857a52ea20cae596751b5dddc1ec7
TLSH
T17A418EB7C7D8957D891156F4A7156E1BCE2D0E18432C3C26C8D8BE1F57F2871D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7b5738fac6ea040b8d615eca631d1b63d61a8c9221b57ac6bcf7d74daceda285
MD5 7c2a097f03e34e88da069052b4e4bb91
SHA1 35f153fe915b2bf5b8acb755b5b198808d59dff1
SHA512 787d65b0ee80d17e00bcf702af3188fcd55c3c9d9a9eeb9c279d7e5fc091c3ca061956870d2e6a642cfcd92ec852075afb953bb3c0f117506471efa32cf7d0be
TLSH
T181517DF7C3E8957D894155F4AB156E1BCE290918432C3C6789D4AE1BA7F2871E20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 89e0a03fab7af9004d426a11e986440939efcead1a84bc48f73422073c189d8e
MD5 cf6c4807065ea8f833f6ffe8da66d918
SHA1 3283aaa0a5cf2de3f1165056b5197b6c0426a2ae
SHA512 cebf1241a66f93052c3997835385c705c6b8f63fdb5dec25725cb38c676b8e4d31c89ffba4b1d3da3f8a4116fbd1a3c2f78b8fbd1229de70ca8f9c728364e4ad
TLSH
T184418EB7C7D8957D891156F4A7156E1BCE2D0E18432C3C26C8D8BE1F57F2871D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4b579e501dbf5a15726a4743c02d5e1c40ef485a4e6c7c1ebba89d5d61420eda
MD5 8ca4c8a85908509e0ff6008d19838ee1
SHA1 b0ac30b46956e9549448f6e956ff60124b718509
SHA512 bf259bc10debfe9b4f612fce4d972d94c4306cf3008f3ef538564977b295df5e9fcd419472d9322c48bbd5db3aef7700d1b26063b04e9dcbb2925729e8b8c6ef
TLSH
T15A518EF7C3E8957D891151F4EB196E1BCE290918432C3C6688D4BE1B97F2871E21464E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0858c23387312c0dbcd16aac02b25bd08ddc83466d74ab92be7cae1fabdc2582
MD5 cda4514d4e43cdfe5bca714ef0829877
SHA1 e0372c50413697af4c739b945e240557459ed641
SHA512 c021f1b6371dd459596d55a14711394c98a0ec51982f3ae1f36ba9f034e1dbf3a7c1c7785742f1187716e21ad25c307e0f02d4051f7e0c904865b6a7fae737ad
SSDEEP 192:ZR3Bolwv7uvmPRpUrkLj+9UHgNp+Ntzb+WNnz1D+mjBVLp2pvb2LeMY4ubVyIsnv:ZR3BYsKAXl2GA25Drj2pD2NYLE
TLSH
T16E52C75EAD10597B6CDBD229F965BB66D2F6102261D02E84F7FC8E2C14E76CC6307413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 787d9979e89951b538623ec79436394feef0ad2727c4c3f25e0f0675353143fd
MD5 60b3ca1f88de68e6110b2ea60bf973ca
SHA1 c67986a60930810f2a5a6d9566ee90d129e10cb6
SHA512 1f4a73a2f7e08adf793da14d4a8179d5ba4a449d5c58c16311b76500c1264e1d15c7e6361f27e0b048f852ecb7d8afc0f360f2e0132906c755d2d7723f66ec6e
SSDEEP 192:ZR3BoMwv7uvAPRp2rI49UHgNnb+WNnz1P5b2LeMY4YbVyIsnAUge:ZR3B5sK6XiGY5PN2NYTe
TLSH
T13832C76EAE14697B6CCBC229FA61B767D6F6102271D02E80E7FC8A2C10E75CC6317407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3de0a79db724d4ff57e26cdcf2bc284a903eaafb67b833b347c66a5559233031
MD5 ba34e51896c39c0e96683dec773eba6b
SHA1 cf15e915a6023dae341e0ec42a77fbd0e4a0080a
SHA512 21381a24b40dca77cdd1358031cf5a8dfc5b2adf8ccbb389fdbe6260398159ac081ac44621f0fef6c0b779f1410e7f5bb3d5cc999d28f623f11969ec0932c3e3
SSDEEP 192:ZR3Boewv7uvAPRp2rkLQ9UHgNp+Nrb+WNnz1D+mjB20b2LeMY4QbVyIsnAUgE:ZR3BPsK6XPMGAK5Dr2C2NYPE
TLSH
T1E342D86EAE10697B6CCBD229F965B757D2F6102261D02E80F6FC8E2C10E76CCA317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ca27d46a83db36fc2ee0d6b2d279751cd7f540d6a31c77978f4de10de6227758
MD5 d217f46f94e77fcb3b5cc51d5294f65c
SHA1 fb0e270099da7dad015b9a21cdc8e2cbee82af91
