861888ac64c2e0d0b2492bed2fc7e6d298e98a3eed5979e50bd83f70f0159e27

Analysis

user interaction
yes
max time kernel
1049s
max time network
1029s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vxnperm.zip
Size 2.2MB
Sample260804-nc4hssvsfv
SHA256 861888ac64c2e0d0b2492bed2fc7e6d298e98a3eed5979e50bd83f70f0159e27
MD5 ced68ce2f1953788f9150cbd52c6bf4a
SHA1 05bdba9f90c3b27b37c0161920a7d8ccd4b040cc
SHA512 f103d053c59c4982f5b5a8e58612672c37337f90b6f4772654a6d41869aa96938fa845da9182e2697628894641c0cec81e5dd249886855459c3482e77918ccb3
SSDEEP 49152:56pq31lOOiTF0AmUxTKMfGICFsdPmj42QklJbMWrE5w1wv+/1tgXpmVAhRSNvi:sWTU0AmUZffgqdPI42QkHM6S/2NEmV8/
TLSH
T108B533CEF3C89F56DE0F2379A15EC1D9A5EE39F41074983C6812280C6EC36958D82AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\System32\Wbem\WmiPrvSE.exe is not expected to spawn this process	2620	1948	net1.exe	144

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\iqvsw64e.sys	cmd.exe
File opened for modification	C:\Windows\system32\drivers\iqvsw64e.sys	cmd.exe

Executes dropped EXE 17 IoCs

pid	Process
3380	PSWOA.exe
4236	amidewinx64.exe
4788	amidewinx64.exe
1992	amidewinx64.exe
3624	amigendrv64.sys
4648	amidewinx64.exe
4952	amidewinx64.exe
4004	amidewinx64.exe
1368	PSWOA.exe
3972	amidewinx64.exe
4612	amidewinx64.exe
2824	amidewinx64.exe
952	amidewinx64.exe
3732	amidewinx64.exe
984	amidewinx64.exe
1256	AMIDEWINx64.EXE
3104	EEUPDATE.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{670aada6-6bd8-fd4a-b240-42b808349488}\SETAEE0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{670aada6-6bd8-fd4a-b240-42b808349488}	DrvInst.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{670aada6-6bd8-fd4a-b240-42b808349488}\iqvsw64e.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\iqvsw64e.inf_amd64_de2cbaa7272d2eb8\iqvsw64e.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\iqvsw64e.inf_amd64_de2cbaa7272d2eb8\iqvsw64e.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{670aada6-6bd8-fd4a-b240-42b808349488}\iqvsw64e.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{670aada6-6bd8-fd4a-b240-42b808349488}\SETAEE0.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{670aada6-6bd8-fd4a-b240-42b808349488}\SETAEF0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{670aada6-6bd8-fd4a-b240-42b808349488}\iqvsw64e.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\iqvsw64e.inf_amd64_de2cbaa7272d2eb8\iqvsw64e.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{670aada6-6bd8-fd4a-b240-42b808349488}\SETAEDF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{670aada6-6bd8-fd4a-b240-42b808349488}\SETAEDF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{670aada6-6bd8-fd4a-b240-42b808349488}\SETAEF0.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2064	sc.exe
4160	sc.exe
3328	sc.exe
1076	sc.exe
452	sc.exe
4688	sc.exe
4236	sc.exe
1656	sc.exe
1992	sc.exe
2036	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
768	cmd.exe
4844	cmd.exe
3156	cmd.exe
4344	cmd.exe
2640	cmd.exe
3612	cmd.exe
3036	cmd.exe
2160	cmd.exe
4556	cmd.exe
116	cmd.exe
1540	cmd.exe
2068	cmd.exe
4488	cmd.exe
768	cmd.exe
2448	cmd.exe
928	cmd.exe
4312	cmd.exe
2064	cmd.exe
1480	cmd.exe
3540	cmd.exe
2836	cmd.exe
1164	cmd.exe
3724	cmd.exe
2036	cmd.exe
4612	cmd.exe
1864	cmd.exe
4760	cmd.exe
4524	cmd.exe
4004	cmd.exe
4028	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4956	chrome.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
2464	taskkill.exe
2064	taskkill.exe
1656	taskkill.exe
2224	taskkill.exe
5068	taskkill.exe
1888	taskkill.exe
3100	taskkill.exe
4004	taskkill.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303158354413819"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}	WmiPrvSE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}	WmiPrvSE.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID	WmiPrvSE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}	WmiPrvSE.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{1F87137D-0E7C-44D5-8C73-4EFFB68962F2}	WmiPrvSE.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
1768	chrome.exe
1768	chrome.exe

