a7a3d76ec75ac3216cd43f0d9d30e7715ac8c2097543cc6efc8df0e44ead0366

Analysis

user interaction
yes
max time kernel
42s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer.bat
Size 1KB
Sample260802-2gvy4sshqg
SHA256 a7a3d76ec75ac3216cd43f0d9d30e7715ac8c2097543cc6efc8df0e44ead0366
MD5 634713d12ddc73ff38c5778c8a78a322
SHA1 d0cf291fb9131a7088822c0e960b417bc3aaee70
SHA512 1df3d4269dc7a04497c9cace165d2cfac3aaad9c822d54ab7aa9126127a261f52632d9d7b3d1c8c255a30c368e6bd426f64188a5586ac4e361414247fa6c866b
TLSH
T17041131BEE5A7170C4AA45E016ED1ABDEB0593C60227CA692E4330CD319B7CE821F3D5
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BackgroundService = "\"C:\\Users\\Admin\\AppData\\Roaming\\LocalServiceLocal\\DeltaBrowser.vbs\""	reg.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4372	WScript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4060	cmd.exe
1916	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
564	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301836580531278"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe
Token: SeShutdownPrivilege	2236	chrome.exe
Token: SeCreatePagefilePrivilege	2236	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe
2236	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1628	1916	cmd.exe	86
PID 4372 wrote to memory of 4060	4372	WScript.exe	89
PID 2236 wrote to memory of 4808	2236	chrome.exe	105
PID 2236 wrote to memory of 3656	2236	chrome.exe	106
PID 2236 wrote to memory of 564	2236	chrome.exe	107
PID 2236 wrote to memory of 3656	2236	chrome.exe	106
PID 2236 wrote to memory of 4476	2236	chrome.exe	108
PID 2236 wrote to memory of 4476	2236	chrome.exe	108
PID 2236 wrote to memory of 3192	2236	chrome.exe	109
PID 2236 wrote to memory of 3192	2236	chrome.exe	109
PID 2236 wrote to memory of 2380	2236	chrome.exe	110
PID 2236 wrote to memory of 2380	2236	chrome.exe	110
PID 2236 wrote to memory of 556	2236	chrome.exe	112
PID 2236 wrote to memory of 556	2236	chrome.exe	112
PID 2236 wrote to memory of 2212	2236	chrome.exe	114
PID 2236 wrote to memory of 2212	2236	chrome.exe	114
PID 2236 wrote to memory of 3820	2236	chrome.exe	115

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Installer.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "BackgroundService" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\LocalServiceLocal\DeltaBrowser.vbs\"" /f
  2⤵
  - Adds Run key to start application
  PID:1628