SHA512 7b542ad4d56fe9102fae69109d291299ac35f8b9e1df4128fb58e85e47b30aaa54c27011641d755cf09afdce96dd62d81958b9e1dc38a6e4d7c0a992301e6313
SSDEEP 192:ZR3Eopwv7uvmPRpUrkLjyr9UHgNp+Ntzb+WNnz1D+mjBVf4V6Yeivb2LeMY4ubVo:ZR3EcsKAXloGA25DraHeiD2NYLE
TLSH
T1D952C76EAD10697B6CDBC129F965BB66D2F61026A1D02E80F7FC8E1C10E76CCA317403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a1c21a1a9cb33cd62648d1d89a763d0918b668f53aae0fb3cdd650fb927a59bb
MD5 14721c4311c6d31cb27628cf6645fbe6
SHA1 ab3ff10fcc19bf101220f8b7486a80b4e6e55504
SHA512 c84dce6a83253ce68aaeab7d5a1aec14aed9cf68111762eb8d7c6dbb26b4dc9a78ec8df1aec81dec52b456a71fcac52387bca59c7bd63a1edfc2817df2af0e11
SSDEEP 192:ZR3vopwv7uvmPRpUrkLjyr9UHgNp+Ntzb+WNnz1D+mjBVf4V7hYhvb2LeMY4ubVo:ZR3vcsKAXloGA25DrazYhD2NYLE
TLSH
T14C52C76EAD10597B6CDBD129F965BB6AD2F61026A1D02E80F7FC8E1C10E76CCA317403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 faafa32d7da83f7fc2bd76ccd834a0dfec5a78973368722e61fdcf61368b4eca
MD5 a0e8763a3f437d8dbe860b182bcb4222
SHA1 8139b30ccf69035a65016888dd5b9def6b9604b2
SHA512 21de26630f58d5b8939fc1e03a1a198715eec56ec88eb01bdc4a9c4225c09158eb477066eb6b3ae791251972512835f4ad242eae717f54826b862865bbcfb6bb
SSDEEP 192:ZR3Bopwv7uvmPRpUrkLjyr9UHgNp+Ntzb+WNnz1D+mjBVf4V0l2Avb2LeMY4ubVo:ZR3BcsKAXloGA25Dram2AD2NYLE
TLSH
T11352C76EAD10597B6CDBC129F965BB66D6F21026A1D02E80F7FC8E1C14E76CCA317403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9f49ee3dd88aa83fd10b9bd2d7727d9ca649c5516822c731345eaa0ba8d8e2d4
MD5 22fd1c5e2febcbe77ded65f4da0628b0
SHA1 cf88303cdaabd7fa0a536318aac308c43314dcb4
SHA512 c4b638cb12b0a2d4911e35bd858ba0d45785fe0d55055023a3d28bf774154efa1f66f238b1598c629ef74e3537c0fef9dd03aebc0279beafcdff0ae44677d674
SSDEEP 192:ZR3BoMwv7uvAPRp2rmJLQ9UHgNl+Nrb+WNnz1D+mjB2Fb2LeMY4YbVyIsnAUge:ZR3B5sK6XRJMG8K5Dr2p2NYTe
TLSH
T16742B56EAE10697B6CCBC229F965B767D6F6012261D02E80F6FC8E2C10E76CC6317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 299e8615a3f2fffb9e542c09dd36d9288b663b0afc2187637a5d527cf2425a22
MD5 16903efce7f81e1e4e699e22dbb18cd8
SHA1 a3d470063ec4fc16d4c5aaf3f9966efc7d4ba876
SHA512 34a11b5e8467aa5f706abbd11ce489d3c3aa576e8c7e9bc8080a5b2bc5d6afdc230990e0500610ff7f750e85bf831e1df2bc5bfd075b07fc5b06939676ac048f
SSDEEP 192:ZR3topwv7uvmPRpUrkLjyr9UHgNp+Ntzb+WNnz1D+mjBVf4V0l2Avb2LeMY4ubVo:ZR3tcsKAXloGA25Dram2AD2NYLE
TLSH
T1FD52C76EAD10597B6CDBC129F965BB66D6F21026A1D02E80F7FC8E1C14E76CCA317403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bf6ea6645ec63541a1693c05af9c4da29be6801822455209f2cadd84d7729e84
MD5 364247ff00ac82cf55ff6eb1f1cd4998
SHA1 aabb4aa7571ed82698d039995732f03b478e3814
SHA512 75a3763c3b2ea1027d616baac2dae5004ae4675f1be8d8e42a9de9a54cd8de27c08a5378dc69c6babb99c640a5f9ac7b8c6f14d6079c91ae957f9976d5f7ed43
SSDEEP 192:ZR3BoPwv7uvAPRp2rkLj+9UHgNp+Ntzb+WNnz1D+mjBVOs2Fb2LeMY4QbVyIsnAI:ZR3B6sK6XP2GA25Drv2p2NYPE
TLSH
T18142B76EAE10697B6CDBD229F965B756D6F6012261D02E80F7FC8E2C10E76CCA317413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 93785f5a55dd4064becb4f1cff2db93ee5c453069390cd1f175b14efbc7c3712
