50940d288c3208a33c1fbad7f122cd8d0671d08603d06598370adc8cc552de2f

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
1631s
max time network
1638s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kul.zip
Size 64.3MB
Sample260804-jc2a8aak5v
SHA256 50940d288c3208a33c1fbad7f122cd8d0671d08603d06598370adc8cc552de2f
MD5 fa3f9f894c0699456f7a08cfb80d6323
SHA1 7a8cf0d5b220f0e4efe84590a208b6ae86b92781
SHA512 a4dbbaa9c54ec735d1c1578350cc3e38a13575c29b8b66526965825efd4b1af0a042771f1d9d6d28f77290551dcce81d8a6561ac3d8db3f9d3295e726e2df45e
SSDEEP 1572864:AtYibWlXGO2oaU4HtQFYbvcUhAcrlg3xemlLvnxL7dby/Pw2zMermDPju:Aud2o14HCYbvcQAdxemlry/I2NUu
TLSH
T160E73379C1F1A5E7C149D276AC3CAF81062771AB50F8C074973147E244A7E9AABD0F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution exploit persistence ransomware spyware stealer

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4964	takeown.exe
3572	icacls.exe

Executes dropped EXE 4 IoCs

pid	Process
4312	java.exe
2740	java.exe
3712	java.exe
3748	java.exe

Loads dropped DLL 58 IoCs

pid	Process
4312	java.exe
4312	java.exe
4312	java.exe
4312	java.exe
4312	java.exe
4312	java.exe
4312	java.exe
4312	java.exe
2740	java.exe
2740	java.exe
2740	java.exe
2740	java.exe
2740	java.exe
2740	java.exe
2740	java.exe
2740	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe
3748	java.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4964	takeown.exe
3572	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
149	discord.com
1	discord.com
7	discord.com
141	discord.com
144	discord.com
151	discord.com
153	discord.com
156	discord.com
105	discord.com
147	discord.com

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2700	tasklist.exe
4408	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl	LogonUI.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1190018277\3294736460.pri	LogonUI.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
468	powershell.exe
4500	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2056	cmd.exe
4180	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5384	chrome.exe
4956	chrome.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LogonUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LogonUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1992	wmic.exe
1152	wmic.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 53 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303475341408414"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lighting	ctfmon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\Pen\PLOC\Settings	ctfmon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHS	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\Settings	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\StigRegKey\Typing\DesktopNearCaretKeyboardEnabled	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IME\15.0\IMETC	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\TIPC	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\2	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHT	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\TabletTip\1.7	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\IME\15.0\IMEJP\MSIME	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\CandidateWindow\CHS\1	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f0005398e082303024b98265d99428e115f0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2252	schtasks.exe
3652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
468	powershell.exe
468	powershell.exe
4628	chrome.exe
4628	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1992	wmic.exe
1992	wmic.exe
1992	wmic.exe
1992	wmic.exe
3648	WMIC.exe
3648	WMIC.exe
3648	WMIC.exe
3648	WMIC.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe
3712	java.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4964	takeown.exe
Token: SeDebugPrivilege	468	powershell.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe
Token: SeShutdownPrivilege	4628	chrome.exe
Token: SeCreatePagefilePrivilege	4628	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe
4628	chrome.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1104	chrome.exe
5356	NOTEPAD.EXE
5356	NOTEPAD.EXE
5356	NOTEPAD.EXE
5356	NOTEPAD.EXE
3712	java.exe
3748	java.exe
3748	java.exe
760	LogonUI.exe
760	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5128 wrote to memory of 4964	5128	cmd.exe	92
PID 5128 wrote to memory of 3572	5128	cmd.exe	93
PID 5128 wrote to memory of 468	5128	cmd.exe	94
PID 4628 wrote to memory of 1752	4628	chrome.exe	96
PID 4628 wrote to memory of 3460	4628	chrome.exe	97
PID 4628 wrote to memory of 3460	4628	chrome.exe	97
PID 4628 wrote to memory of 5384	4628	chrome.exe	98
PID 4628 wrote to memory of 3400	4628	chrome.exe	99
PID 4628 wrote to memory of 3400	4628	chrome.exe	99
PID 4628 wrote to memory of 2788	4628	chrome.exe	101
PID 4628 wrote to memory of 2788	4628	chrome.exe	101
PID 4628 wrote to memory of 1856	4628	chrome.exe	102
PID 4628 wrote to memory of 1856	4628	chrome.exe	102
PID 4628 wrote to memory of 5872	4628	chrome.exe	103
PID 4628 wrote to memory of 5872	4628	chrome.exe	103
PID 4628 wrote to memory of 1832	4628	chrome.exe	104
PID 4628 wrote to memory of 1832	4628	chrome.exe	104
PID 4628 wrote to memory of 3920	4628	chrome.exe	105
PID 4628 wrote to memory of 1628	4628	chrome.exe	107
PID 4628 wrote to memory of 1628	4628	chrome.exe	107
PID 4628 wrote to memory of 5340	4628	chrome.exe	108
PID 4628 wrote to memory of 5340	4628	chrome.exe	108
PID 4628 wrote to memory of 240	4628	chrome.exe	112
PID 4628 wrote to memory of 4352	4628	chrome.exe	113
PID 4628 wrote to memory of 240	4628	chrome.exe	112
PID 4628 wrote to memory of 3740	4628	chrome.exe	111
PID 4628 wrote to memory of 4352	4628	chrome.exe	113
PID 4628 wrote to memory of 3740	4628	chrome.exe	111
PID 4628 wrote to memory of 3100	4628	chrome.exe	114
PID 4628 wrote to memory of 4956	4628	chrome.exe	115
PID 4628 wrote to memory of 3100	4628	chrome.exe	114
PID 4628 wrote to memory of 2884	4628	chrome.exe	117
PID 4628 wrote to memory of 4956	4628	chrome.exe	115
PID 4628 wrote to memory of 5148	4628	chrome.exe	118
PID 4628 wrote to memory of 2884	4628	chrome.exe	117
PID 4628 wrote to memory of 5276	4628	chrome.exe	116
PID 4628 wrote to memory of 5148	4628	chrome.exe	118
PID 4628 wrote to memory of 5276	4628	chrome.exe	116
PID 4628 wrote to memory of 1936	4628	chrome.exe	119
PID 4628 wrote to memory of 1936	4628	chrome.exe	119
PID 4628 wrote to memory of 5216	4628	chrome.exe	120
PID 4628 wrote to memory of 5216	4628	chrome.exe	120
PID 4628 wrote to memory of 3020	4628	chrome.exe	121
PID 4628 wrote to memory of 3020	4628	chrome.exe	121
PID 4628 wrote to memory of 3988	4628	chrome.exe	122
PID 4628 wrote to memory of 4024	4628	chrome.exe	123
PID 4628 wrote to memory of 3988	4628	chrome.exe	122
PID 4628 wrote to memory of 4024	4628	chrome.exe	123
PID 4628 wrote to memory of 5684	4628	chrome.exe	124
PID 4628 wrote to memory of 5684	4628	chrome.exe	124
PID 4628 wrote to memory of 3796	4628	chrome.exe	125
PID 4628 wrote to memory of 2588	4628	chrome.exe	126
PID 4628 wrote to memory of 1920	4628	chrome.exe	127
PID 4628 wrote to memory of 2296	4628	chrome.exe	128
PID 4628 wrote to memory of 2296	4628	chrome.exe	128
PID 4628 wrote to memory of 1104	4628	chrome.exe	129
PID 4628 wrote to memory of 4832	4628	chrome.exe	130
PID 1852 wrote to memory of 1004	1852	chrome.exe	139
PID 1852 wrote to memory of 4956	1852	chrome.exe	140
PID 1852 wrote to memory of 3144	1852	chrome.exe	141
PID 1852 wrote to memory of 3144	1852	chrome.exe	141
PID 1852 wrote to memory of 2732	1852	chrome.exe	143
PID 1852 wrote to memory of 2732	1852	chrome.exe	143
PID 1852 wrote to memory of 4124	1852	chrome.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\kul.zip
1⤵
PID:1824

