dracula_stealer | 98dc3fb909b1513991cea1c885fc663be2e3b8d4d4728d9e8e6d4d01e636ab7d

Analysis

user interaction
yes
max time kernel
900s
max time network
901s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/07/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2tprzbtqfvaqh67y.exe
Size 529KB
Sample260731-pnrh2sshqf
SHA256 98dc3fb909b1513991cea1c885fc663be2e3b8d4d4728d9e8e6d4d01e636ab7d
MD5 c9369fb900052a5ecda6696da9b66abf
SHA1 2723f7d161a3db2ebfa805079f3a38ffae5ab298
SHA512 edd164425caf67d0b91a00d25900a5bacc6bb0791cd5306629389aab9b2738c2401bb2c2cfdf97ae19216a18f6912a4635f4d5614f2e161c9a0fde80420e9645
SSDEEP 12288:9x7jGgzXEoniX9/6VGW5MqmfvAEwIuJ5Z8:r7jGgTE9t/6V9cAEwZ
TLSH
T192B44D187FA98E08D990167E455F1A09CB9ED2F11132B303330AEFA15D459DEDE2D3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution dracula_stealer persistence privilege_escalation spyware stealer

Malware Config

Signatures

Family: Dracula, Samurai
Dracula aka Samurai is a stealer written in C#.
stealer dracula_stealer

Detects Dracula aka Samurai Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/5080-5-0x000000001D7F0000-0x000000001D81A000-memory.dmp	family_dracula_stealer

Executes dropped EXE 1 IoCs

pid	Process
1756	tmp4290.tmp.exe

Loads dropped DLL 3 IoCs

pid	Process
1756	tmp4290.tmp.exe
1756	tmp4290.tmp.exe
1756	tmp4290.tmp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2tprzbtqfvaqh67y.exe
Key opened	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2tprzbtqfvaqh67y.exe
Key opened	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2tprzbtqfvaqh67y.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
1	icanhazip.com
1	ipinfo.io
1	checkip.amazonaws.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2560	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4808	cmd.exe
4120	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4290.tmp.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4808	cmd.exe
4564	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1732	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	2tprzbtqfvaqh67y.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2tprzbtqfvaqh67y.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299745773384485"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
4320	chrome.exe
4320	chrome.exe
2560	powershell.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
2560	powershell.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe
5080	2tprzbtqfvaqh67y.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	2tprzbtqfvaqh67y.exe
Token: SeIncBasePriorityPrivilege	5080	2tprzbtqfvaqh67y.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1756	tmp4290.tmp.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4808	5080	2tprzbtqfvaqh67y.exe	81
PID 4808 wrote to memory of 4440	4808	cmd.exe	83
PID 4808 wrote to memory of 4564	4808	cmd.exe	84
PID 4808 wrote to memory of 3948	4808	cmd.exe	85
PID 836 wrote to memory of 2296	836	chrome.exe	87
PID 836 wrote to memory of 792	836	chrome.exe	88
PID 836 wrote to memory of 792	836	chrome.exe	88
PID 836 wrote to memory of 1732	836	chrome.exe	89
PID 836 wrote to memory of 2924	836	chrome.exe	91
PID 836 wrote to memory of 2924	836	chrome.exe	91
PID 836 wrote to memory of 676	836	chrome.exe	92
PID 836 wrote to memory of 1508	836	chrome.exe	93
PID 836 wrote to memory of 676	836	chrome.exe	92
PID 836 wrote to memory of 1508	836	chrome.exe	93
PID 836 wrote to memory of 4924	836	chrome.exe	94
PID 836 wrote to memory of 4924	836	chrome.exe	94
PID 836 wrote to memory of 1276	836	chrome.exe	95
PID 836 wrote to memory of 1276	836	chrome.exe	95
PID 836 wrote to memory of 3268	836	chrome.exe	96
PID 836 wrote to memory of 2856	836	chrome.exe	98
PID 836 wrote to memory of 4072	836	chrome.exe	99
PID 836 wrote to memory of 960	836	chrome.exe	100
PID 836 wrote to memory of 4320	836	chrome.exe	101
PID 5080 wrote to memory of 4120	5080	2tprzbtqfvaqh67y.exe	102
PID 4120 wrote to memory of 2560	4120	cmd.exe	104
PID 2560 wrote to memory of 1756	2560	powershell.exe	105
PID 836 wrote to memory of 1064	836	chrome.exe	106
PID 836 wrote to memory of 1064	836	chrome.exe	106

