pony | 8aa03cbf7a9290457ae0b7000b4d0b9ff60c97d7f5a11118d56c0fbd7ca3a105

Analysis

user interaction
yes
max time kernel
872s
max time network
872s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 14:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pony 1.9/pony/PonyBuilder.exe
Size 2.1MB
Sample260729-r8a3xaaa82
SHA256 8aa03cbf7a9290457ae0b7000b4d0b9ff60c97d7f5a11118d56c0fbd7ca3a105
MD5 4822e664cf87155b13cf659035a96aec
SHA1 1703c95bdc2acbcc55e07677e8cfef02f943de55
SHA512 5f0d72a0e3f9fdf97e50540c0d3cf13f08816d13245106d2911c3948b2e0473f9425f1ef06da412e588db58886fbe9e7b9be444e11315b7388e270c16292b1a4
SSDEEP 49152:iSOXB1VpIc1OMHPh0WMV5oaIjCHI+gc+eUe4he5QMYwFq6xqMe0UC/PxYq:ixM0OmtAoVjCHI+Z+eVAe5QMzFvxq0UF
TLSH
T191A533F4FBC13CF1E5E57A718815F9821412F0AAB74E21150C6AC586D73FAC3AB9A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access discovery execution pony rat spyware stealer upx

Malware Config

Extracted

Family

pony

http://mainserver.com/gate.php
http://reservehost.com/path/gate.php

Signatures

Family: Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Executes dropped EXE 2 IoCs

pid	Process
4692	Pony.exe
2740	Pony.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Pony.exe
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Pony.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Pony.exe
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Pony.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/736-0-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-2-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-3-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-10-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-142-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-144-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-146-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-147-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-281-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-283-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-284-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-305-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-323-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-324-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-454-0x0000000000400000-0x0000000000828000-memory.dmp	upx
behavioral3/memory/736-459-0x0000000000400000-0x0000000000828000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\~E5F16CD.TMP	polink.exe
File created	C:\Windows\~E59C21D.TMP	polink.exe
File created	C:\Windows\~E5B3852.TMP	polink.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1604	cmd.exe
1624	cmd.exe
4880	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	polink.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pony.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pony.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PonyBuilder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	polink.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	polink.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1988	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298110164058063"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	PonyBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	PonyBuilder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	PonyBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	PonyBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	PonyBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	PonyBuilder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	PonyBuilder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	PonyBuilder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	PonyBuilder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "5"	PonyBuilder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Documents"	PonyBuilder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	PonyBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	PonyBuilder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000	PonyBuilder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	PonyBuilder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	PonyBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	PonyBuilder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 01000000020000000300000000000000ffffffff	PonyBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	PonyBuilder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	PonyBuilder.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	PonyBuilder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	PonyBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	PonyBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	PonyBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy	PonyBuilder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	PonyBuilder.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	PonyBuilder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	PonyBuilder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	PonyBuilder.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4856	powershell.exe
4856	powershell.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4748	chrome.exe
4748	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
736	PonyBuilder.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe
Token: SeCreatePagefilePrivilege	4524	chrome.exe
Token: SeShutdownPrivilege	4524	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe
4524	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
736	PonyBuilder.exe
736	PonyBuilder.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 4880	736	PonyBuilder.exe	100
PID 4880 wrote to memory of 4288	4880	cmd.exe	102
PID 4880 wrote to memory of 3096	4880	cmd.exe	103
PID 736 wrote to memory of 1604	736	PonyBuilder.exe	113
PID 1604 wrote to memory of 2076	1604	cmd.exe	115
PID 1604 wrote to memory of 5048	1604	cmd.exe	116
PID 736 wrote to memory of 1624	736	PonyBuilder.exe	130
PID 1624 wrote to memory of 2320	1624	cmd.exe	132
PID 1624 wrote to memory of 4920	1624	cmd.exe	133
PID 4524 wrote to memory of 1668	4524	chrome.exe	136
PID 4524 wrote to memory of 3932	4524	chrome.exe	137
PID 4524 wrote to memory of 3932	4524	chrome.exe	137
PID 4524 wrote to memory of 1988	4524	chrome.exe	138
PID 4524 wrote to memory of 4444	4524	chrome.exe	140
PID 4524 wrote to memory of 4444	4524	chrome.exe	140
PID 4524 wrote to memory of 4824	4524	chrome.exe	142
PID 4524 wrote to memory of 1572	4524	chrome.exe	141
PID 4524 wrote to memory of 4824	4524	chrome.exe	142
PID 4524 wrote to memory of 1572	4524	chrome.exe	141
PID 4524 wrote to memory of 2564	4524	chrome.exe	143
PID 4524 wrote to memory of 2564	4524	chrome.exe	143
PID 4524 wrote to memory of 4836	4524	chrome.exe	144
PID 4524 wrote to memory of 4836	4524	chrome.exe	144
PID 4524 wrote to memory of 1116	4524	chrome.exe	145
PID 4524 wrote to memory of 1116	4524	chrome.exe	145
PID 4524 wrote to memory of 2320	4524	chrome.exe	146
PID 4524 wrote to memory of 2320	4524	chrome.exe	146
PID 4524 wrote to memory of 4492	4524	chrome.exe	147
PID 4524 wrote to memory of 4492	4524	chrome.exe	147
PID 4524 wrote to memory of 4924	4524	chrome.exe	148
PID 4524 wrote to memory of 4924	4524	chrome.exe	148
PID 4524 wrote to memory of 2708	4524	chrome.exe	149
PID 4524 wrote to memory of 2708	4524	chrome.exe	149
PID 4524 wrote to memory of 4184	4524	chrome.exe	150
PID 4524 wrote to memory of 2884	4524	chrome.exe	155
PID 4524 wrote to memory of 2884	4524	chrome.exe	155
PID 4524 wrote to memory of 1656	4524	chrome.exe	156
PID 4524 wrote to memory of 1656	4524	chrome.exe	156
PID 4524 wrote to memory of 4284	4524	chrome.exe	157
PID 4524 wrote to memory of 4284	4524	chrome.exe	157
PID 4524 wrote to memory of 4944	4524	chrome.exe	158
PID 4524 wrote to memory of 5096	4524	chrome.exe	159
PID 4524 wrote to memory of 2088	4524	chrome.exe	160
PID 4524 wrote to memory of 5116	4524	chrome.exe	161
PID 4524 wrote to memory of 5116	4524	chrome.exe	161
PID 4524 wrote to memory of 3824	4524	chrome.exe	162
PID 4524 wrote to memory of 3824	4524	chrome.exe	162
PID 4524 wrote to memory of 4748	4524	chrome.exe	163
PID 4524 wrote to memory of 1348	4524	chrome.exe	164
PID 4524 wrote to memory of 1348	4524	chrome.exe	164