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Windows\system32\takeown.exe
  takeown /f C:\Windows\System32\shutdown.exe
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\System32\shutdown.exe /deny Everyone:RX
  2⤵
  - Possible privilege escalation attempt
  - Modifies file permissions
  PID:3572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "expand-archive -path kul.zip -destinationpath extracted"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:468
- C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.exe
  j\bin\java.exe -version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4312
- C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.exe
  j\bin\java.exe -version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.exe
  j\bin\java.exe -jar gang.jar
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3712
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:1992
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Discovers running processes
    PID:2700
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3648
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\microm\j\bin\javax.exe\" -jar \"C:\Users\Admin\AppData\Local\microm\gang.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    PID:2056
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\microm\j\bin\javax.exe\" -jar \"C:\Users\Admin\AppData\Local\microm\gang.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2252
- C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.exe
  j\bin\java.exe -jar gang.jar
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:3748
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1152
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist.exe
    3⤵
    - Discovers running processes
    PID:4408
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    3⤵
    PID:5712
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\microm\j\bin\javax.exe\" -jar \"C:\Users\Admin\AppData\Local\microm\gang.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f"
    3⤵
    - Executes a command shell one-liner
    PID:4180
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "App_Admin" /tr "\"C:\Users\Admin\AppData\Local\microm\j\bin\javax.exe\" -jar \"C:\Users\Admin\AppData\Local\microm\gang.jar\"" /sc ONLOGON /delay 0000:05 /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Add-Type -AssemblyName System.Speech; (New-Object System.Speech.Synthesis.SpeechSynthesizer).Speak('LMAO')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4500
- - C:\Windows\SYSTEM32\rundll32.exe
    rundll32.exe user32.dll,LockWorkStation
    3⤵
    PID:5292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa2b19c728,0x7ffa2b19c734,0x7ffa2b19c740
  2⤵
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,10813550601777148488,10197704674662772767,262144 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,5950355601982013961,12688865016065455845,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,17252610607454259012,15152804548033250045,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,17486548493791947538,6587567529323532209,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,5129567768507112556,12014396051011974656,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4688,i,3408814264571213405,687798135350624271,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,13324565932562027013,11177415333137234851,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,8608225444525919206,13017348815635003511,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5452,i,10276646338444950247,4602192192879197137,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5548,i,5146373661468079592,8397500654596033238,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,6866275612737502290,5929112601937544772,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5464,i,14646074109910903619,1659247310278935184,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5356,i,10616319374444317173,5676222078334576669,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5672,i,12391193681296328169,11904071984299457013,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5996,i,3363943806572970980,6520976687042022294,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,16978387780316273189,5139729888162870211,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5576,i,14897592249858486564,6759423858495880656,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6048,i,10055670416225612312,9179486581467452784,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5680,i,1083071755649547976,18426863563935047599,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6632,i,14520395447350577012,1030300235285172954,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6656,i,2493351508808662479,12694049465605874083,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3668,i,16742354753450911362,4469525296762941045,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:9
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3492,i,17721895165084294955,8113888991263766862,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,6550063084151996586,7431461412277984002,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,13014369877878426961,8516365233289439446,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,9345384357337465668,14577549662108823536,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,17451857384083201723,295812027663648603,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3648,i,14123880244556922764,11398609164681422963,2097152 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6740,i,1244937614133647652,3587408776150825102,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,11017228506515179190,15893076975759766531,524288 --field-trial-handle=1828,i,9379594944818894853,4825062928931901518,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:4832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2880

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Hi Ratter.txt
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa2b19c728,0x7ffa2b19c734,0x7ffa2b19c740
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1840,i,317881053049660878,17922962546277943419,524288 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=2104 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,3654125993172344372,469726956068912065,262144 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,13152118416226284871,18167963059407700169,524288 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,13223036460458747329,15028754127445723470,2097152 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,7541497485961325889,12420604167169810334,2097152 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3912,i,6962826948077439844,17259501663746421394,2097152 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,11189324738450023270,14581157725796255633,524288 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5396,i,15319888153681604746,4611983697277225528,2097152 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5820,i,2665870215108538488,11910099538046178875,2097152 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3164,i,5267345793640007328,3057038205309409128,524288 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=3476 /prefetch:14
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,6619245023285359115,13717125811195618021,524288 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=3552 /prefetch:14
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3652,i,12027205971171763490,15381584469964697823,524288 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=3588 /prefetch:14
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3604,i,6418756270333532108,15627161248758519019,524288 --field-trial-handle=1888,i,336793505124264138,11790644651686140267,262144 --variations-seed-version=20260804-090100.660000-production --mojo-platform-channel-handle=3572 /prefetch:14
  2⤵
  PID:4016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5628

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3996

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004D4
1⤵
PID:6108

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39af855 /state1:0x41c64e6d
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1732

