837beae95e5480b4b9f16e6f3bf89163dca00bb5d74b587a14925e7bd623e28c

Analysis

user interaction
yes
max time kernel
19s
max time network
55s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 18:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Exodus Setup.exe
Size 13.2MB
Sample260803-xb48daea29
SHA256 837beae95e5480b4b9f16e6f3bf89163dca00bb5d74b587a14925e7bd623e28c
MD5 b41e0e19346f6dad2dd07a133bdf0057
SHA1 4099b9c5a1704d237552abeddec0a67d63177e32
SHA512 ee46d74514777ff9d11d12d81f70180b57c4189cdb4c9e900d9e08f2d9108a9ce606f797405c5cc1c5a0d27f35b04199b1f3e3018036252496493c002b214aa9
SSDEEP 393216:fCrNYTx/hEVbdXQfM6R4RmhiHsnvDwHcBnl:KrSTxYYMc3ggEHu
TLSH
T152D633276FB58D98C158BD3A69F18727F3718E110F9645132F511E336AB39E8EF22284
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
7140	powershell.exe
3304	powershell.exe
3512	powershell.exe
1572	powershell.exe
5640	powershell.exe
5972	powershell.exe
2668	powershell.exe
4432	powershell.exe
6300	powershell.exe
2760	powershell.exe
1864	powershell.exe
5636	powershell.exe
1132	powershell.exe
3640	powershell.exe
6948	powershell.exe
5492	powershell.exe
2468	powershell.exe
2656	powershell.exe
5992	powershell.exe
3412	powershell.exe

Loads dropped DLL 24 IoCs

pid	Process
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe
1260	Exodus Setup.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3436	cmd.exe
6116	cmd.exe
4792	cmd.exe
992	cmd.exe
5708	cmd.exe
1504	cmd.exe
4684	cmd.exe
2220	cmd.exe
5552	cmd.exe
5456	cmd.exe
7104	cmd.exe
6208	cmd.exe
3800	cmd.exe
5688	cmd.exe
5276	cmd.exe
2488	cmd.exe
6264	cmd.exe
6908	cmd.exe
4220	cmd.exe
1560	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2756	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2760	powershell.exe
2760	powershell.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
1572	powershell.exe
1572	powershell.exe
1572	powershell.exe
5972	powershell.exe
5972	powershell.exe
5972	powershell.exe
5492	powershell.exe
5492	powershell.exe
5492	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeIncreaseQuotaPrivilege	2760	powershell.exe
Token: SeSecurityPrivilege	2760	powershell.exe
Token: SeTakeOwnershipPrivilege	2760	powershell.exe
Token: SeLoadDriverPrivilege	2760	powershell.exe
Token: SeSystemProfilePrivilege	2760	powershell.exe
Token: SeSystemtimePrivilege	2760	powershell.exe
Token: SeProfSingleProcessPrivilege	2760	powershell.exe
Token: SeIncBasePriorityPrivilege	2760	powershell.exe
Token: SeCreatePagefilePrivilege	2760	powershell.exe
Token: SeBackupPrivilege	2760	powershell.exe
Token: SeRestorePrivilege	2760	powershell.exe
Token: SeShutdownPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeSystemEnvironmentPrivilege	2760	powershell.exe
Token: SeRemoteShutdownPrivilege	2760	powershell.exe
Token: SeUndockPrivilege	2760	powershell.exe
Token: SeManageVolumePrivilege	2760	powershell.exe
Token: 33	2760	powershell.exe
Token: 34	2760	powershell.exe
Token: 35	2760	powershell.exe
Token: 36	2760	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeIncreaseQuotaPrivilege	3512	powershell.exe
Token: SeSecurityPrivilege	3512	powershell.exe
Token: SeTakeOwnershipPrivilege	3512	powershell.exe
Token: SeLoadDriverPrivilege	3512	powershell.exe
Token: SeSystemProfilePrivilege	3512	powershell.exe
Token: SeSystemtimePrivilege	3512	powershell.exe
Token: SeProfSingleProcessPrivilege	3512	powershell.exe
Token: SeIncBasePriorityPrivilege	3512	powershell.exe
Token: SeCreatePagefilePrivilege	3512	powershell.exe
Token: SeBackupPrivilege	3512	powershell.exe
Token: SeRestorePrivilege	3512	powershell.exe
Token: SeShutdownPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeSystemEnvironmentPrivilege	3512	powershell.exe
Token: SeRemoteShutdownPrivilege	3512	powershell.exe
Token: SeUndockPrivilege	3512	powershell.exe
Token: SeManageVolumePrivilege	3512	powershell.exe
Token: 33	3512	powershell.exe
Token: 34	3512	powershell.exe
Token: 35	3512	powershell.exe
Token: 36	3512	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeIncreaseQuotaPrivilege	1572	powershell.exe
Token: SeSecurityPrivilege	1572	powershell.exe
Token: SeTakeOwnershipPrivilege	1572	powershell.exe
Token: SeLoadDriverPrivilege	1572	powershell.exe
Token: SeSystemProfilePrivilege	1572	powershell.exe
Token: SeSystemtimePrivilege	1572	powershell.exe
Token: SeProfSingleProcessPrivilege	1572	powershell.exe
Token: SeIncBasePriorityPrivilege	1572	powershell.exe