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Pony.exe

C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\PonyBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\PonyBuilder.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\build.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\masm32\bin\ml.exe
    ..\masm32\bin\ml /nologo /c /coff /Cp /WX /I..\masm32\include\ /I..\masm32\com\include\ Pony.asm
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4288
- - C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\masm32\bin\polink.exe
    ..\masm32\bin\polink.exe /RELEASE /OUT:../Pony.exe /NOLOGO /SUBSYSTEM:WINDOWS /LIBPATH:..\masm32\lib Pony.obj
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\build.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\masm32\bin\ml.exe
    ..\masm32\bin\ml /nologo /c /coff /Cp /WX /I..\masm32\include\ /I..\masm32\com\include\ Pony.asm
    3⤵
    PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\masm32\bin\polink.exe
    ..\masm32\bin\polink.exe /RELEASE /OUT:../Pony.exe /NOLOGO /SUBSYSTEM:WINDOWS /LIBPATH:..\masm32\lib Pony.obj
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\build.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\masm32\bin\ml.exe
    ..\masm32\bin\ml /nologo /c /coff /Cp /WX /I..\masm32\include\ /I..\masm32\com\include\ Pony.asm
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\masm32\bin\polink.exe
    ..\masm32\bin\polink.exe /RELEASE /OUT:../Pony.exe /NOLOGO /SUBSYSTEM:WINDOWS /LIBPATH:..\masm32\lib Pony.obj
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc58b1c728,0x7ffc58b1c734,0x7ffc58b1c740
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,2460910913752998966,14660847832930775675,262144 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1776,i,11971199464265257495,1708456891172199728,524288 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2448,i,8530551182125341338,18130056521820445143,524288 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,4729307262420024527,6946382743072283431,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3424,i,15910662801837925360,4285722270198679023,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,14213113075272220109,2063143824985107658,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:2
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,9972377335193849316,8290247443524368751,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5008,i,11404635597313438585,17366964089179719167,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5124,i,9810938284643729065,9873431220029389713,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5572,i,2328477655106686332,18029226355894287959,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5528,i,15469809849417954608,10279783164679314695,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,16893247685169583482,10605291835993662466,524288 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6828,i,8460494068780881123,12958166690744938704,524288 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6912,i,13246451206198887925,14963177879538491547,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6836,i,16838194968076746511,10674133028254265337,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,10831556749261479466,2803274052011837805,524288 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6960,i,16802049425372582690,13330062108321323978,524288 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6936,i,3799957958377986664,13480541622035319110,524288 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6948,i,3767536670508935580,13707671400269435103,524288 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4780,i,1152497057209385366,4417834659481064421,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4880,i,9769707088645285723,18436461913668566488,2097152 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6840,i,10238113281920607965,6117578290785106687,262144 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3092,i,1760727148292054696,9580603193486668438,524288 --field-trial-handle=1988,i,11381755116667059573,4726724353262823849,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:1348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3448

C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\Pony.exe
"C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\Pony.exe"
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
PID:4692