C:\Windows\system32\ctfmon.exe
/QuitInfo:0000000000000174;00000000000001F8;
1⤵
- Modifies data under HKEY_USERS
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 59ffe43ef3321744091ab6e91027cf89937735cf5fa8749bd7fc1ec8eeb2bb54
MD5 21e0bac9107ba37bce4c38e9dd20ea12
SHA1 a5bad9d05bb54e8600da9bde7345ace1a9d8419f
SHA512 1fa2126796683c32571d3d1ebff95519ed07a91d13dde897547262ad9d8967c6a1858e7a9c7c571e9b85a67df9eea23aeaa8980daa35b4699d93667320688896
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ac55a63e46ddb08c084662d685af2037cd735a4ce64452a3e25e4957f366da3f
MD5 5666d3416df781699ba37f0737761a62
SHA1 a44c5cc42b6d35189658689c8eda2c113712bf8f
SHA512 fda7463735854f6a0d63b90e44d61bf1d59c627e54596d96bd6ee29a722c70143936a74c3d122441e45ed00ecc024cac781b173760583de773f89b7682036103
TLSH
T1F1F028B5C925AC3719FD0B6C30940B46E751136B3B41589F3B3D924C8FB0A3F868681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000066
Size 25KB
SHA256 d988f17022c2e51b630a4a7cd71019b5c5329f404cb17e06d8fb1a8914930117
MD5 4ab101c5df5810f12667341a92a1d60a
SHA1 aedd87954d3a6061ac04465fe4990f8b5f269984
SHA512 6dad4a9511a54b69cbe1ec60c3e38dd8bc1f64a7d390c6c952a9076295c5f5f3cd51444aab89a9164b5c0df59e82b65fb9fa2b8cd51fa4ecfc10bd1d881be15c
SSDEEP 768:DltfuRFbWfIwOvspJYnYqINom6mp28/u3:DlJuH+0sp0gqm6qu3
TLSH
T13DC2F8078D088B83A55983E4BE071EA85F566B1CE8C23AEF14274DDF3E103625CDE46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ab
Size 58KB
SHA256 39e6ab477b1f4f2909e6f62b715544cd8e76fb7bdc602b36937cd9eec74de18c
MD5 bf029b1424c16527e26f7aee515c8b38
SHA1 e1312f4ca88fd513edc56958597d3dfe5094d1aa
SHA512 ba2307f1dd6c41f4e79f0536beaba75367951a61304cf68775551dacfe723e8605034c76e5c530165f2d624c128f23a5dae6cb9bd57f8de8bf7964c1f01a203f
SSDEEP 1536:kDHhuu/idESL+kmV5rzYZ9blQ195wqAz9fNXen:MH4uOH6A9bS195lAJ0n
TLSH
T1A443027236264260BBCFAECAE1C2C8D95C317599187B5BDADC3343572B2C09B5BC9C49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ae
Size 18KB
SHA256 c46bc5ea7bcfcf501c58c0ca4007fe0418a7e4d640e29e8b60d7702eec481b0c
MD5 bdeadb420aed32237c23da7ff99eff38
SHA1 da2c2aea553b5157cea81d747981f8d3fb796879
SHA512 47d8796bb7116568719a441de234b285ce1610ccfe0fe9279132df8614410f18f838a0ebeac8c5d77f988cb8ff85ac8e5e623fe48b4d33daf509aa26a92399a9
SSDEEP 384:rrHJ0DgtdmsyNro22p3ALq9Qys6shPsQr8U3DBQJ7euCnDrJeaH:nHJ6dNP2p3ALqNsbr8cDBQJauyP
TLSH
T13F92E6175D0C9BA3E4AC92E4BD0B6ED86E46571CE8927EFF04624EDB7E112525C8802E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e45667c921239aa30f0d637573e4afbda5f44d4e0d7763cf32e6e2793a0f28c6
MD5 5a6543c04ebb26e8da789980d4af8bf6
SHA1 620e5235a242c6ec18fea40be97bd259401b7311
SHA512 6fa3a4775e9824c41c3f56ef6133abf5c29289d2e82833c188b112d72572332372d180df2f7e24dadf47759114da712e25164e75998fc12d5a9f3949e16adf76
TLSH
T12041B716D9C8C312EF489730E1C753AA3E3A7087200FAEDF58A5057998027EAE16CB43
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 50fa95fc10a97171e7c3b8a283a37e9669a7f1bf99f7d7aff207685a360c2c8d
MD5 1a4f2c310fc1e94aeb52629fe59cc631
SHA1 0389007d3064c2f53482f3e5cc5985dcd853801b
SHA512 7c9e7013db4038d429fd97579ad39f4b5040554c88d00197019cbbecdf7c1e2aa9fb7e88a3a769a0811170ece95d1d1446b98687e88cbf3879199b215b32964a
TLSH
T16641E812D9C8C322EF089734E1C753AA3F3A3053214F6EDF59A5053598027EAE16CB43
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 66556a3d5354b2a9e2d0a42211db70d4b676ce4a83591c3b10faf24da40ca76e
MD5 0470c98867fd15881ddbcf68cf06c2fd
SHA1 7d367cba59d82c5718187ee5a2633edb43e4e208
SHA512 c97578201c66878b040bef940cc7be9222d5ed18c3556a66bd29926e55ba642f6c1978153bb3e9fbef07bcdec2c0a6f9d8f1a1557b9c8e0bc035f1f8714f24b3
TLSH
T15221D912D4E06316CF54663054CB0FA23D3A0548A00B2FCB9D6A863E3A2B3F9E25C723
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4777534cb633aca42f12d5c9dc59e8572fce6fadd327a9dd0d16d91973b9797c
MD5 3e0494fad7804cfc6c0da1254e406154
SHA1 ef289b516d355203af3f53c2efd5e58f205015f5
SHA512 920e035f7f1d9cfbd5c6667d484505f54fb580110cd5e6916dc9809084b376a03396529682c29b12a4221b9e4fa0244ee2844635f5d154df470592d1cde87ec4
TLSH
T16F717BF7D7E48A2DC91166F497217E2BDE290A29421C3C26C8D8EF4F53E25B2D20074E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1fa2d2d2b412562d936ee032e6d63990d87e2bfa95d419b368ea7a950d26881b
MD5 41cf59ab1a8b89842626f8e9fc5fffda
SHA1 43d64102261474ba0b245e0ff247014f7c87aef0
SHA512 1ad35e77e6953b7b206c8626b33ac0338c77ab00a507dfae9dbb45edeb2bc410a9ba1eb86d76badb1e1f77c315d52587ee53025012219a7baf88721416eb543b
TLSH
T155317CF7C7D8957D890156F4AB156F2BCD290D19531D3C26C8E4AE1F97E1871D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 268715de1fe05411bc10c989261d6e422255c9df8b68928221de7c107ddbdc64
MD5 0ba3543dbf45cd166edf935ce3d269ab
SHA1 f0c743b562f3c4af446b68482c162ac221601d78
SHA512 0ac02c5a82cb3179d3c6363fee2a9ff8248924e1afa6e3e2e0c90165136551b1b22f41fc23d0d8e09f1cebdd82b37ba70946b5043e4cc546da87158832aca899
TLSH
T183317AF7C7D8997D890156F8AB156F2BCE290D19531D3C26C8E8AE1FA7E2871D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1b7d9bf98c3917edff4700039e108f1fc5d2ebfb65eeea568288411566a54394
MD5 b24e6423307b4e6684e11e2d0e2b000f
SHA1 b656df817a12ac5343d51a7a9870c3f38817e695
SHA512 df90bdf15dfd925f43e9a7c9a9cdab9e16e6cf543e68e1a92fea6a738de2709b210bb39c76f854e154eb0c39bd9066cf2da08f87111106314db0a98c840d26fe
TLSH
T1BE817CF7D7E4CA2DC91156F497217E2FDE290A28421D3C66C8D8EE4B93E25B2D20074E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3c80e93baa6ffbc39494c890f140a83abd23d7a532c82c7617f8b364d453f41d
MD5 3e34d3e4191921dba517d1bd37f388ee
SHA1 5979c172848d886d5d8b2b470f3e24fa3dc22f89
SHA512 27ca28f613af7381ece92f5d4f54c9568321171b660235600ce189c83e36e03dad3bd0b0d72af1936a653792d27a9ae98508cb1b0ba849df6ebfb21621417587
TLSH
T134817DF7D7E4CA2DC51156F497117E2FDE290A18421D3C26C8D8EE4B93E2572D20074E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 dbe4696889cb4740652689f47575beda218f7484b32f1a509de69d5228ab4611
MD5 9b1707dce5bc408b30f5ab4496151d31
SHA1 60dc83ec1e4c19abf803db9568eab31707afe6ec
SHA512 2dc210d3e71aa55a66d070cbc6d2ad0089c1910afb025d704faa9a80b99df28d8281c144e9f79a78ab67a52997a73a5c20cb3ba8cdd8cd9358f8b4d3fcac27d7
TLSH
T1A1216B6F8ABEB4AB10B848FF5E1CBC0569B5B430119168F5FF9681ADF08A4F31A11067
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 cd2baa5e8c1a565486ff3aa500dbf0b06bee05db4881a6dfc0c32585685059a8
MD5 191fdbe39383ee76a682dd5d4ed08a8d
SHA1 4e2c24f056d843d9ed04896688438c6fb7e6b6d9
SHA512 ef7cbdb30305d077c7512a28004609798a4578f031887e46f2f877407500cc5bee91ffce76e861a2362622ee872fc7e13895196e87ffc7365370c34f828a984d
TLSH
T14F217C6BDB7E749B10A948BB6D497C06E966B431018134F0EFA2826CF0C56F31B15052
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 54532fc92e6ddb4f9ad8f2a85cf86298670b25943ba65700f6a20d514df6bddc
MD5 621bad7a6aa557a82578dbb90027c1d8
SHA1 bfb356baaacbd0c567b32196a2e90760734e8841
SHA512 df42e3d58a862f8d978dff67c4cc1e9c429a2e6c1e707a44e1f3e5d56775d673244dc4fe9f64235d720aebc115a1daf65874869bde8ecb5596f5d6536af2fe3e
SSDEEP 192:nRtKqg9JOv7xAPRp2W9SHsb+WNngv03RFG4kwfVyIsnAUgR:nRtKJJqIXFEwk0VZR
TLSH
T1CF32C91EBA10293B6DDBC21DF9257B53D7F6102235942E88E7FC8A6C24D76CC521B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 101cf5a8acae7854d672b11d706dd95b14b020e123a54b4a1d38be4b86c3a782
MD5 f79f25ec6f64e3266bcf6e58bb9b7bb0
SHA1 e19cc02c188259c0bef2205224aa496acf6a6c4c
SHA512 12dee6ae8602a138ceb876e19561cc4a26dca20eddf553b9cfa1f464b71296bf90b44992ebd03098b272bd252310a5fd74a9c01a20a56438fa7f5110ac35b31a
SSDEEP 192:hRSCqgqlv7HDPRpDSTvW259SHsb+WNtbzgpVvTTA6fyFG4kwzh8yIsnAUgraJ:hRSCGVXXG7W+Ewtcvg6gTGe
TLSH
T1B652E92EA910693B6EDBC62DF9157B52D3F2302225942E84EBFC896C24D76CC621B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9de2c3074225e2fa4b274374bf9d8320758e1aa07fd6b0ccffd2cb07fcdde971
MD5 245040bfe0e758ed8e1001220a73f69b
SHA1 e8c28fac0174294d5bd92de22735c2295344a96b
SHA512 0851071d2698b07775ca4cf994922e8d85aed5ff81ad48400b8921b6988db9957ff0ec0b28e6d3581c789a7bc515005d77f37b57b9039416e28515626e279e57
SSDEEP 192:nRSCqg9JOv7xAPRp2STvW2P9SHsb+WNtbzggvgTb4eSyFG4kwxrPyIsnAUgE:nRSCJJqIX77WIEwtbgAe5RfE
TLSH
T19742C92EA910693B5EDBD229F9157B52D3F7202225D42EC8EBFCC96C14E76CC6217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c50616e2dcea71ec5092c7f41c3cb0b3086ef5d41abbd20585ccf579fa3aeda0
MD5 94fa268a5b3edac44c207e050e797abd
SHA1 e434c40fca5d2002eb32ad2ba0d66c25c7eb73e7
SHA512 fc2e2b04ede6dd7afa4b7d4d03e1fd354a9c1f79aefca29f6240e129c1c5e6bf8e3e38f83be159d4b2bb0d740fb25ccc0b59bc939907f447a642937a545938a7
SSDEEP 192:hRSCqgqlv7HAPRp2STvW2b9SHsb+WNtbzgpVvTAFzENyFG4kwxhVyIsnAUgraJ:hRSCGVeX77WYEwtcvYECRHe
TLSH
T13352D82EB910693B6EDBD229F9157B52D3F3202225D42E84EBFC8D6C24D76CC621B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a562c258f43b8c605ecc058a92fe88c4d5281950b8615222968c03a2d18920e9
MD5 39ddcfad503d83deca336b24d9bec920
SHA1 9f65ee52806a0b79f798ac1cadc9f400e3a468ac
SHA512 fbd7b1dc9cafd8f79395a81531ee60671eacd5d384fc020243985d5e6de9eb8f55bc43407271f75a39d3e33dd8e69628ed40d6d5fefeac28819b6c34c547f0c5
SSDEEP 192:eG14K6ms7KxkXqK4I40pUZNCgVLHrKHfFKslE88OXzKD/l0+ErUkKN9l6y/kkoUb:D1jts7KxkXqKf/pUZNCgVLH2HfgsluO6
TLSH
T16432D827A48D5A3F0FD8D40DD8136F4B6DB5029263780D24A7FF9D0803A97CA125A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 70bb69ee9a1a83822ad7ec6c5d0c238227dccaef90ba6b5eee331bab3c049dc3
MD5 52db369d25a17e53acd20bc0ca4073e2
SHA1 292cf4150c5025303d94757ffc84955b6d478ba7
SHA512 e4922988b299e6c9f33a0e4a26bc0e42222c4a149bc5653ae197bf8c70978736a00e7af76268b55990de24df873316dc9996d633927dfa53871b9f19bf07987d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c9eaca37bfe0f839c3ee36c154db75816aeb5a18b91e601e6406a81ff27880ef
MD5 240cd4139e9c7e8c86632d7057bf37fb
SHA1 5d9cc4c34b58af165ec9841875a8347718f6ff08
SHA512 12630e1a725ed7824a58c6a7098f33d5c3f90c37838975e7baaadaf50be61b39ae7fc07816f5e60034513922e51de8202825daa3cf911b3f98dab92758cb2b28
TLSH
T1D9A0021051C05B31DE414374E2A299452E614C192953479794930954DCBF1C58241907
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5c4a10.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5c4a10.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 5f57040026f03e5650eab37a8a0a303764a8db71aede0d50ff1b91e3a49c8171
MD5 80236b33808abc7c702c7301afbface9
SHA1 08d271d97286bd96485097c5d3f7cd73796d8680
SHA512 ecef0a3b44fac2654bfa80cab1b4af3f18fb88ca9dd176d39899912807d46f3e72f0414e3617c8661641521aab665ec9e62e0dfe7434c79d02f6672345265496
SSDEEP 3072:vcR34VhBkaITupmQwi90EZqsE38JBrk7NGEK:vVVUaITEmQhw38JBrkBjK
TLSH
T1B6C313A9DE9B9D6648D088776A235F07F7666F5CD0A1EEC0CC965702934ACF7B301093
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 860e4e5551a8782f7267b19758641eb03a6a57db247c49d70e9f8e6441232747
MD5 fadb779290b8b31ad7a63e420dcc0fe2
SHA1 f0555056a0a02475243290ea3d2d965746a9439f
SHA512 ed932d773669e980a691b2c67b6e7275cd72f6d2ba5b718c5956ea826cb25bb256ecdb3c68862df5cdb3989fc23523eda7b59bb6d2613206b8139ada7a0e3071
SSDEEP 3072:ccR34VhBkaITupmQwi90EZqsE38JBrk7NGEK:cVVUaITEmQhw38JBrkBjK
TLSH
T1E9C313A9DE9B9D6648D088776A235F07F7666F5CD0A1EEC0CC965702934ACF7B301093
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 2b8be93651191d28d996e25c74761df68e05250e58678e520a932356cfb6dad3
MD5 39a0e9c3c0b01214c3e07327bacced34
SHA1 6202c67c3d1ece6e077263b91057b61d6fbc04c1
SHA512 c2d7bb6f67a2bef18ea0f6670e113ef4154966bfa412cc720cebe4c82396bc7f7e13b64e8345fabdb5cfd7b7838f2dc5eb9b1cff4a272fe639c05888b64cd18c
SSDEEP 3072:TcR34VhBkaITupmQwi90EZqsE38JBrk7NGEr:TVVUaITEmQhw38JBrkBjr
TLSH
T1C9C31276DE975C9608D08CB76A125F07FFA9AA4ED4A0FE448C955B03530ACF7B701493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a794c510ed136ebaafac6e7a6a1530cdf16e5efe43123d51d3e7a1b4a476a34c
MD5 7dd628d5493f54bb24939bc60f9a3f33
SHA1 398bfcf28ef9ec4c78e7f826a2cf5f7b31085ee0
SHA512 ac997daee7dc7bcfcc68044875d1fe88851ec79d2f0404eea675a933063cd69b2d5a91d41331c5657c961870aa4455c639816c5e1aa524c658eb9a1878493cdc
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5/9D/B6EGyvP/e+08ZPEOLv4a:MC08UR5rYv3eDUD9Jgae+08ZsOP
TLSH
T15FA11973A56A8D7BA976C58571426B43CEB6B07BE521AE94E9EC1F0C11EB0EC1301623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 5f6992e74f1a0a754614c7bbf4489f87e6da16186aa9688cfa199d16ca8beaad
MD5 77d900ac1773840026364e0726be2892
SHA1 25aaefefa7161a6f49db7370e6a65dd73bb45896
SHA512 70e9f28b5917713a58d628c385ae891c5bb7b52ee6e2b83130f16f2e322990d80435aeba8d4fb52bc1c647a9eef726e4eb393b182313a4e55b16a3618785350e
SSDEEP 3072:ecR34VhBkaITupmQwi90EZqsE38JBrk7NGEK:eVVUaITEmQhw38JBrkBjK
TLSH
T15DC313A9DE9B9D6648D088776A235F07F7666F5CD0A1EEC0CC965702934ACF7B301093
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 53b43f5954dedad107f4a53ee2bd0d95e4e14dbc07da79c3590115f593ece4d2
MD5 0d3b50de27d3a084b5efb1144e79633b
SHA1 eb3cdfb4602658bf403b26b652874283b20dae9f
SHA512 3ca974531c5d2b07ff3e82b642dc5c68a2f03d9983e49c3c194bcdf3f6ef2384dfb15c6713d8fa2b236ccc1feaf3fbb38f72360aedc9d1afaff5339b325c4e13
SSDEEP 3072:NcR34VhBkaITupmQwi90EZqsE38JBrk7NGEK:NVVUaITEmQhw38JBrkBjK
TLSH
T10BC313A9DE9B9D6648D088776A231F07F7666F5CD0A1EEC0CC965702934ACF7B301093
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 5654b5c86cb944099db3009d3977b259670e46821478e66a2bc59f6d81a2ef6f
MD5 4727e7b03b849581046937db521455cb
SHA1 e8142c659f582cecb16f27096006b1e71114f5b1
SHA512 46b927fcff8d8b68a8593687dd2c6855418cfba5485656e7dcfe353d3c58a1c125fb77a83f05206ba79e9d0b858700affd118372a3fc784f91fe21f68a603ebc
SSDEEP 3072:NcR34VhBkaITupmQwi90EZqsE38JBrk7NGEr:NVVUaITEmQhw38JBrkBjr
TLSH
T1B8C312A9DE9B9D6648D088776A235B07F7766E5CD0E1EE80CC965B03934ACF7B301093
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 186KB
SHA256 e5574c18bb92265b09914bfcfdc24e9eefdb15ee77095c11a22baa6bc5e6639d
MD5 e9649ac9f822c86b1143e94c35a93281
SHA1 c7f353b3b27778a6d4bb6109cc67a8c066e86c6c
SHA512 8593d5f42edf55c0e4cc45b2310fa8e4807c8f192e4439715c60ce0be352c2f9438a7fdf53a568c2436d493603e6a69a37e46100b06a8683c93ba7583cb6c933
SSDEEP 3072:Yy5PCq0tcnbP/7EcR34VhBkaITupmQwi90EZqsE38JBrk7NGEr:rWtk/7EVVUaITEmQhw38JBrkBjr
TLSH
T1D0141377DFAAA82648507D976622970AFF669A4ED0D1EF848CD4D702410ECB3B7047E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fftokrec.qlc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fftokrec.qlc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\bin\java.exe
Size 49KB
SHA256 b3afe83e1ab067da4c56f1a7b2ba4c14ec832d694333f35b2b45178e9ac596ef
MD5 0defc9439e85882fd63fa06be759edc2
SHA1 98f71abaa7fcb4bfba1fafba438c1444b55d16df
SHA512 c0a8aa540c6808cfdb02d7b1d9dc8bd4ae3d60c670e8b19d69cb3b4f3e8c25c9bc7a100592cc82b0a725100a687a21121b6358734756cc67de753ec68b0458e0
SSDEEP 768:9OpAQF9M5R2TyJ5R3s8D/bkt5Ruz3Vb3gD5FYiDLk5kIv4D:CASM5RdJ5R3sozkt5RA3gD5F7VIv4D
TLSH
T15D336C47AA083C81F42F84F188A6792655B4BD032BD173FB7DC6B21E0971391A9176EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\legal\java.desktop\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\legal\java.desktop\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\extracted\j\legal\java.desktop\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