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2tprzbtqfvaqh67y.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2tprzbtqfvaqh67y.exe

C:\Users\Admin\AppData\Local\Temp\2tprzbtqfvaqh67y.exe
"C:\Users\Admin\AppData\Local\Temp\2tprzbtqfvaqh67y.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:5080
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /C chcp 65001 && netsh wlan show profiles | findstr All
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4440
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4564
- - C:\Windows\system32\findstr.exe
    findstr All
    3⤵
    PID:3948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp4290.tmp.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp4290.tmp.exe"'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\tmp4290.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp4290.tmp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf132c728,0x7ffbf132c734,0x7ffbf132c740
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,15421900180306492380,6222540809622630160,262144 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,8061807204233012687,12265240096473209697,524288 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2292 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,15729216234025875161,14760980741908903320,524288 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2424 /prefetch:13
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,15050219040330383207,5046853915984503490,2097152 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,11611587972380604258,9484977090841683160,2097152 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,16852991600234435287,13180707654920057960,2097152 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,12042662385734727419,1718635541562597211,2097152 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,1107316525643229059,13240552400451905677,524288 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,12508055756085168850,2737687446398503962,524288 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,9680703984152636078,8054160789185758888,524288 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:14
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,4050402271192559348,7199092972130086154,524288 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=876,i,17544244413283091297,16952947304108617844,262144 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,5697436837331955338,7028275020056765551,524288 --field-trial-handle=1976,i,17652028155046169280,1582155387883495201,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4332 /prefetch:14
  2⤵
  PID:1064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a01519a640bbee803b78122a3c9d2357766160b4844ce9a57b96bdb34de0de54
MD5 edae7410a470cc45d855619cfedb63c5
SHA1 672836827295942c93a3d2f786b8641096312388
SHA512 bbd324dbd4c67ec14d4da12706eaaf48a87e7fd9410802f20d53e12864871b91d044fed8bea02b1d5c4f6baef932a6cb567bd6233360077faae2080d0b689cb3
TLSH
T16CE02BE9C812EC3B08FA0B1C60505706F7A013B77A418A5F3B3C91198F75737428596C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a8758076b12d40be9a9e2b0818e5f9ef6b82ebf41304900c0462b72cf3c75fcc
MD5 09ef0a6fd44418d1bb5c0f43fb633489
SHA1 cec9972f966794c3df031bc7fd551add4eb4f384
SHA512 ee1017a024ba4e04bcd1f05f53ea3d754a46fde1290d39eb02b94ad399f47a08aa422fb386d78701411eee0589acab269d7c6756f7588ac969b8d3bacc441633
TLSH
T1FB618AB3C3E48A6D855152F4DA256E1FDD3D0A24522D3C62C9D4AE1B53F28B2E21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 95c7ca80114a2a960fbde3ffb839fd9cc787ce864f10ea3720a686d91e573dfe
MD5 0e92a19f9538d4ce3cdc4b10c6e3990b
SHA1 eefc2ca00e5ca48b893d27694dc71affe68d4112