C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\Pony.exe
"C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\Pony.exe"
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- outlook_win_path
PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 934e8a2dd0b8fc2347eea4a5fcd1e0271ad9d5a2afa5dffa8aef017283231eb4
MD5 f0d9cdb92f2136d897525d63ed1a375f
SHA1 ef4e84f76ab149db1d7def9088d5e039eac018fe
SHA512 df19c50bb58e85cdd1b10d5ef14c6e5b0a2d4cb19e1a0fa5c4162ed9647256cdf4b62690daf9898df15c607728b24f1f1b75426cd85f7748ba211368898599ce
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 312d6efdf7953afedd46f18211f26cf9b9d02f98c8a0e25fec4bdcf51976b842
MD5 d3cf765a9f5c290e5e842a609d4845dc
SHA1 0856d1d0a34fb2421ed3a00dc4921f461d94cd9e
SHA512 01287b480455ff144918222253c05949db9110d67bcb04febdbfcba6de46d1728d38d19e493c142f28ab7293b342c4d2053ebc937974140c7b99f5a2271a945b
TLSH
T106E02BA9C964AD2B08FD072928584B46F65423172B41896B3A3D970D8FB9A761586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 42KB
SHA256 3ef639cb811d22764660fc39517971f4109ee97aa0a442228c70dfbf3df9529c
MD5 c6d1d82e03f1afbb5597ce9f4bdc7b81
SHA1 999b71de05e9ce8da9ca9fc2b894058cfdfe57b4
SHA512 11d46e5fffe07e20e290a75a2797a442c5cdc52273c423670dbeb0c50184729773c639471ea27192bb685b070eea734e72035828c9806767bd1cf0ef61eb2d5a
SSDEEP 768:PZP8ym3DbsmYp5DuvGKQPwKLvEzVm0jAYY9W4DZelgQjK9cV92F44U54rc:PZPybsmk5DuQPzLyVm0jXlgoKI92YSc
TLSH
T1F213E0A5AAD591421BB04162E55A3C52B2ECE73140E8C8F7B76CECEB20E5BC676E10C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 21KB
SHA256 ddfc772d3e514eb86fdf926b6cd0ecee8fa54299b32e771c9d24fed72065543b
MD5 d322d730b0991da1ae55e68586ff40e3
SHA1 f2b22344bffe05f8e0fd5842a70ee344943c3e0a
SHA512 fe42468a82420539d6b755d5427fd35de61deaad6db4a5b52a14f0a8454933ddf329a5d345c438d8e8ac4a522dbb8a145be17702b01e8920f4b49339d5508211
SSDEEP 384:V+scj/sKzh4oD+DiQQhavQW/ifvUAarVEWp67PibgPkqkDF8jZ+YHHIuWye:ZcjUHi1hnciEtCWpy6bUi8j6ye
TLSH
T126A2E1A557AE1210D0B6796436FB4054228939FB16B0732BE6F1CA46F7A41F8CF0B90C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 39KB
SHA256 4ee0e4d6dd551e2d790dc6c46ed070452d18fa49966f5e41d3a9812e8e4546ad
MD5 ea59a13f4d6a7b77761402802bf00e2c
SHA1 dc360da58b9dd91fedb96f449ebd8d3d9f9cc08d
SHA512 230297296cd866f672a992abdd5c4302b7cb9af928f0d7dcfd5adc8ec6fc8beea6bbc98e531eeefda32ffd43e2a3b54a1df44455f86597f548f0e41b45742ae9
SSDEEP 768:ycfPAZ5cmU3BL2Dy0hMWPCmRfoY+jatp9iUHLD5jhmkqaivqt4fTJpLu:ycfoZ5cmEQhMJjAFAD6KtM
TLSH
T18703F1068C6ECACA2D876F4C98CCFD574D1A6DC2D4B117A0E6170B8E0197B5FD253366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 32KB
SHA256 f4304d9be322f525473d0f5b7764d0a04d9f05bf07aeaea79098c02c848bf5e7
MD5 ce1db29a7f44559a898bb1829f4e5bfb
SHA1 950d3184969b6e3202e985ce039d40ba05d2d813
SHA512 6c92f4aa138505002422f5f83c3b3da7e634b52742c86bf1f228203d0dd93c54fedf94f9df36eb97c06fb6d9bb8fd577d6db3abf1a9edfa0099b664cff438638
SSDEEP 768:e+3cdOFqCT2ebIUId+pqMRFZpzb7uoIrgREVtVdekULMExf:eEWL40+pqM/Dzbet0rxf
TLSH
T144E2F1470E6EE53A00513CC96773B4F0EC89FA2EFA652E74928DF80183654125D67BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 27KB
SHA256 c1fad7a600176f251d4895f10d2a47631dc316f9e9e8508b2e6fbd9c07e4ad98
MD5 15e9433f737fedf2c52f7e1f74a51941
SHA1 6ee07a85f946df6f71d0906d170b13f6a245b2a6
SHA512 a40fdfea08ab2807f947c2cd2e6c031e3b7dfe98648d10e9c73b33b342a33c5f20569091fb7305cf2f1b92fe9d8e93992c5d3ae94cf2c9bba17b60f839f963c9
SSDEEP 768:WXbHRy7UvZBuTkVid/1Z7BwRgEr30EkYzeHFdE8KdJh:WTU7URBu4UJwRtS6eldE8+Jh
TLSH
T111C2F1D47A23063AB7079ACC5F69B244DC319B59EE2F455B40F212C540F1E986EE4B78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 26KB
SHA256 5864d3c7899afa147b5c77b50fd49a763dd7d3fc496f54eb20f8d8e1c8d2d55f
MD5 ae84389d5f8f9b7e49d8cfe620cc0fda
SHA1 30e8f635f0aa7d8ec0a889d9b3b83e20f68ba9ad
SHA512 8907a0674710341585e6558636812ab18cfe899f12f4cfeb2972c9923f03b555ce8ddb5cff8ae402749f86c81c3914c94b25219dafe89d194d1305f930115557
SSDEEP 768:m/nGVTAP7+266fcGhRdDVqJk7ZmawV2gE1vhyCkNeIQnK:qgTg+2p/7BquZmjh8MeI5
TLSH
T181C2E0D57CF3F3591BEEB1A500653E2224BD78E2B25CFC16A5E489F490BC226DA49680
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 18KB