jna14222998206179216121.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna14222998206179216121.dll
Size 248KB
SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
MD5 719d6ba1946c25aa61ce82f90d77ffd5
SHA1 94d2191378cac5719daecc826fc116816284c406
SHA512 119152b624948b76921aa91a5024006ef7c8fdbfe5f6fe71b1ec9f2c0e504b22508ff438c4183e60fa8de93eb35a8c7ccdda3a686e3c2f65c8185f1dd2ef248b
SSDEEP 6144:tO+uZb5K8Dy+Zkt9dHlJ1ybBEleb906wslm/m+yygW:tO+MbMOEe3m
TLSH
T19B440807A7B688E5E8B7C03D44236A12F6B178294320EBEB47444A575F67BE0DB3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4628_1546056213\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite-3.45.3.0-628450cc-9302-42b5-9ea8-322217db3970-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.45.3.0-628450cc-9302-42b5-9ea8-322217db3970-sqlitejdbc.dll
Size 947KB
SHA256 14dee990e031f70c879d5b1b07dc1f8e077952db51e3bb37282f37684f06e18d
MD5 fc683f23febf5492ce94521b369014a8
SHA1 8b72934bf6d8885cdcbf028867d83b1f89ad1b21
SHA512 f022f19763d5d27160826da4b93c1c5eabc0c7f61fd1f39f4bcca3a5d16f721fec6fcf5bf78ea8691a190dcece6848c33e7f51777f6b8812aadec98cdf311f56
SSDEEP 24576:5iGt+jeMSQXL9Ev84DfQXgLlzpqOHN8WaI:1ZnQb9Evj5vqOHNH
TLSH
T1BF256C13E39640BDC47BC2B0872FE323B632F4496134E95F6AA48B642E61F60975F758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssc15766218356324055151.jpg