MD5 3f745d2e721c8e8653083d0942fd1e3b
SHA1 65c5deb319ad77fa2904b9e80a68747d89661424
SHA512 1054802f590f58b87fcf7dd07e0c496be092915ce6b1963537363cc344b69aa858c5224a631afcd5370a01ccfdb24fd88e105054f3077d30b55a845f9d252488
SSDEEP 192:etK4K6nP7KxkXqK4I40pUZNCgVLHrKHfFKslEOlbXzKD/0T+ErUkKN9mO5a1AfTH:oKj8P7KxkXqKf/pUZNCgVLH2Hfgslxbg
TLSH
T10132EA67948D9E3B4FD8D518CC176B8B6CB4019673780824A6FF9D0403A67CE114A6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f51efee3eb71e6798b2dcb667e94a5cf79d881ca87fc5e48f3c36cf42d6f8bda
MD5 e9305a8c86ab5dc4b4161bafc71f8ef7
SHA1 19b136b78fe4466f4938752660ceed1f53acfad8
SHA512 a7a1ef2af612def69558fd2bbfb7d270a0d1facae84079ada1bb3527f670898c0e215b707808046455847460fe38f778b0d51a40989210bbb6bff07316dbffc0
SSDEEP 96:CbJod+qKJku7fby2f2eaPphCLnvSl8h4otop5EItDPB6uCDdGyvODcDTaDeRNC3+:CtoAJr7fbyVlAiU2j5cwFcDTaDeuCOC
TLSH
T1AFC12A75E85E5C7B4DF7A444B1032E03CDA5A2ABB951BE28EAE91F0C00E75EC0383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 c796cca1a190e2a40fdeb2fa3f4c798665618be270e3d6bf2c31f888a7bab255
MD5 316d9d87e756e277672f6c4d164fe676
SHA1 f068fc27f2ec70e7246d9f1bfc8d4209d17d4871
SHA512 bfd17e8b7df99792839e8c833c829852d3a027991eb6265b9e33e6592f6a01364318dec74810fafe989a19d4268e6fdee242aa9a8b32a1b546dcedeae93aa681
SSDEEP 192:CtoAJr7fbyVlAiUDZ5cwFcD0aDeu8xz/s:CtBtMA7cVHDeu8B/s
TLSH
T18CD11B75E85E5C7B4DF6A449F1032E43CEA5A2ABB951BE28D9E90F0C01E75EC4383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3ccf7836ce1ff115cec784edd50b530817dad6ecae51bf29f4ba86d97146221f
MD5 790151542185d4e3f8c155f19bcccba0
SHA1 8e1c32a5d0e75074263701d770ec808b9946d10d
SHA512 db1d9ddf5c5fe79d6c7b5496686f6c2222d239050868ab79e2602a8d2a2c3018493f4927bbaec870745800b33feebc566fee28d5036d05589f00b248af2ac0ee
SSDEEP 96:CbJ0d+qKJku7fby2f2eaPphCLnvSl8h4otop5EItDPB6uCDdGyvODcyXxwzjQ4Hf:Ct0AJr7fbyVlAiU2j5cwFcmxoQ4H1aDK
TLSH
T136C12B72F86E6C7759F7E551B4023E43CEB5A2E7AA116E64CAEA0F0C00DB5EC1742117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d087626722bd4209374361705abfa5665ad760b93a876c642466a693357b0932
MD5 56f27bf68b2a0c673ee223d9b996e7d6
SHA1 2e9ea91c4063990519613663241bf63b24b4a111
SHA512 56fb26a31406255fc970403a349e32a64f10c0c30e3e8b52caedd51b71bd4c853066008bcaaf9b944b6040a1eadb72f8d680b37bd3f280732c00ad315d8fc534
SSDEEP 96:gC0d+qKJku7fby2f2eaPphrn3RDotok5E3DPB6AGyvODqLD/bjv4a:gC0AJr7fbyVlFDUDC5kFqLD/bH
TLSH
T10EA12972F4664C3B9DB7D448B5122E03CFB4B2A7B961ABA4DADD1F0C00EB1E80742127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 49bb7f31dced4a941adb5662d2d1cd1535468f4eab4177fb9dff9b2964a72daa
MD5 39225072f9ca4e8eabfcc136bfc05ca9
SHA1 e2ca10cf519c87941de29c3130fe2edfb7fa60b5
SHA512 c8d993334dda0be5cbdd7493dc8c0aed56b72a4e1afe4615ad045194ecaa4bdc1bc2ea677cfd796fd96d8208800845e7fb0b5c4edb2d88245502bfbbcc016bd1
SSDEEP 96:CbJ0d+qKJku7fby2f2eaPphCLnvSl8h4otop5EItDPB6uCDdGyvODcDTaDeRNC3+:Ct0AJr7fbyVlAiU2j5cwFcDTaDeuCOC
TLSH
T1B5C12A75E85E5C7B4DF7A444B1032E03CDA5A2ABB951BE68EAE90F0C00E75EC5383127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pip-26.1.2-py3-none-any.whl.metadata

Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-9633ejeu\pip-26.1.2-py3-none-any.whl.metadata
Size 4KB
SHA256 17832de47b5dc23e46253ba16462520036f28d9a27d5c30157784952ca4e69b2
MD5 e1d3fb276a1b4d7e2c8e46cdfd6ada86
SHA1 a7bf7d835bfb15c4b8387f102ccd7a5684e456f5
SHA512 826ee9277f5efe4071044f7b6878407e40b6da299348ad188cf26ce1370f734aa206baef8791c57589c6bf73b71c7214be1e08e38df57f978feb12637d9a67c5
SSDEEP 96:DFwsaMjaVMvxsxx/IFdfor3fUQhKQ0IE1EjZhsw9t30hcxShMYzcbl35qy:lsOaJ351
TLSH
T1A49196BB2FA457767F920B4AF217472F9D3A41AC798A6C7C74B851348620F31C0BD156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pip-26.1.2-py3-none-any.whl

Path C:\Users\Admin\AppData\Local\Temp\pip-unpack-iz4h1lku\pip-26.1.2-py3-none-any.whl
Size 1.7MB
SHA256 382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab
MD5 7225f2f0d0a1349525eb684280b3ebf4
SHA1 734b4b45b368dcba8d68bde365ca28bb73dfb2df
SHA512 232005367f7345db948414e60990dc458eae40a06fcdf72094c370fe0752b56d7302375612543fc0e91684c066c5506f37282b72d6e2ed8b1ef36b7f00f6a420
SSDEEP 49152:IOCl/xrR/CQktdWdeZqeVliLaKFMsRLL6oME1uCfi0rUzN:ITrBCQOWdeFVlhKFX5BfCzN
TLSH
T1178512BA80DD5672EAC7CF74E36AFF1D202B45826047A91D38AC2189D4BBD91FB4D704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\tmpeou6ro99\cacert.pem
Size 266KB
SHA256 fc9165a12403263e7ebfbdad7be7a3eac0fa5d325d3c70465f28d3690072ca28
MD5 7cec1f8cf3352074cc70f3c6595cc69a
SHA1 b47d7e19601ea93d81dd1fad2fde2916557f2b07
SHA512 59346b000274610016ef1eb57069edf809fab34622fdef6bcdcd01eee491a9335ff8a9ef596e8d2ca4f135fd144b9a7bc6020e7e92e2ed6cd99812d8ed1e7bd4
SSDEEP 6144:MnB8fRRiplrXURrqADwYCuCCgT/QRSRqNb7d84u5/hrB:CiRiLbURrHdRWavdX0/n
TLSH
T196447C964F269C092C9FE1C1CA9B1357DD3A027B99FEF0F1294A2408D24622B57FCD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pip.zip