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\LocalServiceLocal\DeltaBrowser.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\LocalServiceLocal\keylogger.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa997cc728,0x7ffa997cc734,0x7ffa997cc740
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,4349077957296565619,11224970880822406858,262144 --field-trial-handle=2044,i,10804181989297147385,1647606824402299674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,10775789922970061025,13427108220416122346,524288 --field-trial-handle=2044,i,10804181989297147385,1647606824402299674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,7578623758825743776,6726976781966502569,524288 --field-trial-handle=2044,i,10804181989297147385,1647606824402299674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,15842016451283975769,8709158975299222186,2097152 --field-trial-handle=2044,i,10804181989297147385,1647606824402299674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,13090513792858793593,3999596268262233955,2097152 --field-trial-handle=2044,i,10804181989297147385,1647606824402299674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,1888954588092529277,7242568285989655539,2097152 --field-trial-handle=2044,i,10804181989297147385,1647606824402299674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=1700,i,330963905826224898,16366777595328300569,2097152 --field-trial-handle=2044,i,10804181989297147385,1647606824402299674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,3536482530083526660,359469393307509717,524288 --field-trial-handle=2044,i,10804181989297147385,1647606824402299674,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 882fa7c01e02738f23da33f5750843112eceef4a8c78666d6db759a48c97b778
MD5 e912c95c4f5d87df25f8d92d5080954a
SHA1 83a9a1f25dd7a075592987e2cf26d7275c88450c
SHA512 a98dc103233849d530bc6827dfc7f8d23215d2ed0418b56970117d5bfab30f7c91def084972f84bbfaa78d5c4045d057c69c366a805b41aff619e711fea049ac
TLSH
T137E06165C922FD371DFC171864654749E64123573681DD1F373D910C8FB573A4186C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 71cedb85d7520e5053cdb11a27ccc1b055c228afbdb209087b1eb9ed2e94616e
MD5 0ded70a38cc7a6a47be385b59574c096
SHA1 7f4c41f8b928d3f1adcdd90c1ded5c49b9d0dbb6
SHA512 d1d2a44ea6a49b79cfa7fb89b401148bfe2b96ea197eef58f79120177ecdd539b95390f9255b3d579a4fdbc99746a180357a05b484c81945ca628c0694f58b9a
SSDEEP 192:VRlPGlmv+Bn2b7v7MF+pAPRp2S9HHsb+WNnUb0zi2OkvkwJoVyIsnAUgtaJ:VRlPXxbDgoUX91wE0O2OkvW8
TLSH
T1CB42936EAE15697BACDBC229FD127B13D7F5102121951E84EAFC892C15E76CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6ec54b7186200a487ef9963fe4a1bd79cae3f939bf046db224114bb1f9946f6d
MD5 6198404a296504c8b0e53b180f23c3ef
SHA1 37803fa9363be8c61b444df3a972c354960490d5
SHA512 ac4859bc0e4ddf525641099f496a070865616601f673c876883c565a71fa0ca6e620d61b1e875289191e8dbe8c95e7732fd56cf526eed00b0f0601a1e7a6d202
SSDEEP 3072:/FGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Mm7Rkm1tYpBeh2BAoM
TLSH
T140C312275D75E9375879BB0EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 a57f01a2f9bae1587fbb483d020c6a54551497c45b73f3cd6d20a659307a0876
MD5 e6c05265d7b94211e3608495e6d2e989
SHA1 ee771230967c58f5a1b7bf9bc67d968d6c3f1138
SHA512 023dd6c15081c8f4c89cfade82aee5dae6c18d4c18326b855dc1c7d3e8edf4a30ddfe9ec5d7e43121d4ec0216ff43096e95820a69762c075211636c97dab74e7
SSDEEP 6144:ja8i0Aw9NDv+qw5ZtAam7Rkm1tYpBeh2BAoD:jaeNO5Zt69oBGcAoD
TLSH
T1113412375F22DC779AD87A2A640F4B0F1EF0AC2AD914DEE798C47B0853A9ADD140E534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DeltaBrowser.vbs

Path C:\Users\Admin\AppData\Roaming\LocalServiceLocal\DeltaBrowser.vbs
Size 175B
SHA256 cfe335fc1ba3bad667696ba62d6406980dabf6adc7aa7d8c7e2fcd36a4259640
MD5 59fd13019c3be31018dbe30d73a6e942
SHA1 7ac4a5c54492f2037cb425443115786e31585b36
SHA512 708cd98ca8d2f788c170881521d36cc9ff46b706dd9cfbfa29ec77f66d0b8181b9cbe248fb6a7ced2ec3b21c67889c352f31f5d5abc5dadc8e996e542638a54e
TLSH
T1EAC080149AEDC638D85DC0FF07F25148D364D947112679580740E44C03505581332223
MD5 SHA1 SHA512 TLSH

Submit Download

keylogger.bat

Path C:\Users\Admin\AppData\Roaming\LocalServiceLocal\keylogger.bat
Size 1KB
SHA256 81024c6fb55942ae06941a0e0ee432e638e8dd36a27b57600677ebd17021b3b2
MD5 5d0440ace878c7e9b0e053e898596f91
SHA1 96f5c7cbeb444f2442487a3ff5d84b3b96bbc770
SHA512 070208cda694226d7be6f62aaed5a5c90fc80fbb9a27741df27d6d1c42514fef75f471a4e678454c46265a31a932b11e3bb8ed80be30357f38ff7fde8b373689
TLSH
T1A9311F226CB1CD2ECA7206BBC9D5697CD2B9819742188544B04C4D880F382ABD1A65BE
MD5 SHA1 SHA512 TLSH

Submit Download