SHA512 94624245220ab3ae0e891b39adb21dadea95d72dca7ed87eff632eabaa8221052171e2dde79ef2084334fec7905ec91bb9ec27e646bef65d6ebb1580674851c4
TLSH
T162618CF793E48A6DC51192F4DA256E1FDD3D0A24521C3C6289D4AE5B53F24B3E20174E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f9799b78be2c8ae2c92cdbd614f3516baecc2ced11073af7693bb167a67bda56
MD5 6783ba76c8e75ea7e309bbab2fa89e3c
SHA1 30c228a872fe2df1c965c6601d5c972883a8d4b4
SHA512 1a34603068e6de0deed8aa4f9884753247eb3de34a5d8f295d74ac7ee554a90f9e204006b697ab1611f345c9484fd7a4eb0c2f57ba6f59defd276da1a82857cc
TLSH
T1D7519CF3D3E4866DC55192F4DB256E1FCE3D0A14431D3C6689E4AE5B53E2872E20139E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 854eff9187348b616852a6668c5f8eb8fad678b3993270898e6123fa2988ba57
MD5 49ccaba4bf7578f74906b12a5dcbf524
SHA1 9e0bb2cefe57aac0d1c99af3c27cd51ecfc8e5f2
SHA512 9dc49d5c0297069f543c89cebe9f27f75ebdd131853f03a38efdae2ff7565df297c5f760b1c9a294fe5e21daa490e878c7c4354ad96b474e26e855d01a30e5eb
TLSH
T130619BF793E49A7DC51196F4DA256E2FDD790A24132C7C6288D4AE1B43F2973E20138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 77ab59df00ada0050648e120fbdb640f28bb407fc6d8a5c91e2e9d4474700aa0
MD5 f51397797ca580cc8435afd0b95b9800
SHA1 bcd26414854feb7524106bc442eb91939992dead
SHA512 1c38ec093434f759bd98c8b0affad9ec5d48b4d35426baaac81240cc2d946f0267850d0d3db4bb02711668f91526cac4b228342f9ba90ccc796f4e60927cb2a8
TLSH
T1AB619CF793E48A7DC51196F4DA256E2FDD390A24022C3C6288D4AE1B43F2873E20078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 519B
SHA256 cf9f1862ecc319a2c79a9b1939f1509a326d22572da9fe43eaa3ecf176df25a3
MD5 f92abdc1b5c45878d5ead43d8b751caf
SHA1 dbfb3e01aa71fe6358b6134e33c249569e1d4959
SHA512 350be14f80c47114e18fbfe85f936dff8970883932133d972f0e652ab821d8d080e6a9ecfa0f1bdf557957343537e07871406379f795e8d91527e8247b37db8d
TLSH
T1C5F05057D76A7457007945EB0E047C0A15F16432014154F4CF9FC13DE1894AB0F02497
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 055831c503cfc58618c8f15e442875e9b1f5676e4c4782012d7bdb3b05ca32eb
MD5 f57583e9332da8538c8090495f13e9ca
SHA1 48fbf7adce88332e2412e9dab74963b9ad57b40f
SHA512 6c480c139e7174f7a4e47bd763af1605625c36e53759079021a3f60d1e77b8c7b5c0948aa2e686f151527652e06ed5ee30364c8a4dcbcfe41331f5a24bc26842
SSDEEP 384:PRqya7Cv2bVF7xy1CyolZUXKrwc0laEje:4ya7Cv2bVF7xy1Cyo7jrw9cj
TLSH
T1B242B52EA910683B5CDBC22AF9617B53EBF5102561C42E84E6FCCA1C15E7ACC332741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 71c21cc2ce583859fae87b16f7c37c0a62c2bbbac797089956827f3a304d3ef9
MD5 21b80d4715ef41b365c31a8d11550777
SHA1 09700746eb83830b9facb452e4e1a95c78710669
SHA512 bbb8d930d8af56105c4178aa8b8ac8c5bee18a16c444e35597fbb3f52f043f7474c6981ef4762fe2d8a5db9e0771e716f10eb6acf9c859c5844dcdbae516fb22
SSDEEP 192:PRqy8NbKICv2bVF7xy1Cyouv7dpAPRp2F99Hsb+WNn0z0sRerTawVyIsnAUgtaJ:PRqya7Cv2bVF7xy1CyoKZUXKrwc0Na08
TLSH
T19342B42EA910683B5CDBC22AF9617B53EBF5102561942E84E6FCCA1C15E7ACC332741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5487e22e9638c23203be0d16d9dc217a9dea4134ded213fa50f22784cccdcc3e
MD5 8b9d83512d1544456bbce5f99431d657
SHA1 a1c2ebde119d04c017528bbd14224707cf6352a3
SHA512 2ee8168c3768c641bb930bc1ad031476594c218feb5d3b1989c317bf49abce4d7f4b5649bb47df21c5a9112ea2f8bcecde6af1eb0f829cf5b6ff1eca687d1d1f
SSDEEP 384:PRqyV7Cv2bVF7xy1CyolZWX0rwc05aAje:4yV7Cv2bVF7xy1Cyo7frw9AX
TLSH
T10452C52EA910683B5CDBC22AF9657B53E7F5103561902E84E6FCCA1C15EBACD332741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6fb27eef9992005b24b3287512c74163da3d2e87106e670a5facb12209378fc6
MD5 04f6642ad31564513222c48805b21780
SHA1 cf4804ee62947121635b3e60197b226b58d9f7ad
SHA512 c4c1b78860c3f45faf2ae74250b067aef78c1b4b2c31e5f1c6a3afb77c7d3cebe952b0e3851ba4d6edaf67bb2597a980d261d076cf16ce69aec60386fb342928
TLSH