Suspicious behavior: LoadsDriver 13 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe
Token: SeShutdownPrivilege	780	chrome.exe
Token: SeCreatePagefilePrivilege	780	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
3948	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe
780	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1732	780	chrome.exe	104
PID 780 wrote to memory of 4932	780	chrome.exe	105
PID 780 wrote to memory of 4932	780	chrome.exe	105
PID 780 wrote to memory of 4956	780	chrome.exe	106
PID 780 wrote to memory of 2740	780	chrome.exe	107
PID 780 wrote to memory of 2740	780	chrome.exe	107
PID 780 wrote to memory of 1192	780	chrome.exe	108
PID 780 wrote to memory of 1192	780	chrome.exe	108
PID 780 wrote to memory of 2040	780	chrome.exe	109
PID 780 wrote to memory of 2040	780	chrome.exe	109
PID 780 wrote to memory of 1244	780	chrome.exe	111
PID 780 wrote to memory of 1244	780	chrome.exe	111
PID 780 wrote to memory of 3372	780	chrome.exe	112
PID 780 wrote to memory of 3372	780	chrome.exe	112
PID 780 wrote to memory of 3544	780	chrome.exe	115
PID 780 wrote to memory of 4740	780	chrome.exe	117
PID 780 wrote to memory of 3424	780	chrome.exe	118
PID 780 wrote to memory of 2076	780	chrome.exe	119
PID 780 wrote to memory of 3468	780	chrome.exe	120
PID 780 wrote to memory of 3468	780	chrome.exe	120
PID 780 wrote to memory of 3488	780	chrome.exe	121
PID 780 wrote to memory of 3488	780	chrome.exe	121
PID 780 wrote to memory of 3284	780	chrome.exe	122
PID 780 wrote to memory of 3284	780	chrome.exe	122
PID 780 wrote to memory of 5068	780	chrome.exe	123
PID 780 wrote to memory of 5068	780	chrome.exe	123
PID 780 wrote to memory of 3244	780	chrome.exe	124
PID 780 wrote to memory of 3244	780	chrome.exe	124
PID 780 wrote to memory of 180	780	chrome.exe	127
PID 780 wrote to memory of 180	780	chrome.exe	127
PID 780 wrote to memory of 1016	780	chrome.exe	128
PID 3540 wrote to memory of 3380	3540	cmd.exe	132
PID 3380 wrote to memory of 4028	3380	PSWOA.exe	133
PID 4028 wrote to memory of 1888	4028	cmd.exe	134
PID 3380 wrote to memory of 2640	3380	PSWOA.exe	135
PID 2640 wrote to memory of 2064	2640	cmd.exe	136
PID 3380 wrote to memory of 3612	3380	PSWOA.exe	137
PID 3612 wrote to memory of 4896	3612	cmd.exe	138
PID 4896 wrote to memory of 4552	4896	net.exe	139
PID 3380 wrote to memory of 2836	3380	PSWOA.exe	140
PID 2836 wrote to memory of 3100	2836	cmd.exe	141
PID 3380 wrote to memory of 768	3380	PSWOA.exe	142
PID 3380 wrote to memory of 116	3380	PSWOA.exe	143
PID 116 wrote to memory of 1948	116	cmd.exe	144
PID 3380 wrote to memory of 3036	3380	PSWOA.exe	145
PID 3036 wrote to memory of 1656	3036	cmd.exe	146
PID 3380 wrote to memory of 1864	3380	PSWOA.exe	147
PID 1864 wrote to memory of 1992	1864	cmd.exe	148
PID 3380 wrote to memory of 2160	3380	PSWOA.exe	150
PID 2160 wrote to memory of 4160	2160	cmd.exe	151
PID 3380 wrote to memory of 4556	3380	PSWOA.exe	152
PID 4556 wrote to memory of 4004	4556	cmd.exe	153
PID 3380 wrote to memory of 1540	3380	PSWOA.exe	156
PID 1540 wrote to memory of 3328	1540	cmd.exe	157
PID 3380 wrote to memory of 4760	3380	PSWOA.exe	158
PID 4760 wrote to memory of 2464	4760	cmd.exe	159
PID 3380 wrote to memory of 2068	3380	PSWOA.exe	161
PID 2068 wrote to memory of 2064	2068	cmd.exe	162
PID 3380 wrote to memory of 4236	3380	PSWOA.exe	165
PID 3380 wrote to memory of 4788	3380	PSWOA.exe	168
PID 3380 wrote to memory of 1992	3380	PSWOA.exe	170
PID 3380 wrote to memory of 4648	3380	PSWOA.exe	173
PID 3380 wrote to memory of 4952	3380	PSWOA.exe	175
PID 3380 wrote to memory of 4004	3380	PSWOA.exe	177