Token: SeCreatePagefilePrivilege	1572	powershell.exe
Token: SeBackupPrivilege	1572	powershell.exe
Token: SeRestorePrivilege	1572	powershell.exe
Token: SeShutdownPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeSystemEnvironmentPrivilege	1572	powershell.exe
Token: SeRemoteShutdownPrivilege	1572	powershell.exe
Token: SeUndockPrivilege	1572	powershell.exe
Token: SeManageVolumePrivilege	1572	powershell.exe
Token: 33	1572	powershell.exe
Token: 34	1572	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1260	5052	Exodus Setup.exe	90
PID 1260 wrote to memory of 2220	1260	Exodus Setup.exe	92
PID 2220 wrote to memory of 2760	2220	cmd.exe	94
PID 1260 wrote to memory of 5688	1260	Exodus Setup.exe	96
PID 5688 wrote to memory of 3512	5688	cmd.exe	98
PID 1260 wrote to memory of 3436	1260	Exodus Setup.exe	99
PID 3436 wrote to memory of 1572	3436	cmd.exe	101
PID 1260 wrote to memory of 5552	1260	Exodus Setup.exe	102
PID 5552 wrote to memory of 5972	5552	cmd.exe	104
PID 1260 wrote to memory of 6116	1260	Exodus Setup.exe	105
PID 6116 wrote to memory of 5492	6116	cmd.exe	107
PID 1260 wrote to memory of 4792	1260	Exodus Setup.exe	108
PID 4792 wrote to memory of 2468	4792	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\Exodus Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Exodus Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\Exodus Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Exodus Setup.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:5276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:4220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:1560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:5708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:2488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:5456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:3800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:1504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:4684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:6264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:6908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:7104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'""
    3⤵
    - Executes a command shell one-liner
    PID:6208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffad5d2c728,0x7ffad5d2c734,0x7ffad5d2c740
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,9080144631854395561,2493772690210596063,262144 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1900,i,13333761384480696746,17061671566212490159,524288 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,5618634597753938723,582569842806373657,524288 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,6135820318034753552,7714079232442509173,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,15974783431102655989,13696809872250175407,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4688,i,6587959653666806295,13100819682425680011,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4684,i,13652906464049705472,7227214984327972042,524288 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5404,i,2062351880028230471,8707080978940452307,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,3059407509054027740,8070701260959977316,524288 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:14
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5672,i,14476413861512667213,15962969070173058544,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5696,i,662739777472546708,11419384045126377608,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5924,i,12894867922877397987,14166875140983234616,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5928,i,12060031125294572902,8115857934938204550,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6228,i,15846177418443275775,2372412865735885560,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6340,i,5464911928195559818,13953326676232981599,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5816,i,7127470316893351907,12419773866395786327,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6484,i,18045812776536010685,16761623102717012405,2097152 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,9043808435971292592,11115585223667344193,524288 --field-trial-handle=1980,i,16748078149371108558,97450649968494741,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:2908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