T17BB0121080025102C08206B011862C88B1546F21A60E170583F07D23C8355618024050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595bc2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595bc2.TMP
Size 96B
SHA256 d7056f0d594ff07314dc3ed24db5e0a0c85e3f38d261639d7227e93e30533168
MD5 472c01a955477af74393a6bfd7516099
SHA1 bc540c3c23413cd69432e6adefcd9aaa343752db
SHA512 d30f2931e581c74ce546900fc890e67abc16dcbe1881384db827f8f9b4702d576ef1deb68d6fed0d83cb59ac00396f465854b05ae7dec7f0826406a996e2e85e
TLSH
T1D9B02230C0023202C00203F020C280CC30A0FF30C3030222C3F00E33CC3023080322A2
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 9f068c6e2a7399893d2faf10ce3ed5acd02202e14eb43dc9baaf3b08df6e979a
MD5 364110d6bce9459d622b4d4c56c52a3d
SHA1 6134e4821a8f1cabd398d593105717c5ef0de352
SHA512 e29d385252e1bd3e6fda270aa14f3ed2c7a294fd640f651657e6ee0b8cb1016d7d27586575ef78768803659f676a632c14d958b5e2ef995d05803748db2e380e
SSDEEP 6144:H3tHfDL0L3IFrHNE37LHWuPQm7Rkm1tYpBeh2BAoj:HdHfPm+rY7ZPj9oBGcAoj
TLSH
T15F34131A6D70AC7AD968BB1AF049292F18F1DC93D11C9E758CD099046FEFBDD0609D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a76f42879fbbeccfa279ac6269c1c68cbbe98b2669ab313e46db9c56cd34ca63
MD5 6800d200c71d87611554bcecbf798f03
SHA1 5fbc7e323f71a1a44d5fc10a5a848325774b6cef
SHA512 83a60320f23eae382fe41609cbf42392b00fd7feb2024589b666e01b89b466f98e05e57d2d6971fd11a2327a4068e826411544dfc182d1f4ee470830a5af5652
SSDEEP 6144:Y3tHfDL0L3IFrHNE37LHWuPQm7Rkm1tYpBeh2BAoj:YdHfPm+rY7ZPj9oBGcAoj
TLSH
T1C634231A6D70AC7AD968BB1AF049292F18F1DC93D11C9E758CD099046FEFBDD0609D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 6daabc12b2e187e6ba7f02d3510b01c717aa1481e1d1e1084e437830f8305020
MD5 279d60ddcf4a5813ff64bc906df5d6b7
SHA1 dc5d8a7aea868ebba0f4879f8d8cc53fab0495dd
SHA512 07f1d80cae0f205ec93455420038f3a09a08d606c0bc7a9560c5ee8462987c16bc1651b23a0cb15b271eb019496b157a90e17499c4a579dc114d6ecfd2de34f3
SSDEEP 6144:6tHfDL0L3IFrHNE37LHWuPQm7Rkm1tYpBeh2BAoj:iHfPm+rY7ZPj9oBGcAoj
TLSH
T17934123A7D70EC7A9968B71AF1492A1F1CF1E893D01C9E658CD459046BEFBCC061AD28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 279KB
SHA256 f4402684706dac4166f187f199da03a1584eda4f39d691ee6350ffe81b6eafec
MD5 a25eecddb1f22495fd68fefc18e228d7
SHA1 01b377d9bf1e5d474633dd5e108010fcc3fbc604
SHA512 a4b38ba165333e30a7eaeca5fcf9a884eeeb9baa2283c41668b2a08dd005ab512c2a15b3de0dd1b04a172ba141be57586ea24574c0105aa315ad63e3a38ee396
SSDEEP 6144:uyHr8uptHfDL0L3IFrHNE37LHWuPQm7Rkm1tYpBeh2BAoj:uyHhHfPm+rY7ZPj9oBGcAoj
TLSH
T12954133A2D709C7E9E35AB1BB04A1A1E2CF1ED53800C9E7A5DA45A045BEFBCC0519D38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 45111cf3d0cae79c818653396d61cd4d2f4868cc0812314828d3f697b781554c
MD5 62917e98612edca2cf269a8fa5a6da76
SHA1 cda0e8ea3f52783b78b86159e6ca1afe6c3f52d3
SHA512 dc090fa72e9d30f36c9eecf735a469fa343e8694ffbed5a431536f1c59b8416b1e5b1129e51a679eec34cd4364f3fe6688f9144ce132a0dd9a88be83e8db9185
SSDEEP 3072:6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:dm7Rkm1tYpBeh2BAoi
TLSH
T164C312375E70E9365979AB0EB48E0B1F2EF14DA6C830DE82C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hqycer53.ssl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hqycer53.ssl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mmf2d3d9.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt4533.tmp\mmf2d3d9.dll
Size 1.1MB
SHA256 9eaa342059785bd584df956574c637e6d0e6016a099221a56e0397f8c86cd93f
MD5 22284d6bb382967ff72363f828050e13
SHA1 5c98e25d24aacafffded9353c9526be0128c6dbd
SHA512 2e5a5bf115b1d2a07d0647b6f4925ab84301ca6354e3f3beb8d44f51900ff21b06b97b23128160fd94dfd33116d03094ca47c49143ae98473eaaed441f9705b2
SSDEEP 24576:jzJoEGnUrkcp2K48nzXIA39fCRyN1MqEf:Bllp2WsiN1JO
TLSH
T1F435BF10F1928132C4A773310A67A37972BABF150AB585CB1B987D7A3F345E1973938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmfs2.dll