SHA256 ad2895e897b6c16771512ffa71833897b7f5f1d877ac4f5c966adf8772b5e0e3
MD5 a866eef7e8dd5754dffb17c0e25aabc0
SHA1 0c23c814887291b5d273070c44018596f5102fc6
SHA512 992c98ead81ff20c891e43d43215e93fb3d2b09761acc13baf999f416821525638b078f6cf4313d460d74ddcb4bb027d0a5ea49a70af8d09a104241887a04bd8
SSDEEP 384:DJbVz/pDYG8Qg7qGPD7unGtNjRM8oLLdG6INvSHN/czQNyf/h1n7loOA1:DJbV7gH7uG3lToLLEHNvSHR8syHTV4
TLSH
T16482E0848A6575417A5DF2CEC3469797E20C53BF2C7B8B65F9B1C00D5920CC842AB79F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 30KB
SHA256 340e89f457d96357e5ce95d9f63f4432149ffe51ab7f72c4c671403806f0381c
MD5 421382895ce63b5c9ab695bc6a1b975b
SHA1 83159ce5df6cdf083dc6269a54d0ce10494eb1ac
SHA512 1f6f88fd415e1dbbb451fdb4cb23359fd549d259c9a876b9238d0f38c29440b2f80621f6ec4f014e2410b6c4e50943e524384111a008e6f1e1477c5fef589bc9
SSDEEP 384:myMG9v1lWvb3Z5UHuLwPXkkm+D3RVHPFP+srgpP0GeZzfU9wE8dc7TxxKAzqOePR:myMG9viF+HuL4LRVvdlUiEjhxNkR
TLSH
T1AAE2F13E0F5815148EE9DD4B4B1E6FB6C093179CCBB8A78D83185E21892458DDB3A7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 78KB
SHA256 42596f0cec67966f5b2bafadad281ca64a82a75bbb059362e04679ec649e52a0
MD5 ef76b1578bddc0c083b3924c85bef43d
SHA1 ce4c79bbd1e541a8c9f836d23abd92d8d2770d21
SHA512 3f7306055f12e82c21e5dfacb435cf070c9579fd08369cdd723a65923317c232fb907e6f0583fb58cecce1d92c9641afacfea0c4b090a9c6816891fd50ca0816
SSDEEP 1536:BK3oBgmOFBMUJZrCQkmDhRRisXLzwgdETZLKfRejcQBI4A330:gZ5tnRiPgdDcjcQKr330
TLSH
T18A73129B93C29F1B02DC4BCCC0D49890B6B0DAF1F63F8921A637AD67521A062DDA547D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 56KB
SHA256 ff4e1d8d86a21db7f8c65e22dfc6909dd5d766250b679177ce2e7fbfdeeb98c8
MD5 0bd886f533fa0edb2966569812229c3f
SHA1 6a208564893a295878ad87e7547f11a9327c12c7
SHA512 aa6ebfd0e101b3d473cf43cf59c0f30c77cf7a4b2c0333ac1fff01c1d57048704a08fbfedc5f2ab185c107105865216a2d9a860d6ad7707910322d45a4576907
SSDEEP 1536:a1JIZxwHgPD5xrIxuUJzy9/2vR1Q6T1Sm3++jbN6:awZK+DmZJztvUSXl6
TLSH
T1BB430264B4FCE60821FF451D3BCD0A87E2297C54DC47E84CD6A486A81A633EA6E439D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 87KB
SHA256 067aeee8080d01a70c23bb894c9833f14864638f7e4e8598c2a2bfb80cda2fe2
MD5 1e506739e92f9da66fafbd094458aff0
SHA1 2734ee8f985ec0bed8e12e8deb272c4ee677cfdf
SHA512 ebcfb5e5064c06a6bd016fe91209ec2ef52eda88bbf14660157588e556796414a7e083c7a04da0911279f057f2a9517ec2b6a373ec75d0bd6a657a8bf1628e07
SSDEEP 1536:KiBVJsE3Xx2NZhFFiuciDWXBO66jFuWeQV7oX9HLHHXxSjjGgIPRT2A:KiR8DF1c3sE5O0tH7HX43GBRT2A
TLSH
T15F931283E89D503534D559129FFE76E2A91F2E283AE3995EC1846143E613CBDA330A7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
Size 132KB
SHA256 b19781e6cd8eeac522126406625e72ab5057405359a7db073376db142d442dc6
MD5 693cc90c331d394efde4a1667bd1d597
SHA1 d94125b8c653a200c41ee3cb7a6df47ff49f9ce9
SHA512 87e000b5a3d9c21cf3217736e1411e9abeacdc0b3d9404bbdb89bd9ce435a094e81c4b124947a2b4f9178dbd32d6696145b5fbb445252ac25e2614a9feeaa62f
SSDEEP 3072:+bc6K6QxiZn9lPHoo0G6/jFxWcGTBPayDB39MfAgeVU926esqwxJ/u:yXfQwLlfR6H2SyDTMfDey92mqOG
TLSH
T134D31208129C3EEB6E858A8F6F77F65D33931A8A24B009DA1B23A6DE354CD0151F1F0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 16KB
SHA256 9cf9aab5d8ecc44e0cdcec3236220895c4b9295ccbe0cf5592c9e3faa5f45893
MD5 d5a29449942315947bd89b76a40e0d15
SHA1 af23f796e2146be1f0f9a13fe47a4a219249ed1d
SHA512 5f30b8e1cbb07e7e0b0f62f59b3d51444767583403897a781248fd55bf70094a0743511cb0f53b49c0ed5b9495e91c2fb80affd9a55746a7bf20cb52b377768b
SSDEEP 384:w6Xr9GJZURN/InJ5WjnB3cRlO84e2Xrd1vrvGIW7DqBrw:3RanJ4jnB8J4vXrTvrMwc
TLSH
T14472D11F386B30BA53ABE8CEB6DE9C04EE842618541E39C74439F9219520DAE4494FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 71c16dd99ffb91814b6227188f060e426fb3c42d7a13979cf18eda52e9bba1c1
MD5 dfa0567bb1fbddd1f38f3a2861ca02d1
SHA1 10bf817d8514a648201806843f59f0590cfd3b4d
SHA512 9a5e6040c52d82ef834771cd5378d6a187358466f7566f59539ffc15e329e4c4ce9a902c7cf3c0f70af0a43d5f2ff8e04b319b784d1aa6bd4dc9012a6432447f
TLSH
T11A71F859A101650CDBB5893B64DEC6A93EF24A940A0B9EFDC43104F714CBFAE5D8F720
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 ccf93b2c7c4c83028b563315699450e9022f991f9b813ccacc871c01c82482e4
MD5 5c61a3edf5e7c490c43d56108dbd1908
SHA1 648c0f2dbd623b35170a1acd686b8f62038c9811