Path C:\Users\Admin\AppData\Local\Temp\tmpeou6ro99\pip.zip
Size 1.7MB
SHA256 70299eba676025278e1f5399b764961125bfe2db5634cd17c685d81623f128ab
MD5 939f8ca62628a094a1c79570805d96e8
SHA1 801073815ec63f2ab20737919d8253a609ea9808
SHA512 37108bc9ef60a26e489782e90578a927b795b5ed10b31ea782a85fd5584d3b5052deb9a7809e6531d7c73e502107be1c123a93dd5c70f800747432f6562b7e60
SSDEEP 49152:TgWHjW2xnzoQktvQd87qezlKLcgTI2LtTW48ALYUPi9v:TE2xzoQcQd8PzlvgTnzjPyv
TLSH
T1CA8512AB8C9D5F62EEC78A34E362FB55081B45A36147E92D38EC218950B7991F3CF704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PWS.vbs

Path C:\Users\Admin\Downloads\PWS.vbs
Size 153B
SHA256 0d7cee0c13374181a23e8f605b32f2969c9c490b83c7891318f26bd17777fd7c
MD5 2862ffb5ea32ff114bebe41576441b02
SHA1 d9e78d276186e5ca049724796494489e228ff431
SHA512 fc68bf19449801ebe3733d6042684d7a175d446cf893de9e5214abc4db591c8249932590f2528273ea0f3d66a3ec24c1270b067a2fd403926de699893e1b7e9c
TLSH
T1D0C04C18EC1DD555A07AC1D302F3881CD784556652B99C18374CD84837212401F14067
MD5 SHA1 SHA512 TLSH

Submit Download

PWSS.vbs

Path C:\Users\Admin\Downloads\PWSS.vbs
Size 233B
SHA256 aa1fedffb8347551a3bac6dd1043863be35a9449d796af48833f70d8bb49a05d
MD5 cd467e95fbcb7287669b4a86b3049cbd
SHA1 f3d02fe650c9a15a83ef21daf1e89ef9bc6e19aa
SHA512 4dc67f4fea9df2273b58a9834e42e50b028f850f8c0157d24636c3d581808c9964bdbfabfa5e3b2e44d09cdb06efa6cae6ce541a5a727540f4b021221d81f0b3
TLSH
T156D0A724AC1FDB1091A9C0C306F2DA2C9784582113674D687A9EC84D77200009F38097
MD5 SHA1 SHA512 TLSH

Submit Download

pip.exe

Path C:\Users\Admin\Downloads\TG\Scripts\pip.exe
Size 105KB
SHA256 52a618b5a7a3e5e10c78789f078540c4ccab701c7bfb9dd2d83e9de98de61d34
MD5 398b3175399a3dc4d375d37f5800a26d
SHA1 5826023aea5f69ec54c98699772cd692bb710077
SHA512 792eee65d0a8cbaf9d53a172be285a6fff163390aae243da15839488dff4559016c672d171e4fff566667aebf822af28dc2e373c8d977712010e585b4d99f608
SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GGC:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+NC
TLSH
T1D2B36A0A33D420FDD0675274CDB68A15D3B2BC2A4674934F27A47B6A1F733926D2E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-308-0x000001C350EF0000-0x000001C350EF1000-memory.dmp

Download

memory/1184-312-0x000001C350EF0000-0x000001C350EF1000-memory.dmp

Download

memory/1184-309-0x000001C350EF0000-0x000001C350EF1000-memory.dmp

Download

memory/1184-310-0x000001C350EF0000-0x000001C350EF1000-memory.dmp

Download

memory/1184-311-0x000001C350EF0000-0x000001C350EF1000-memory.dmp

Download

memory/1184-313-0x000001C350EF0000-0x000001C350EF1000-memory.dmp

Download

memory/1184-302-0x000001C350EF0000-0x000001C350EF1000-memory.dmp

Download

memory/1184-304-0x000001C350EF0000-0x000001C350EF1000-memory.dmp

Download