Path C:\Users\Admin\AppData\Local\Temp\mrt4533.tmp\mmfs2.dll
Size 459KB
SHA256 c0d56cefb509e5600ac6b430adcaf53b81881d3fff4e62b7ede158d66d826622
MD5 4cf7bb74d8104280b7e986f4df21109d
SHA1 edc21a43136afddbf4786593e84b934d40591b74
SHA512 2bbac48354657659795697e67508d777ee595348e1fb3d4b6c65d8618c346b3be0052b1e2e2fe669dcca19c3c00d59d1833acc21d88a97efbde2694935e3c292
SSDEEP 12288:1F4DiwTv/cRLT6BDhdI+2KPYpzGYxv1g5IQurTUckeEqvI:1F4DiwTv/I8ESAzhxvJrT1kr
TLSH
T191A4AE11F982D232E9BA12728ABCBE6A247D7A71473445E397844DBD2D701D31F327A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mp3flt.sft

Path C:\Users\Admin\AppData\Local\Temp\mrt4533.tmp\mp3flt.sft
Size 24KB
SHA256 cd5bd7cc59eaf42bc0edf418ce6f077f9db369d5e3c414107b82492a877a6176
MD5 7beafd3ec0c36a1422387c43c49f68ff
SHA1 240e7d8534ed25dffb902a969826f4300a88dde6
SHA512 44101803bd757bb7a84577aa1c087472a619da732dcdb3947b683cd7a7df30931e4c9973e06532859f9654c4ad3635db205e41fc7214a0f52537be91e87b2734
SSDEEP 96:24yW7bMnfxKgUEDGDaq5E9my5F3MM+YuU0UNESZpMS07oQCcw95bcPw5IqQ+5lyc:24y+MCQiaOC3j9dJlfMSkI5wPPzElt
TLSH
T18CB22C12B3E10CF5E15A5F311D9B023BAE75FB9917B862575F91C2391C33901A81B537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4290.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4290.tmp.exe
Size 8.3MB
SHA256 ddb4fba8c375020d3135d7cb842e7922065ff907e642caa26835a2791657de79
MD5 3eb21edf597be0cc6f3b3caa950876ad
SHA1 a6f426daeb8f9b55a398912d657ab862c692542d
SHA512 53b0fbe84b41a42328b0d25303f6a1272fbc99e9a54b83c92433a768396c029259ce66b18e2a632c3842294f15add779b71aa1fa4c6bb8b435fbfbbffec2028d
SSDEEP 196608:LIZuaF4DiwTv3ta/46yX+GtxPKloNAJ9BJhjQ6+GzFuvJGg/w6w:oF4DiwTvk/OtxP499+6PFuI8wd
TLSH
T103960113B9E1A021D8B50071C5FAAA2659AD7E3DDB35C7D392C01FAA3A331C35B752D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpE93C.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpE93C.tmp.dat
Size 138KB
SHA256 95c0efcb6d6491d878e06461146fb3ef4496fc5f1c2e9e32077b76f5cf6719f0
MD5 e098f70a46dcf92a164da5b561ffd829
SHA1 e0c2239c2f66cf3fe59eb750a215a026a78641c7
SHA512 7fc2dce6f4163f025adcfc802ae7720944954917578ce7499dff6a0e97a0c9ca1f050a2566a03e2ab1ffb8ffe876cd2411b7ac090ef7060294086ec0960ab6ba
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2O9tlqHVum2ne:FnbZeMrv/hGt9aKne
TLSH
T1A8D3A74B3A743402EDE59A761CE050BB5E3CB16D4F15A5D4287620688EF2863B23E4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpE93D.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmpE93D.tmp.dat
Size 224KB
SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
MD5 516351263bca6c138322eedfe8562bc4
SHA1 77dfdcb950444fec98ca242c05d380a112489aff
SHA512 31c1c26ba3b3f27daa67d049ae0fda61f9707b682004b642783424521232bc9e9f602200ff70559fc33c33151988f43e4c67048f4cbfb973b6d058a2a8567f21
SSDEEP 192:Vno3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:C3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10E24540A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1756-210-0x0000000075290000-0x0000000075308000-memory.dmp