Path C:\Users\Admin\AppData\Local\Temp\ssc15766218356324055151.jpg
Size 114KB
SHA256 0fd8373467fa5687e5611369e62842e551a6566a62dcc643f4a3009e6d22b647
MD5 622e41812cc3667f6f2e0de74895205a
SHA1 b18114ba794ea95cb2538b91ff9e5fc9f32613d1
SHA512 635709456135c09c249e81b03f902bb0bc2ed078068e848b46cb3a16b71fee5dca3bbe074c5cee0d6eedbf69a6ce3d16fb6ef243fff19f91c3ea8105d22eb8bf
SSDEEP 3072:QKFKzK0KEOKrKrKrKrKrKrKrKrKrKsKyTHVW7wMa5zg40Io46yWNb1eYw9IZIkhj:QKFKzK0K/KrKrKrKrKrKrKrKrKrKsKym
TLSH
T113B315138C1C8793A56D57E8BD135DAD6E1A2B0DEC867AFF10224ECB3D601661C8E46F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssc17410323427385278176.jpg

Path C:\Users\Admin\AppData\Local\Temp\ssc17410323427385278176.jpg
Size 122KB
SHA256 dd58884b03404fd67739d60c142b0faf736a801a5765340e4266b5d1b96d0eb6
MD5 b14123b17d4898a16c0555c08275a416
SHA1 679c12ea9fa715a9e1a015041d1e71dc18c15f07
SHA512 35caf5889753ec9e0b6f1a57a3eb6eb872794c1833cd583d5ff647570d99e98908d7618f8afd9f43e9e3f172e7217f43d2499bde11d086020047785248dc0fe1
SSDEEP 3072:QKCKiK0KyKJKrKrKrKrKrKrKrKrKrKrKgReiJxUKiB8VCgW3iRuG2dqB:QKCKiK0KyKJKrKrKrKrKrKrKrKrKrKr/
TLSH
T101C331034C198B93A51993E8BE531D9D2F565B5CEC827AFF00221ECB3F642661D9E42F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssc2932649110336349813.jpg

Path C:\Users\Admin\AppData\Local\Temp\ssc2932649110336349813.jpg
Size 119KB
SHA256 a7698c02922b0996574ca0469284e7c70cd17c914f59f770fb000371cb90b974
MD5 4aad33efce1ea326f0741652f77dd406
SHA1 b8dca8cadf91ea3c7b48a3b7655a2c2a47690685
SHA512 f90656a5ef345806369668db099bea9e1d97ddbf001a9c2dc059ef8e665c96c277e0ea20910946eb26d6156edcb5c4f3ac2008967ffda5bb899c4fa415ff85bf
SSDEEP 3072:QKFKzK0KEeKIKPKVdUoV2fa5UyiZ32Mjzg7cmEr/oXnwF/AKQGtUWq3X:QKFKzK0K5KIKPKVioUi/iZ32tdAk
TLSH
T1ECC322138C548B53A56997E8BE035EAD5F1A2F4DF8C276EF40220DCB3E606361D9E42D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssc983875003531933055.jpg

Path C:\Users\Admin\AppData\Local\Temp\ssc983875003531933055.jpg
Size 32KB
SHA256 1fd3fb2da8bb2fcb485a4e7a6ab364490197ccfb872ba2d9e7b6d6a1a26c5bb9
MD5 4f94efa6c4e0c8f20197b364df2e163b
SHA1 aaf22d1ed2f1ef37e5b3b8f6e7f52eb53eb6f6f6
SHA512 337c2478b607b49cb54b09e382c7d0fc7ad41e0ba454b6fd91df6f67fdb2a2164d6c1afd2874ceeccb7344db363d9cde4bd156667f3219b619146d0a4fcffff1
SSDEEP 24:9H4sozWfo0XxDuLHeOWXG4OZ7DAJuLHenX3o3:14/znuERAW
TLSH
T1D1E2A25E6755C360DC1795FA15571F92E6CF9B8379503606297082BFCD109C487CCA5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

AddGroup.doc

Path C:\Users\Admin\Desktop\AddGroup.doc
Size 368KB
SHA256 e5106fc7e446b8888ba38f2b0f80629e11b115366c69cf726d83a9a8ebd41575
MD5 a7885304e76b983d362b869389e55997
SHA1 288c946f420b1d041703ca2f83a6c3922df1d699
SHA512 1456012b8d742056a7bb4d7cff4f950543a622494a00542f139642d8b333084da6bc2426f4f1de772ad718aff825f3dd7a2f5e735fb17aa4b41a69730c36a3bc
SSDEEP 6144:7vl/bQxdsQZO7lXHTyGTnP7KlLsleRIPlMv8t+/Oxi+KVBWso9KvVuTHN8d1t2w:7Nsx3ZUjyWP7feitM4+mQ+KfWWuRSL2w
TLSH
T123842381837A1D710DC355AC7A3BF5A7D8FA001B880D1F54BDEB6A2A34309E9F99E445
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApproveSplit.vsx

Path C:\Users\Admin\Desktop\ApproveSplit.vsx
Size 565KB
SHA256 cac8776759c68ff269dfea571943a381bf6b6b4f202e956f738e28b8c76e1ba4
MD5 c3e34d903e78c0701c88bf4ac0db674b
SHA1 81ed09e87ce23c6dd5d2ca3cbc4c5ade7c64ad3f
SHA512 3bd1ca65315e5b9e704d0428da7232a9ab4938f5c6c7e62f540400dc950812b78280ea66ecde078dbeb25900c18afee6caa583ddba7cba42c849e637faef0694
SSDEEP 6144:e+RfZuozu9EoSjjH5ORxUnauZT2nfRDOLhWzUpETdBxmEHmRHipBLPRDoG9mCdQa:e+J0E5/Hg7UnauFhqUp/ROZDddQv9kj
TLSH
T1A5C42345E482E79CF507C55C832A757B72EFB19FFBC18B215C842C89E4470C6B6A6EA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockConvertTo.ogg

Path C:\Users\Admin\Desktop\BlockConvertTo.ogg
Size 270KB
SHA256 5d551a31c5d190b26bc766f22cb5ede67c98fbbffc80215bd9c2a3545df27f2d
MD5 ab783817af0d14e0feca70aae99a7a45
SHA1 e5ae52dcd8fe2c62bb28589bf4596c3c7de862e2
SHA512 28286a7b7569b5ce10e38880b7a142b843e656717b0ff9be0da79ae0f54d97c9d6779d1d2fae2ed18153d7e410d5929a0592ac2cc907734058f4b1cee4b1f9b3
SSDEEP 3072:OtEOJ2LYtDLG//uiLHf4Z8m0nQkji5drRAEs0x/u7D3T1XeaH8z101k65FHDXBhW:1aDPOHITgd0GgFK1PnHDDibb7ZaO
TLSH
T1B2442335320453D24CFB3DBB657DA05DA51BDC5BA6B1623380C7A932A30D9BA12FE2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseRemove.cab

Path C:\Users\Admin\Desktop\CloseRemove.cab
Size 548KB
SHA256 c56c63856e406fc9c259e4dfa522f1d559c61a698b48f8b2f01880cd5d4a1e07
MD5 9b353d090eaf5a80bb5200f1057669fe
SHA1 149e50efa15c9711dfc12ea729118754dc214b55
SHA512 38f95b418910a36925836579c1ed139bdd6fd606c179e43cc88461efb2bc27fcbeaa7e56ddfe083cdebd0d550e997b18ab365c75b30c66ec7c2dfb74230f578c
SSDEEP 12288:IJ1Bgut4x45yidqMLjiUYzexLPZ/+xYDr2a6LBBz5mJUWIpvIA4eu2:IJ1JeORVUyLPZ/yYnonzWIpvlvu2
TLSH
T171C42383A859DC53F13F6709C2235ABE962F37F55E49D4A511AB1B233AF838CCA01536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertSkip.temp

Path C:\Users\Admin\Desktop\ConvertSkip.temp
Size 385KB
SHA256 1402e27898faff485f914b55c26afae4f9a5ae209d2280b50c0dcb1b1541bf65
MD5 92f80604b1ba11f2a64d412540d69fa5
SHA1 1564b43782e88b7615e1da8283b3e63e339ca965
SHA512 ccdbf08c328ef6d6dde3924114fc079d73ac15f56be946f5aadc237dbce3f4b9e365957df3af15309ce16105876f269cd881df519bd35d441f988c7e67117e42
SSDEEP 12288:bNg6w2Wh95GVJBriJVn+WVSYV5rimFvn0i:bH5Wh/GzBrivtSQri0vnV
TLSH
T1D4842324B8607BD30CD6DC14F00647E3863FFB568CE6E59E2314A6EBA52F357680A563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DenyWait.ram

Path C:\Users\Admin\Desktop\DenyWait.ram
Size 417KB
SHA256 b7825355a16ba56ee49f8e5b10f8b1fb28c57c3ed6e161ab3c838cb5c15d06d0
MD5 462d9f1a8c6ceddc1122dd582a2bf57d
SHA1 a38a1d797c9aa6c69ef8f60a66efc1c4eb6c913f
SHA512 98b13aed1bf428e3d589ae92eeadd7e39121bae7ccb484a8a9f7a019a6dd6c218b58e8a1372d118e1ef210048c0ef1905104653c186722c787b6949b77998138
SSDEEP 12288:wrYJ/Oq1Cyi0YBv8B0eTbOlSFiwqO7Z24lvgX:wrUWqnVAvxeTbOAFvquZpc
TLSH
T1A094232CB976131B9904EC0F5320CECB6BFBA2AA2A540060DB73747BF59DC1F6561CA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisableUnprotect.docx