25e63e21-f482-4d1e-8f22-d46ddf42efa6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\25e63e21-f482-4d1e-8f22-d46ddf42efa6.tmp
Size 124KB
SHA256 5c5c0cffca714baa8b5582ad03d2a2c59648c78f1daa05c4b52cb1179085c907
MD5 6ac2dc1bb4165d8e492002e4e06e1fd1
SHA1 7f6d981d488f070f97feb99ede2297f06092d499
SHA512 2b98633ec4a2990d4e6dfc79c7f7c379faf5a0bedb412d6c1ecbe698c4bf96792dcbd2a7c0829cf1a08fbaf21b348ce4636a64473c7191fbb25fbf88bcafaeaf
SSDEEP 3072:JWHYBxxYWn0M4YVjoS8PcXoKOHxbD58TpRjEDO:Xxa9YVjoS0QoKQ58EO
TLSH
T1DAC312D4883E5FF66D1D88669A2D339AEF707C74C0A9B5F0E2F6930C0A9AEDC1507056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 504B
SHA256 6cd548a96f9c76615cd6a27765c94cd8e55a4f68853a9a1ff2e377175010ef64
MD5 0342dad5688913fad665cc6afeee0e7f
SHA1 c289fac52bcabaac8ce3a31fdfe691a0c15e4013
SHA512 673fcbaccb410f7affe38a73f8c90f586334294a27ee701e8441e29bdc0c583d5c52d23cfac3e7e807106a844d97b48ef53419b049d882ee372507c30f4fb49e
TLSH
T1C0F0EDD821758942CFF03EF304BD888A244A9F2EC7214F4FB2D0326CB0191A3818D153
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e2d8f4b045b173db157518bf4a78d065cd8a18904c86cab3cba46747307db29a
MD5 e26a225cbd38d81852741a6bf3c294a4
SHA1 bab2282ad0624b4c9a000c576ee4d4b29bf5eec5
SHA512 93387db951b568d778c4d2293432522f1250ee6654f2304045f19bdc02ee25b99b5f53d67fb915913fd10bdc2ec4dfd5fbb62a5fcd89cdceda0c800bec2e9696
SSDEEP 48:YALlqUqOhAhmszXLsCfoKsQRsd2fsdiosdIKsdGtsdWJzsddcsdRf/sdxPsdbNPU:D/z+f7jLReaX0nfWQNPiuUR
TLSH
T12F9170F7C3D8852E895196F8EB156F1FCD2D0A14432D3C66C8D8AF5B93E2871D21524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 7acac543a192e4ef9f198fbbc5687194ac78d664de14c7c18923ab79207b7f39
MD5 c461f36676fcdea92c7e9c2481c24e24
SHA1 9d6c82303bba1a21ddbe8c17ef1cc0b606bdec77
SHA512 fa7234d081e582d5bf409e170a2159f4dd33ffc6ae9be00389c6f3fce6d27fe536458726dcb20234a50ff85d0721792baedb3e548387b1905e3b2ada842abaa7
TLSH
T1D7F052ABEE3974636878D5BF1E05B80939B6E83102413CF4CF6A426CA0854F31B0605B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6b8c0d07ef7104e421d17240d597d30fc8af20a2f556fc086240e423325a6186
MD5 f645ebc4c06b69a7813487c64e596234
SHA1 385aecc7645695e222c1e335cc4e8fed3b22af8e
SHA512 b0b690809ed6f15fadc6b12f5573eb88b3bf1f5103ec45dc912a0b1c0887bc8953abf7aa0a371e3f8699067d198e4085ae24309bb65286825dcc5f293ff43000
SSDEEP 192:JR7cBz7A+2v7JQAPRp24kX99Hsb+WNnKh4JG2Mf8e3wVyIsnAUge:JR7mz77CPXYvwA72Te
TLSH
T11542C62EA954653B5CDBC229FA267B67E3F1102671D42E90EBFCCA2C01E79CC6217447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 ed89a9e1cb9804f7a442545a4232b0bb73beb6be31d898e5c732b174e167cdf5
MD5 4c8354741b0036d29a836cc4841008b2
SHA1 a41a42e0a1e002cd6c8b4cb6fa6334a34f81ae2a
SHA512 f913c2289919f708434ca1fefdda67b8ac11ba28f2add35691ee6b2c7f915bf6c07cadafd9fb4d6ec19cf14ac71290f1c954ef9a0f8214078f6e5c4fbabcb51d
SSDEEP 192:e/Q4K6I+7KxkXqK4I40pUZNCgVLHrKHfFKslE8nRXzKD/KB+ErUkKN9r5FUxpEl6:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZR3
TLSH
T12132C72BA48D9A3F4FA8D54CDC136F4B6CE5029376780C2456FB9D0803A5BCE115A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 096edfa7a961118d9a4fa4030a9b9faa6045499c32cb1c399ee41e2113cd9405
MD5 81ab0e8eb743d31f35819fbe642d9d3c
SHA1 fc2a37099ffea1c354951c2558e35208f1880caa
SHA512 d8949d3b8778c445b9d86d00ea863358acb3454a02deef373381aabf48292db665cbb333c9f7cef1c3eb6ffeddafdaba6f35cdc6c94ebc159e250b92ec0413b6
TLSH
T130B0222833820E33CF3B0BF020C2802232002CA23282802330F8808ACC0238022C0C80
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c0a7b840c0a2c4df465b996372b8e523e986b0fcc176c5ab713e1f86af66a4ec
MD5 0801cf276a014372596cce1ca6c3b891
SHA1 e58c43f95bb4ec44a57e9386bda0ec2f72d848da
SHA512 516c521b70444010a3fea12efd2b6fc72d88f5749791409ca121029edec779c131d2980e4300f31ed4e0096182faa9acacd032377f2fa42da4ce1a6ea3396e2c
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok594DuB6vGyvk54ENTboRYv4a:5C0Ngjf5ZKSNqDUD0O7qENTbog
TLSH
T1F5A12AB1A46D4DB394B6C589B1437B43DEA421A7AA71FF84E8DC5F0C00FB5D82382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 d80ef766cbc2085944fa683f2c51be3a440e2fda8509190d30681124c57340a4
MD5 5dd0c1041f95bf1037c118cfd8f8a745
SHA1 8a4c90a00b1bb5b1d6971dde5110d5e94176ce07
SHA512 b183dd778596b9260b056f06543ac21ddd39dfb8c59329b1b6e6e5e85f7cea79d5d21110f7cce70bf4cfb7df33e2a1cd101f93bccc3c3408103e1e1b6507dffe
SSDEEP 3072:1WHYBxxYWn0M4YVjoS8PcXoKOHxbD58TpRjEDO:zxa9YVjoS0QoKQ58EO
TLSH
T15EC312D4883E5FF66D1D88669A2D339AEF707C74C0A9B5F0E2F6930C0A9AEDC1507056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download