SHA512 518b22b7b0c148ee70c7d872aab64a80d8efc8adac54a087c9218a72b4873a6cf4c7cfa04d5e0e904db1c19443d8f6c11ee55623ae66bd51cb740e9c38c12b84
SSDEEP 192:DwfUFUYJmHGJim+LGaIgZ7viVxcXlPpaPBxvhfPYNPTNmE/mamkmpHmimDm8m64H:DwfUFUYJmHGJim+LGaIgZ7viVxcXlPp0
TLSH
T178129CF7C3E9852D891256F4AB15AF1FCE2D0A24431C3C6688D4BE4B93F28B1E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 e87088fb92406079aa5c32fad8af84d823e278ef629ae289715540c5fd02970f
MD5 7a1444e78d5774c5cfedb2f739c95046
SHA1 916a39577c9c7df7e3639f5225ba6068b1606b34
SHA512 e4005121886ef8c5ef9ed15b27b00a7ad28d859657d53137b99ad53869833ec6f837f7f77e6301d1e923f2122dc5ee77faed0abdb9eb1afacf0a7b6505c6625d
SSDEEP 192:DwfUFUYJmHGJim+vaIgZ7viVxcXlPpaPBxvhfPYNPTNmE/mamkmpHmimDmfmImm0:DwfUFUYJmHGJim+vaIgZ7viVxcXlPpas
TLSH
T17602ACF7C3E8852D891156F4AB15AF1FCE2D0A24431C3C6688D8BE4B93F29B1E25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b1ac9fe8ad9c22d22fbb7a5b4c847044a3506846d063e712bb97c89414dd7ab4
MD5 e756ece588b5c2af9904166511886256
SHA1 39609db5ddaa5b41cdcbdcf68f98f19cf7b709cf
SHA512 067990d994769d80ad6e716a14d133109b0c2c7961c8eabcef250532f3d5759878766c2d5d3472bb106d23b821cbc192ae1b448dfe4f999a0f7ae4bd65daf051
SSDEEP 192:FROcBzaqtTkqGGN5v72ympAPRp2Umm4395Hsb+WNn0i4bp2C52vY738QEkwQag+W:FROmzaWwINZQUXU7wda2O2vY7Wwag28
TLSH
T13352D66FA964253B9DCBC21AF9267723E7F5102665942D84EAFC8B2C18E75CC331B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0f4bf3b424042d6dcacf0afd7d986c323915bed876ec5be445ed47c5e97d5761
MD5 5693c8f14b9345f7e0511d51585d8155
SHA1 d33fc35cadc00f5709e8ae4bbdfecc650843e10c
SHA512 a118f105c58ef294263eba6abafc88724c2d5a976e82970a77d512e09aecebf8d686b9bb01f58023c3281e8deb92adbcb330614423c50a8821fa753d112deed2
SSDEEP 192:FROcBzaqtTkqGGNyv72ympAPRp2Mm4395Hsb+WNn0i4bp2C52vY738QEkwQag+Vi:FROmzaWwINeQUXf7wda2O2vY7Wwag2e
TLSH
T16C52E86FAA24253B9DCBC719F9267723E7F5102665942D84EAFC8B2C04E75CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 263d4b0782336df172011f514529b29aafb3a00390d7bcd74289ffea1b97d95b
MD5 8cc8eb31aeff65d9474bc1cee4ea2ce0
SHA1 f5401977601f6fae5590d0e666e3fa37428e9c93
SHA512 59ee485bd5d3ffcfcf53674d546d3fe27c9a03178ba716a97e94d9f8797ad67a90a469fb0f05dc56d4baf49046abf262b1ca5fede79d403e0a1b0a40b0ee85db
SSDEEP 192:FRWTcBzaqtTkqGGNHv72ympAPRp2UFpmA395Hsb+WNn0ivft+bp2y52vY738QEkA:FRSmzaWwINPQUXN7wddQ2+2vY7WwaU5e
TLSH
T14052E76FA960253B9DCBC21AF9267727E7F5102665842E84EAFC8B2C14E75CC331B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8f12c9d7fb8229a2296346588cdca694a099741135549b4cdc1be4934f5a2381
MD5 e5a624dd26012e4a06955e2002ebba00
SHA1 bd4e375d41b2fb38ebcc03e8b128aae1bc847812
SHA512 fe532c7f18a06defe7632f8b214e338b1ed2c49017bdb10f28bb9e4c998d7801e8897d8665fa6fa36fb9fd466f2336ecc302fa978425e5546f53e4d532bbc630
SSDEEP 192:FRYcBzaqtTkqGGNHv72ympAPRp2UFpmP395Hsb+WNn0ivj5+bp2y52vY738QEkwK:FRYmzaWwINPQUXM7wdFQ2+2vY7WwaU2e
TLSH
T1E552E86FA960253B9DCBC21AF9267727E7F5102665942E84EAFC8B2C14E75CC331B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 31ced412e9c56e1a838da6343a2b63cdcce579e60fc131b24578d95c230c42c3
MD5 ae1ea2ec0d08f9886f4d2cf5ff58d72d
SHA1 09359020f3a1e2e62aa0be0bb0d06077886a5420
SHA512 65e6f6716c883c4cc14ccf80c2ffd9b993a705bf0375e8827410843d866a5e7bdd073e37131452664cc8c7bdde9b73428b754b775ed7bcdd88bd4fadba1bd95b
SSDEEP 192:FRWTcBzaqtTkqGGNEv72ympBPRpGUFpmA395Hsb+WNn0ivQOebp2152vY738QEkq:FRSmzaWwINgQfX97wd1w2/2vY7WwaA5e
TLSH
T1D262D76FA920257B9DCBC619F926B727E3F5102665906E84EAFC8B2C14E75CC331B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 54788b95af51527dfeb58ec61110e07a37c500b01c63165ddb1d8dc63f42ffbf
MD5 8cf2b26da79be958b62a8524f0abf633
SHA1 d0901de4df13d9b2476f8c212d90239d2fbc62a5
SHA512 d69fc0268df77e5a396f26c40cf5a8810ffb0ce0d71e418c021f44f3e6aae75422b97add0c0417b25655b556648c305549581f872e1b8597656e09e2b0c9e355
TLSH
T195B01201C4025141C08202F011431488BA149F12A60B2B0147F0BD23C8755A58425050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe620615.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe620615.TMP
Size 96B
SHA256 b1c0fd5b92ee9aa3add07340122f47ec77beb381357f30a700000628291ec906
MD5 a03cfeff95178c37b29827331ebf540e
SHA1 13d672afabd93afe4cdfc78321ef03cdc9e43754