Path C:\Users\Admin\Desktop\DisableUnprotect.docx
Size 13KB
SHA256 3339c42f44d9e71810bf3916a8963ec1a0df9133e5ad069fd97140ef7ef45700
MD5 dd8536dfc7cf01f973d28cf3c528055c
SHA1 614f0f4e110f582565cb82fab7578ddb6d5ce5c6
SHA512 8ef1e868ab2a6b0058ddb765c1e4aec845855b8c76238e1522c05346e24bba56f270ae7bf3081f9904d2b32f0f1f5d422975d4de96161329d303e1f72b709a26
SSDEEP 192:CtuRH2z+r3WECCNxtpgoZ22NNs+EReTWNGFHBEM3ZYkqswlkg2R:a0w+r3NdNxt/ZtNNwIFHDJJg2R
TLSH
T16A528D75DA455432EAA3463CF02E12F6F21D21827A56A4C7345FF78E8253E870707A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectExit.vst

Path C:\Users\Admin\Desktop\DisconnectExit.vst
Size 401KB
SHA256 47cec9baa6d62c06622929f3a7d9cd7365390ce508b7297d8dcc84b2f3a6a726
MD5 fe77889a82118c06c1050942f6cd0ecc
SHA1 4b5d4954374be2e82c152746b0b88b4e7f9a296a
SHA512 eea2f7f7c94d60bd7e15c25dfd81e46f4205d6cdb44933a361499f513ec1d0c923df5d4b622293aef2a71ffa4a04a285bc209f69cd71e0fb64806b23b22a1549
SSDEEP 12288:bIaRnsSHJrRCvpvrh6OnIcsc/1zdGVvLtq8PW:bHnPJrRCRTEGsE1zd0v5BPW
TLSH
T16E94236171EF10534AF24DCECEF9EB84E814F0C122152E9E0AD6AF405D1E4378ABB676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportUnprotect.wm

Path C:\Users\Admin\Desktop\ExportUnprotect.wm
Size 204KB
SHA256 5636cf01469ff00d099d7bfddeeb7843be39e05044643929fc14f78af8add244
MD5 00196bca5b5f412a74caed08807182c5
SHA1 ce9f8ac5698dd109992f8a5e2ea2f803fab4f9b6
SHA512 a0190a79315769e52c1f315f7fb02ee5e16bbe603679b3b17e092a0b2b188490d103a232220d615361be5d5b316510e8ec1ea1a3b61b8f8dc505f0c0381f8214
SSDEEP 6144:AFkTdcbldASm0vpFPgZkB8kNXLS4ivq3Y4Bx7/4z84d21z:Aiwx9hFoe5BZivq3PBuz/d2J
TLSH
T13D2423A5E17F4C2AE284F54DE90B1CA4EE170CE219C19ECA368309B1D0A6C79FD1FD50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideSync.docx

Path C:\Users\Admin\Desktop\HideSync.docx
Size 14KB
SHA256 3d6148e47e9cafd8a26e46330c6dee164165e37f27d27ed5367fe3bd6de6716a
MD5 df1cd5670bbf1b23e52b5eb5f7fa48fe
SHA1 ae5f242ee0085d4cf44562158d3320b189595cad
SHA512 2758eb8991b3ce0099a918d3a48cfa5fc8dca7f39722fb3993f46e0f6e1e25f39cf76c22d75a9cc7b2706b46bb8906955fda33905fc85d325c1bfc94aaee4da5
SSDEEP 192:Cta/fS0b8I1GMTRCCNxtpgoZ22NNxjfTeTWNGFHBEM3ZYkqsUN2eiO:a+fS0n1N9dNxt/ZtNNhfpIFHDJS2eiO
TLSH
T1F762BF38DA1A5820FD938C7DE04601F5E12A88819B558997359BFF8D4273F57072F38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportRestart.docx

Path C:\Users\Admin\Desktop\ImportRestart.docx
Size 13KB
SHA256 c4dbc8625b9a318a759d9aebbcfa18678c5e34f6ab84fceca793a3626d13f7df
MD5 58a357a86cccecd8a82e0747962cac16
SHA1 5a42a7bf9c33ceb64961069252b894514175eaf9
SHA512 2910fb520a9c9bd1bdd293520e29f892f488dd3828d9073261f1f728ae00c1a636ccab85a5ef855f66e273c81062514e905fa6f7618c983d554f69cafcb3d731
SSDEEP 384:ar72gWDGDwtOndNxt/ZtNNCKIFHDJI9E+UPH:dvDGh/xllNRItDG9Ez/
TLSH
T1E452AF25DE06F420E623463CE06D12FDE50C5042765AE88B265BBECDD762F5B0307ECA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeCopy.wmf

Path C:\Users\Admin\Desktop\InitializeCopy.wmf
Size 434KB
SHA256 c3b44ea82b7cd97242bf1dd0b3e6142403b8a05dc93bfdcfa0afb779df3ddbb1
MD5 426430009e5d01d556f972ea9bd47a43
SHA1 8549fad8598cc741a92f766fec232ecefa50cad4
SHA512 2c4da1410eed70d9874e5fedf4391fb682e8d1cd5813bd10b554774420e9acac9dd46a40c5419f787dba62e7f11cf217a4b9ba2585e7bc4b0af56a81ec41ccdb
SSDEEP 12288:DhlyrcmGxPzDTjC6GTNxysKeCFpFCr3Z3XhJqJY:9YrcmGx7/j4Dy3eCFC3ZnhJuY
TLSH
T1539423C0136FBB1819DE5D9663029842423BF8A9436F188C47EA236F36CD3571F69E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallSuspend.ADT

Path C:\Users\Admin\Desktop\InstallSuspend.ADT
Size 499KB
SHA256 918b794f119bee25d49cd4351d5cd9eeeab4e0a704c5ed1bbb0e982ab97a72d4
MD5 67c583c485dfa375381959e45fabddcf
SHA1 b202a1e9a46309dd4b39e5649568f8372a965f5c
SHA512 83f2af8e4a2b689de4fd8109b1b625f2af908c91f8968036b0c08437907be1c69d21977f7381de1651caffb3764c6136750fcaf19f065df3735c24a5f21508ea
SSDEEP 12288:g6FhbT5G4d4xmerc9s8ufSe4xvzOn5po414IIa4PNpZwXsnb9Q07a:g6rY+BersufmiiIJccsnbW0e
TLSH
T1CDB423D337357A90251136EA6A0054E8C7E9383919B607A07760BCFBF8578F92CE35E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PublishGrant.xlsx

Path C:\Users\Admin\Desktop\PublishGrant.xlsx
Size 10KB
SHA256 a39e71c2f563c27fc9974fa4b1fb04a116844fe7cf816e706ec05e0e083a78d2
MD5 5368e41dd669a6bcdc268c8a4b806eb3
SHA1 63691bbf8387812bbd53af216ec8976e82ef40cd
SHA512 3f5c0d563e5bf419c38f5c97d10f220b02167557975e81b84ca62d297c3493a9d7d56a1dab47369cbd04e8ce4f0ec6670d1b8ccbc2675bf810860caab73b838e
SSDEEP 192:wc8mVZ1Ib3U54U8aFUlbVvevUqzQXpS0GFc7QFYmNkvaoTa:wc3z1I3o4UxUlM9z6pOFmSYKkvaoTa
TLSH
T11C228D1DC434991AD277D03DC08B44D2937E70E1ABC6AA467A75F68E3A4029703AF3DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveBlock.m1v

Path C:\Users\Admin\Desktop\ReceiveBlock.m1v
Size 352KB
SHA256 00275f9417da5edc1ff0ea34742b88d5cc3ffbf3ae8d79b091b41552365ed6ca
MD5 48374a88b181ac5f3bd2b5235ca55418
SHA1 e6c3a301770ae36b7e2a6d04744b7891e3529e49
SHA512 0cef29b23ecf42cf2b3c6aaaa482760f4d13bd6ca136ff5f1b1ee84c700faedf48d63d0535a67d2020e85f8d404019b13fe38b8bdc0724b13119eedb73e9447d
SSDEEP 6144:uzRCEOzfY3KzuDg3XjHS39OrUrSFrvgUc4BkeHqWJn3g1oKhb+cU9hVTmAVCWr42:uzR38Y6zy2jH5UrS5vgx45KWJ3g7tMjl
TLSH
T1E8742375CFE8D13468F191B7C56DCB9085B68882D5C7512F9A1DC0B60228DABAFB530F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterRevoke.pdf