Download

memory/1756-203-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-197-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-195-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-214-0x0000000075290000-0x0000000075308000-memory.dmp

Download

memory/1756-213-0x0000000075290000-0x0000000075308000-memory.dmp

Download

memory/1756-205-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-212-0x0000000075290000-0x0000000075308000-memory.dmp

Download

memory/1756-211-0x0000000075290000-0x0000000075308000-memory.dmp

Download

memory/1756-209-0x0000000075290000-0x0000000075308000-memory.dmp

Download

memory/1756-207-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-206-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-204-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-196-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-202-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-201-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-200-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-199-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/1756-198-0x00000000000F0000-0x00000000001F5000-memory.dmp

Download

memory/2560-174-0x000002435FD80000-0x000002435FDA2000-memory.dmp

Download

memory/5080-0-0x0000000000040000-0x00000000000CA000-memory.dmp

Download

memory/5080-172-0x0000000002450000-0x000000000245A000-memory.dmp

Download

memory/5080-170-0x0000000000910000-0x000000000091C000-memory.dmp

Download

memory/5080-39-0x000000001DF50000-0x000000001E01A000-memory.dmp

Download

memory/5080-6-0x000000001D8D0000-0x000000001D920000-memory.dmp

Download

memory/5080-5-0x000000001D7F0000-0x000000001D81A000-memory.dmp

Download

memory/5080-2-0x000000001C8B0000-0x000000001C8C0000-memory.dmp

Download

memory/5080-1-0x000000001C8B0000-0x000000001C8C0000-memory.dmp

Download