SHA512 945c6d18ce211dd8d0fc8355439a69c0eed6ce464c2fb8f78a3a8ae47f0f0a3c842e367988531dc99c8a5851a5780c8e2b78b811cdfb5f638436aa1bc60c5ef7
TLSH
T107B00255C107A216C052C3F266A9D5D8B170DF26DA431A73A2F11B77DC35A768935160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 1482329e78972164a0bd2de122c0942a12837c766d4724b20043d24ad41f6939
MD5 1c4a2238adbada8d1db902415cbae6c5
SHA1 de93d88d3bf2d3c354c75b85930258a2a78746e0
SHA512 59ecd5c4c01f0625e2ad05c744f3d97529ecfed3953cf3c8c5d9ee910a4d57ada492a2e4410542386a9d80a08d353ac9e151e3d2d97e4c62163186908c71df12
TLSH
T119B00254194D2A27CA5A537032F25488F3F15C16B7B796A745F10074D457E8A9713E40
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 ebe4567bea3bdc1b67b9d3703eefe279c4e55f29c0d56a99a41f0c15c9333558
MD5 68f86e13c529ad8c18537596e9675e76
SHA1 6bba2600726d5579c54f0cd8466944b7bb694b00
SHA512 bd090d6056d4b8da702e02be6a2e60e71052b8bfaf3f7f0902890f9e9a4c4bf1f5a3ef706d671b203d970533f5f2906939ee48cd8db4d3e75b1dff038e3ef9db
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP24xAfVumGdmQ:1nbZeMrv/hG5xA2mQ
TLSH
T13CD3874B3A743102EDE59EB22CE0517B4E3CB17D8F55A5D4287620588EF2963A23D0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 682281680550e3d28eb9681d5e38eb3ab6c4463ae54aa0ac2e51c76916117f5b
MD5 4ccc411fb4a121cbabf7b4f05e77008f
SHA1 d72758aff05cb534929551a0e1b9d54fcc9eb509
SHA512 5d6f59e77140220aa6b3f0f23be72f9631f0a0d8dd190f6efd539125ae4fd08b9e5aab2f76ba7a552f0af9f42adbef110bf29b051afea83408f56e3111f5ac47
SSDEEP 6144:yBkyBtza5n1+IuA+9wCUedCMqZ/ZLW3Ex3:4BtdRAoeYCMqZ/piQ3
TLSH
T1FB342337AF681F331AD29F64685B4B97DCF172A9D434A254A76C374BA0C3491BC4AC8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 248b8b516808eb25b458e6fb6677f808f73641170d9c51a46af043acc8fccb56
MD5 29d4bbca84e4d97dac8dcc864d3f027c
SHA1 3756d0988a57d5915322b84b601fc5e3f0cb1e76
SHA512 26fe87f0e28fe27bc21f05784e671ff584a0fbd23aab94627cda414841fb914a35e76a6574691f45b3f89e72e31549165aadd65e3b41059c3b2c76771edbdce6
SSDEEP 6144:qHkyBtza5n1+IuA+9wCUedCMqZ/ZLW3Ex3:qrBtdRAoeYCMqZ/piQ3
TLSH
T195342333EF681F332AC29B70786B4F97D9B161A4D434A254976D375B90C3891BC8AC8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5a627bc146e138934797b3d3800e86e3ebeb918e9d5624ce85c54515ca96308c
MD5 e917e16afa1bb753e587c67fc9288f75
SHA1 ec6a36502ec22219e8a2ed1669698c715a9a75f5
SHA512 fa7935c4bbe13a6cd9ba6503faa96e2496980bc3cd08b78c8983340a7c6210e8e12a527bb4523282c98ee9c6a27b3b831e7327832755af15fcdc0fdef7231320
SSDEEP 1536:eOxCyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbu:hQqfd7NtZL8cHQRZEQ6SpsJ
TLSH
T1C5C30237ABC61E339ED2CB70B9230ED757B504A9D034D305EAAD27FB6883895694249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 f1e27f5423fe52b0f347183625d71c491b31df3d3a91b3c30e5b2a6d50236331
MD5 552938111957d5786cbef562ac06b533
SHA1 07b53107f38803cd0159cf3a16e4a0b038a145ff
SHA512 2d686232fc59566124bc8ed1d48abea710c910bcb3cd2a5410ee71c890e84bda2ad7aaf439c675edf0c07547f2c998b60a8d6fd579f578acefd172c993175eaf
SSDEEP 6144:9HkyBtza5n1+IuA+9wCUedCMqZ/ZLW3Ex3:9rBtdRAoeYCMqZ/piQ3
TLSH
T160342333EF681F332AC29B70786B4F97D9B161A4D434A254976D375B90C3891BC8AC8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 af8088abbaa246276304e7bbf2ace9485f5c00469c1d3082179b5667c49399a5
MD5 f6e3fa4d51168c48ec97cbbd55aff8ab
SHA1 9683b3d037ff28c54b8605939eefe341e0231f20
SHA512 e4227ae180fae19e9aff0ac856c5ebbc7a2adf01a3d7fda86b40aa5e0d28e68844799795e32dc671fe766b85570f35230d7268a5d7c92568c6e556f1f63fc670
SSDEEP 6144:yBkyBtza5n1+IuA+9wCUedCMqZ/ZLW3Ex3:4BtdRAoeYCMqZ/piQ3
TLSH
T1A3342333AF681E335AD29F64685B4B97DCF162A9D434A254A76C374BA0C3491BC4AC8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2ba4b0e84b1c33adb5536313f52cb365b97c89599fd294d0029844410fc59b02
MD5 d40cdbc3b9621100268f88ea4fd65e3c
SHA1 7590a76180ccc6acd1536517afd542594dc95b6d
SHA512 9129f6210f702fbd02311fe0ee3d21037a3ea5db0119a3f8b224792b9ca57356d2e3f108d7dfa872d3d1b853abbb0ba4f22e3ec76bad81083abaf281e355e629
SSDEEP 1536:T9QyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:0qfd7NtZL8cHQRZEQ6Spsk
TLSH
T1D9C302379BC21F339D96CB60B9530FD697B644A59034D301EA6D77FF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Config.inc