Path C:\Users\Admin\Desktop\RegisterRevoke.pdf
Size 532KB
SHA256 9f49b09ce5011c15bbce23c23c24894ec1a3afb189d99e863852ffa3bd624ed2
MD5 f2f68f192fdd66f5210fd37d63e53bba
SHA1 1d68f250a1803120a828e56953f01f3cfd0ac95d
SHA512 87973840f5b222a7384b062ef9dcb27fce4c7425fc82345f009f3feaaae044680212d94d84dfb1a405aecc2dab2db887d2d7c13e0cb63c8be4494710f651b7a5
SSDEEP 12288:kii0nWBEcZgIiV5tkYv/FrMvPXS59PCwn9fCdH26AmoT:kii0nahZgIiVzl6M9PCw9q1oT
TLSH
T1C3C4232FA641D6A9A3A251933597B34C58AF443737BB0D22A0F3C261E105E117BAA7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveLock.vb

Path C:\Users\Admin\Desktop\RemoveLock.vb
Size 581KB
SHA256 3850db96118026ca4c99df197cd2cde1bc77decf6678d508d82bbb10186f8b1b
MD5 28d51056959d9bcfaeb0d6cf185280cc
SHA1 2c2225ac9c3ffc751cc94e242ce25229523377c0
SHA512 10933f428dec7659d87ea60999f3f3ca4ca3d4b84e532460fdec47761aa33d4e89171844ce3602d2d26f6c452444add36f5c5201a2321708aea6b65fc14c4346
SSDEEP 12288:FLJ15ag5kxUzy1LnCtdp8k3wUc9V6EI3wmab1DKnsi8S91I8Cx6030SZKj:P15a2kxGy1L2K8wUOV6VzmDKwSzI8CvW
TLSH
T16BC423D9B93EF91E72A09E3FE2C89543EED578208B0B3361584C44DC56CF4B169E163A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestorePublish.xlsx

Path C:\Users\Admin\Desktop\RestorePublish.xlsx
Size 13KB
SHA256 da31eb21b137c2521c09fdfe36e1fa8aa4e98acbe0ca2bdbbc05193d5dced1fe
MD5 5e146a790983f6dcda77baf58a63f7e7
SHA1 383d5f52f463125af89848e93406503cefdb95a3
SHA512 8eb9e2dec7d52a3a2347d5742233f8ba6a2acb5c9e22352e6e2c72b432d603daf4d46105460dc99e6ea41338b58a97e37cd3440c44b13fd936c36d8eabac34f9
SSDEEP 384:wc3XZ0P35q1+zgWUlM9z6pJn/2FwB1E5YeP4TOaof:ww0RqIzgWxWppGwEDff
TLSH
T108529F1CB028683ED72F0C7E819611C17568206C978A6DDB3C21F62B77413AB93973DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestoreReset.svg

Path C:\Users\Admin\Desktop\RestoreReset.svg
Size 221KB
SHA256 09745d899f3414490c9c5e6d64c49bfe3d97c4c72cfafaf84687fd66b838c500
MD5 e476a45fe7d1f4535aedc07e288e162c
SHA1 5a1fe1d13b6f703ed4ae5fc902307b12b109ada9
SHA512 622e83aea98f53cf0a08136438d76fcb3ff8d92c774e461bb7e6d6eb1887599c612f48bc9176a836464f555eefabdcaaeb31e664ae44bd04f316ce6e5fcc6821
SSDEEP 6144:VaJ5RexdjcLG8BMbE54OUAofRylhzzK6eDo:Vs7exds/MbdOUAeRyPfKtDo
TLSH
T1EB2412302794866C6127D47ADF6077CD2E419002669B0A27FB4CFB349FB7C2A2DB919D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevokeMerge.docx

Path C:\Users\Admin\Desktop\RevokeMerge.docx
Size 253KB
SHA256 5393d9c878116596237d4fe738037dc273c0e8dc1c9618a1ec67c0b7ed1f44bc
MD5 44a34bffcaa57c63702a48cd7a347ec7
SHA1 c8923528aaf2c01e655e523591c46febfb936d44
SHA512 8967d9c603fba943ef305ebe73c0943b4d6f424267f996476b2cdd700d4d33066a5450243b07c9f32154bd8ab71f6fa34577250ed37f0e1030f7bcc26c4789b1
SSDEEP 6144:Up6aKx/VGFxR140K/0hmDDfIGZJWKjf+95Cdxlxq:UphKtcfR1BLYJdL+95CdTxq
TLSH
T15C44231ED00800E16238A4932E88F5B1D7BBD53E6CB3129A1B15D27DF71A5D3E29E5F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectMeasure.7z

Path C:\Users\Admin\Desktop\SelectMeasure.7z
Size 237KB
SHA256 a4cb45e8b09ae04ce4a5704531958e324b68d7c85791094b544c2a3aad942e01
MD5 720b9f216662d55d868289e243517610
SHA1 33b715d11c6e6dc53d1f9f3b8c8c1ac17849760c
SHA512 eabe30908ce32ee1680c788b35ab4e95e4c90bb27b172c72920c4f8b58f04ed0927dafcbe4257f15744c0b2f2bf480d24178c8df8807f2fe53f8c7ba98c734d1
SSDEEP 6144:1g8bV8KFiI1I4yyFgBE2MY6zsvAdCxJoslvhRUWU0:1BSFIiUeBE2MoKCnoWhRUt0
TLSH
T16D3422B08DD2B9CACFCCBCB6D10CC0AC7D64061A6F2523984E9D24B09198FF2D9B5D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitMeasure.docx

Path C:\Users\Admin\Desktop\SubmitMeasure.docx
Size 17KB
SHA256 9f96154e450a62b703375af02f1412f8cf58492f22bba95e5e952db97bfd66f8
MD5 0f41474f17582c9db7a19f4dee0fd804
SHA1 f4c6f25ff64fa829705fb79ff23d11a10d709ddc
SHA512 d2bbf65a27474349345173a1feba1554edadca8ee082e5a778ac1662f2f3423873bd21b25ac88cc24ddce369fa433c93348dd17b822541288993ebd6e0087068
SSDEEP 384:a72OK0TftWKy9cYXA30W+dNxt/ZtNN4IFHDJ6hdcQx:7OK0RWKy9XQ3KxllN4ItDEhac
TLSH
T1A382BF39DA174920DAA2067CF21E11F2E12E904237A7F487305F7EAE9676B63071768D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnprotectInitialize.wax

Path C:\Users\Admin\Desktop\UnprotectInitialize.wax
Size 319KB
SHA256 d970d40caf32dd1b54c9086b38f42def1efc06d19c5fc20adbc09a5ba75fe4c0
MD5 78f077e840fb05359a58ef70cc74e4fd
SHA1 dac18f5d7f3cec7101edb44ad2dae288b342a51f
SHA512 faa9edf0d91e08e4d6d30e21ee69417fb4cdf46e29e4b312730936e975a8397c332a754c3acf4e72902752f2f0b51eefeadcf23e5f7492ac5be86e0e146f3ac8
SSDEEP 6144:sxYFS5tP7fEuLelGIQDGDVLtUUUvtpYpBRrY13ikSyNNkRaygnz3piFSpu:uYUHTfD6GIQqHGvfYPRQHoAZiFN
TLSH
T109642313652157BEE6F6DBE1E0797B4D992DF690C33A80B66D32DAB8C170243520CB8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishCopy.emf

Path C:\Users\Admin\Desktop\UnpublishCopy.emf
Size 466KB
SHA256 8b86b5041bd6ff5529e0d3f65b03b3bad4919cd17b5184e4ad5f2011881cc4ee
MD5 2b11fbadb9ae2e4cbaf2e781dfa88871
SHA1 8698511027faa4556f5dc25308ed56aceb896c0f
SHA512 41b910058f863bea40b21e4dcdb10317d114cb384d98eaa482bcb94b3a17c1ba21e4e15d6463636761c872e511ef8879abf3d9b21ed3f1fdefac34b6d9ccdc38
SSDEEP 12288:wbeX0tv5KaQMouSWsxL3rFDCdANr8ZLQw8+5k5b+:m0EvWMon3BC6FYB7
TLSH
T136A423219921C80B6A52302E72F5705D57CF85BA870C0BF89137CAB46EF2F72E15DA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterLock.mpp

Path C:\Users\Admin\Desktop\UnregisterLock.mpp
Size 286KB
SHA256 5363252b0e5be7ad29d458a51be3e32fdaae94577945e7e07fc10e1b9b52928b
MD5 38793bdd15aa9a280cea3bcf3976ed6c
SHA1 768a0e3baa9d5fcddb09159ef7544aa3ff772290
SHA512 dd5328033cd7a2b21b3da774e480f641f8b1f52a7455854fc29c264c626054130c22c9c3a29a925484f01b188a7f677bad3446b59ed713b2256efc1b47bdaeaa
SSDEEP 6144:vZ/yDUvkyhQJHqU1oi3e9MYS0pZAssC9u0Ep761kMX/2VI:uUvkyhQNoXyYr6s7u0Ep7WL
TLSH
T18154237443008AA5B8AB7C999D08B29850637D2ACFF36D09E87D1277179C36A1EF513F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterWrite.wps