Path C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\Config.inc
Size 3KB
SHA256 1974f80d40d99ca4b771013a15bb9755efec8c843e513ac6fa33dba618f51e24
MD5 e37d44051c3fcf6508e5b1e10f2d0619
SHA1 f2b6c305c9538a361a0a3305498018444d0241dd
SHA512 97395d8a2a9f62833061206f10f06cd98db9a6eb2c563b579c29aa6301184b0c7d258c5e52abf76fbf3ca7504a7380cc6e5da8e3ed60d733449cf0c7471eefef
TLSH
T1796170B88DD19C0EA6824F5E72A8A7076F9477CD529D8C11FB3DA77022314A02EB04DF
MD5 SHA1 SHA512 TLSH

Submit Download

Pony.exe

Path C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\Pony.exe
Size 88KB
SHA256 4350b6bbfe77bcfaf7cad640ecb7fadcf57e2f166cbb4b4d8272e0b8ab131aba
MD5 831e59f248202b66fc88dd202ee2cf20
SHA1 d1069b4b89983d20a8f52d77b7762e2f03012e73
SHA512 3f6962cff1b91752eee053cf13c898d0068d5fe14b841430e407b2de3373178b53fe1b525ceeaabf5dcbe4caa5cdd8085cdcc16838b13c589754ff743dfa165b
SSDEEP 1536:9O3s5PB3qT4ubJ0Ys1fiFdliW2Ml7WlFyaGaBZSPl5Ld9xO55mTvcEOCkzmGyW:scPBUD72tBGaKdOTLEOaO
TLSH
T1E4930803F481F0F1C1A22BB17BC11764E7F99E797C3A8D5AEF4C49856DA268B7B16012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pony.exe

Path C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\Pony.exe
Size 88KB
SHA256 3d987576af7e3e47a81d77b8c0b06f6dd2780eadd3c35eee541e916f94504238
MD5 8d0553218ce9326fea6f1da75365b623
SHA1 c5b8672d1f2869415248256963b4fec7b8d36b47
SHA512 6e9cbc109f4cf63942d19a16a82454483c4296601e71f74e234757feed361f1b685d5c27f1ea74d9f72068eafe3bc9dbe79c6661a4560b0d172d93a1b54e8407
SSDEEP 1536:9O3s5PB3qT4ubJ0Ys1fiFdliW2Ml7WlFyaGaBZSPl5Ld9xO55mTvcEOCkzmGyW:scPBUD72tBGaKdOTLEOaO
TLSH
T16C930803F481F0F1C1A22BB17BC11764E7F99E797C3A8D5AEF4C49856DA268B7B16012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pony.exe

Path C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\Pony.exe
Size 88KB
SHA256 4f70fc9b475c0e37b39ffde593072a4df37bc83b4eea615752ea5a70b11fa195
MD5 5cce7c78c4890378d1da4c56a0d45791
SHA1 c0d081ae040fbc919edb281d1b81dd3a2592a243
SHA512 7446a0f47552b8771f54414f869260c1955073432c3f2fc7144bc4f4a19c81f1e47d8a17eece5af5a0d118cf4ad7ac1f8f0fe6d49e07bb05919e7eb4c605c19a
SSDEEP 1536:xO3s5PB3qT4ubJ0Ys1fiFdliW2Ml7WlFyaGaBZSPl5Ld9xO55mTvcEOCkzmGyW:QcPBUD72tBGaKdOTLEOaO
TLSH
T16B930803F481F0F1C1A22BB17BC11764E7F99E797C3A8D5AEF4C49856DA268B7B16012
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pony.ini

Path C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\Pony.ini
Size 2KB
SHA256 d57ce3855aa7b57bb18081f796db02782504ffc70a987efd4e8c576a1f4c6245
MD5 925bb9ff81ff13e10951bdf16b78f3a5
SHA1 86a6761322aa4569e0715cba7c1ab6f5d4b5d99a
SHA512 651fc2c3dfcf1c964271fd751ffacdac20274473f85517b19bd83bd44bf31a6a2ebd27cf5e424bc818427ef332a2816bb191de1874e6dd926114695be54c0b23
TLSH
T17A5152FF0E0A4A0D2B954DCD40DF7AC33AE9ABC5116D5A219AFE0078CEC98E42CF1159
MD5 SHA1 SHA512 TLSH

Submit Download

Pony.ini

Path C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\Pony.ini
Size 2KB
SHA256 a6e0d5aaba3793c3716d6aef5852ca2eac74c54abb16fb0785f2254bffdddd2c
MD5 37d1d6842316382d9d5d50815aea4090
SHA1 0a90de9d4908e479144eb910a7c54f71a4548111
SHA512 0c9cd89d7fb4ca6fa0488fcdcf2d68e13098a1908785fdaa11eedbed947ba221022cb1656f37eb079c82668df6fafb15d64b088fb439b14d4d75774aba7a1a23
TLSH
T1AE5155FF0E0A4A0D2B954DCD40DF7AC339E9A7C5115D562199FE0074CEC98E42CF1159
MD5 SHA1 SHA512 TLSH

Submit Download

Pony.obj

Path C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\PonySrc\Pony.obj
Size 130KB
SHA256 80bb1470038e275e508102911e6a8905cb30bd14154864cfd6e239813ba0505b
MD5 11440ce4fc6780f4c34afd4e34110231
SHA1 8593e2cac5eeec6fed1c77292155276f93981855
SHA512 952e929af735f5d7f581df1188a138dd58f73da86797557b8ef0d088c08718bbb44b949a92151fdcb6cbbbf9ce2a3ea63e34212b65658660728b74848a634fc7
SSDEEP 1536:PlZNg2qTJix2iZpYs90fuBpAhQve1kDq3ZwJOto4272xVSvH/l+vMGUkzmNK4mpd:Nc27N90f5hQve1kLOA+o3lk4lmFH35L/
TLSH
T14BD3A303B4E0A8F6C861277CA6C58302F6BCED5977370B46AF7CC56629A33D7A782151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pony.obj

Path C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\PonySrc\Pony.obj
Size 130KB
SHA256 2396e43837de8786033efa16003411930a049ff7b0e34318f27fcce4936aa60f
MD5 c714394f8f4323cd31447f92b3a1da43
SHA1 df8b91b23818c4ca18c03b4f54bbf5c337dd0792
SHA512 cf25608541eef8de6ed0582fc2a41162a2a9b4c0c856e7c95083a1cd0a5217f025982d0b0b8ca6e9167a4b6b23e216f13ef22f18da95ca744c3149b6b570e0e0
SSDEEP 1536:vlZNg2qTJix2iZpYs90fuBpAhQve1kDq3ZwJOto4272xVSvH/l+vMGUkzmNK4mpd:tc27N90f5hQve1kLOA+o3lk4lmFH35L/
TLSH
T1A9D3A303B4E0A8F6C861277CA6C58302F6BCED5977370B46AF7CC56629A33D7A782151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pony.obj

Path C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\PonySrc\Pony.obj
Size 130KB
SHA256 1e3ed6789014cab79081ae9aaed8afce8a56b2c78018c8188a4683f6f422a28f
MD5 d4d02b082c37e88e91c4e2a8a383c89e
SHA1 2cd9adbfc0c73f82819f6b21a0a790a846b0ce09
SHA512 d9cd16d26b860c9f7de3feaf51ee867e08bdd0bf0e8540a01fef6cb7f76615e7c7b4080fd8ed031d299c3814cbc7708d91641bcf26666a22c9f808a4ee5047c8
SSDEEP 1536:BlZNg2qTJix2iZpYs90fuBpAhQve1kDq3ZwJOto4272xVSvH/l+vMGUkzmNK4mpd:Tc27N90f5hQve1kLOA+o3lk4lmFH35L/
TLSH
T131D3A303B4E0A8F6C861277CA6C58302F6BCED5977370B46AF7CC56629A33D7A782151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ml_err.txt

Path C:\Users\Admin\AppData\Local\Temp\Pony 1.9\pony\PonySrc\ml_err.txt
Size 23B
SHA256 8143ed9b940a6f302ac5d81fd8319dc8675d3159562e37970742fbd048228a28
MD5 37e1817639bcde7e6e77b9a0f3fdd1eb
SHA1 3a52df11c731fd77c66c0bb21327b7fe97a0cf5c
SHA512 5e67da9a484d3ecba8ce9b27dc3a4ab8e9219d214e8e9a5b6c26f4f9ebfe385fe58aecfae7565c1575594e4278432b9d834b44eca8c36f21b1875223df9e9726
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_knuxj40n.15j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_knuxj40n.15j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/736-305-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-10-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-144-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-142-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-459-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-284-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-147-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-454-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-324-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-146-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-283-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-281-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-1-0x0000000000827000-0x0000000000828000-memory.dmp

Download

memory/736-3-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-323-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-2-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/736-0-0x0000000000400000-0x0000000000828000-memory.dmp

Download

memory/4856-302-0x0000019F9BA60000-0x0000019F9BAD6000-memory.dmp

Download

memory/4856-299-0x0000019F9B5D0000-0x0000019F9B5F2000-memory.dmp

Download

memory/4856-301-0x0000019F9B990000-0x0000019F9B9D4000-memory.dmp

Download