Path C:\Users\Admin\Desktop\UnregisterWrite.wps
Size 516KB
SHA256 b355364dd6f2a94653e7c2505c47fa52e7a2e137a6b8fc558e90349895e966e6
MD5 b2370ecbbec07c7c90f142d269fcc418
SHA1 e1c69240e94c4b74f215faf57f1d2f6a8ef98ecc
SHA512 1528207ef16b0ab9d9fa175fd26926289b273ee0c18cb6160297f90292a73255bcb98191d84b75bb9567f0b1b6ee4a4e47006720e051cc6b2a158645402cca73
SSDEEP 12288:2mTms4UGEG2o7AyLN/qlwdvW3RxgFZ2pEJ4cxGMISlBt4qu:2FBUEagCTPuZ2pZxSPt6
TLSH
T14EB423F502C3F216324A2A73F16E246D7807604F993BE40969C6DB00DCBD676A9B697C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UseDisable.pub

Path C:\Users\Admin\Desktop\UseDisable.pub
Size 483KB
SHA256 9b527740b85583b0942c5dcadfa361f502a564f1071542607cbb2231952ea3a7
MD5 0f4fddc57ff15420c052e3c2c9edbefe
SHA1 3cd98501577270460940dd97e52ba7b00158faaf
SHA512 8e25339534bb4ca70f2786c2167903250f1cffac3d12d57bbe79fd8392aac833f6ae40311c8e78b39a9d9aa5f47f0a079090a4ea90d66b69b69f6bb8796aa89f
SSDEEP 12288:9XwRzgqyNkwkmRJLdesvAA/zw9SLE3diT+c1kL4kh:lqGkwNjZesvFM92+Ss9h
TLSH
T18BB4233B44EC4BA177311E094E16890766E474D6306EAB41E1E7CB12D3E79D16CEE2BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchCompress.3gp2

Path C:\Users\Admin\Desktop\WatchCompress.3gp2
Size 450KB
SHA256 4e0e591249626c9edd913c53aaff608daf94b88987c7d5efb74f6df1c0b19684
MD5 4d597f7a708c46a2435fb7f039b649cc
SHA1 cf463270ebc2855ae2421971c858fdd5a6e90008
SHA512 3b3fef6d6515992db5af0d5eff9311bffd24263dc41e6e791aa91369126415c5166c6684213eda6aaafd3e0656185361d153ca6c93ff55d0a741aa6a54d5e82c
SSDEEP 12288:iowSpjmRoBgBT9VmmE2ZaQ6oP7AIU/qoWWMKQcDZobpT:LTkiBgFdZWoP7AIU/qoWWMNcFsJ
TLSH
T185A4236A444B742CAD9FDC5E2C9885030AFD13B423F996D8A343BAD4B1953F21BE9F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchCopy.3gpp

Path C:\Users\Admin\Desktop\WatchCopy.3gpp
Size 303KB
SHA256 4ffcfe29d8164d2d173de7b145e9cdb2ce3ff73c6e96ea4a236304463a69daad
MD5 600d768e783616da78c98ddd8099d595
SHA1 e0ba772f142832713f89faa430a7f9e6b8cbda24
SHA512 0755235974e8dc7135a0fd0e998952cefc61ca06c46f3962a18feb7b655f39fa1410a3b846e49d2ce955f2e9b7a27c80f1afb818efd527fdb456fe2b6a5a3050
SSDEEP 6144:EG8EJrjtko8Ylu/TTyuORKGvOnEYvIsucjW:EvOfjtA/TNOCnEYvQT
TLSH
T17B64237FEA3121E48D7DE6E99D41215FC32B370F0ABD9195D093989B5A817B2F630B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchJoin.emf

Path C:\Users\Admin\Desktop\WatchJoin.emf
Size 802KB
SHA256 cfcc2a54b7c5bb70196423e3070a1acfae6d97e8f82b3cfa75afb0f3df91674f
MD5 0458369d2abae7e1653b7de0cf868911
SHA1 9e73dd864ce5483ed61909a4424588647129c56d
SHA512 e40fd842bd78ad4a08bdf924395bde5a6a932c37d469bd3d38a8dcbfaf8e16e0c914b7909659c7b435203a4f8faeaf9eba15cd48414d1276dacf98bdd9ca57a8
SSDEEP 24576:EGDyPGrEdX9lhTQE0haM9c/JR30O8TjpgixJ:byPGr0vTQE0ha4aJREOc1Lv
TLSH
T1F50523CAD761FD17DCD41D63DA9F23683EA8B019EA3F5C342F69CAE931841843E4A452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchRemove.rmi

Path C:\Users\Admin\Desktop\WatchRemove.rmi
Size 335KB
SHA256 5250608e9c17cc93846add17cb2ef0a0d2304f386ce43363281fb64f4067606a
MD5 63b07c00cc095a8ca3af228a907b0cec
SHA1 e4e9741860dceb75104545b573d4b5dd07b29296
SHA512 75d6007d26292f3f49c52330b91a3110212d75689c573af589275dd187944fa193ac94cc9f1300314edf625736d56a9de5754b931bd3fd04affd3dbf6153230f
SSDEEP 6144:3XTxSU5XUPFWvVdiZs/nk80W92E7V0BJvusKt69ny79/m3ej/I6jITlltVI5SiPy:3XTN5XUPC8Zsv9VdYI0ek6jILIRy
TLSH
T1C57423DBAB45980B6D888307741B8F668C0DE43E173FAB0761ED2BD5422BD504F3A6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acrobat Reader DC.lnk

Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Size 2KB
SHA256 b1de871825c8e85b69aeceacc0a10c4d2cf03d2d6f7f8fcc585e9dfeea65fd6e
MD5 6e367c45815b0d164152db3e5be529bd
SHA1 678357d552f77d123b7ba1b38ecdc092a05bafa5
SHA512 7dec5f44255ce62a377459989bcfb167b6be0900a2c279b7fc6caaf04ee62015af1a84956f6da607b931fc860305dc175f6c264824599eaa41e0a3fad6176b24
TLSH
T16C41C1114AFA0726F2339DFBABF11536AB26FC51A6048E0E0085434B4A71B01E994F3F
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk

Path C:\Users\Public\Desktop\Firefox.lnk
Size 1KB
SHA256 d4ff6f2acfc251ce139f921704bc4f479647d96b2a3a1df4b2f6e86a8d32a109
MD5 5faed45c7e6b88a8403f422973af9e5c
SHA1 4cf849406a076c19d337c465bb2e21ae4f9fb2c8
SHA512 2bfffe1ae06617ffa0e117f6412fe5dd22fd1b488f0b99e26c62db39307dc53e9c059cceb9cfbfc92efca94cb42e0da8afe25b281af925d080623fb201c35d2f
TLSH
T10611CC010BFA095AF1FBC4317BB227739337FD026A19432D818832995E73210992EF93
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 5789a28f25a642b5cb864958ce028dee85c331cb4ee3607db6f7910faa1969de
MD5 a6b6534e11af4130ace29cf4c0c81e36
SHA1 250708ab68b852e6eefce5cfd68e1011454c397d
SHA512 78c96ea7693003cd0b2272faff3629db01fddbb79066d2f9aac4c9f2ed4f5aac34881fb8402d0342458786efa4e4950c83eaf146c537f3ca732a139b58033d2d
TLSH
T1724157117BF90B69F3E38A7AAA7337210F3FF8229914561D408592491CA2A141999FB7
MD5 SHA1 SHA512 TLSH

Submit Download

VLC media player.lnk

Path C:\Users\Public\Desktop\VLC media player.lnk
Size 923B
SHA256 699d8674250729ab87e9f0f09500a952faae54d209a9ea90dfba627474ce7ff5
MD5 ac04ee94a545c369a42a7478b9daee30
SHA1 26b8d38412f9f37e95b8b34293b1640d51b5157e
SHA512 7a103b36ee67cd9846187c0c3de36423c759fe5278e6ca68b8b33d724cc169e3074fa1fef8423dd2c7df816eca678ca70e89356d38665de559c1df6f0069967a
TLSH
T12A11DC023BB32B2AE397C4F81D6213E24F2AF6145B41770D8080194E5D38200EA5BFA6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-255-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/468-11-0x00000240727D0000-0x00000240727DA000-memory.dmp

Download

memory/468-0-0x00007FFA37AEF000-0x00007FFA37AF0000-memory.dmp

Download

memory/468-18-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/468-17-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/468-15-0x00000240727E0000-0x00000240727F2000-memory.dmp

Download

memory/468-16-0x00000240727D0000-0x00000240727DA000-memory.dmp

Download

memory/468-14-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/468-13-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/468-12-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/468-3-0x000002405A2D0000-0x000002405A2F2000-memory.dmp

Download

memory/468-1226-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/468-8-0x00000240727E0000-0x00000240727FE000-memory.dmp

Download

memory/468-10-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/468-4-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/468-5-0x00007FFA37960000-0x00007FFA38304000-memory.dmp

Download

memory/468-9-0x0000024072800000-0x00000240728B2000-memory.dmp

Download

memory/3712-2696-0x00007FFA3C2C0000-0x00007FFA3C3B5000-memory.dmp

Download

memory/3712-2371-0x00007FFA3C2C0000-0x00007FFA3C3B5000-memory.dmp

Download

memory/3748-2849-0x00007FFA3C2C0000-0x00007FFA3C3B5000-memory.dmp

Download

memory/4500-2887-0x0000020FFEA40000-0x0000020FFEAEA000-memory.dmp

Download