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\vxnperm.zip
1⤵
PID:2036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff6f8ac728,0x7fff6f8ac734,0x7fff6f8ac740
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,15956745596992824000,3591106454309846794,262144 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,13983846941180339687,15726347307240565892,524288 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,4962451125607924119,6347789018606393327,524288 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,17068538914902690797,12278327228822982640,2097152 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,16844787139036811697,5074776503779641788,2097152 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,4012226829655997998,5487572519867845725,2097152 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,4369625578499315381,5967276003295295409,2097152 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,1405746551086418067,14328073720040842,524288 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,17096816122593497313,7863501205320000883,524288 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,5171789322970274838,11192074548255624255,524288 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,12924648852165236164,373501426108828911,524288 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4468,i,17142073976612088594,5945801038085287922,2097152 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4792,i,16648699109443416706,16645809579720207856,2097152 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3416,i,12010135723435599736,16868202893250120323,2097152 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6100,i,11612990909989526047,14453060796750563562,2097152 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3372,i,8466432909642259741,3816373796255667412,2097152 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5848,i,557997801376738857,9446186389881810032,2097152 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,14979103471686760913,3739702662213906942,524288 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5684,i,8286618116812025357,13905570431600865363,262144 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1528,i,17391835413786589043,16758817470861777463,524288 --field-trial-handle=2052,i,6655619155620987665,14860088235449249860,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:3372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4000

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\vxnperm\" -spe -an -ai#7zMap28308:76:7zEvent14264
1⤵
- Suspicious use of FindShellTrayWindow
PID:3948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\vxnperm\RUN AS ADMIN TO SPOOF.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\Downloads\vxnperm\deps\PSWOA.exe
  PSWOA.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\system32\taskkill.exe
      taskkill /im wmi* /f /t
      4⤵
      Kills process with taskkill
      PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config winmgmt start=disabled 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\system32\sc.exe
      sc config winmgmt start=disabled
      4⤵
      Launches sc.exe
      PID:2064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop winmgmt /y 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Windows\system32\net.exe
      net stop winmgmt /y
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt /y
        5⤵
        
        PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\system32\taskkill.exe
      taskkill /im wmi* /f /t
      4⤵
      Kills process with taskkill
      PID:3100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cd %windir%\system32\wbem
    3⤵
    - Executes a command shell one-liner
    PID:768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmiprvse /regserver 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Windows\System32\Wbem\WmiPrvSE.exe
      wmiprvse /regserver
      4⤵
      Modifies registry class
      PID:1948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config winmgmt start= auto 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\system32\sc.exe
      sc config winmgmt start= auto
      4⤵
      Launches sc.exe
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\system32\sc.exe
      sc start winmgmt
      4⤵
      Launches sc.exe
      PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop winmgmt 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\system32\sc.exe
      sc stop winmgmt
      4⤵
      Launches sc.exe
      PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\system32\taskkill.exe
      taskkill /im wmi* /f /t
      4⤵
      Kills process with taskkill
      PID:4004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\system32\sc.exe
      sc start winmgmt
      4⤵
      Launches sc.exe
      PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Windows\system32\taskkill.exe
      taskkill /im wmi* /f /t
      4⤵
      Kills process with taskkill
      PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic baseboard get cat 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get cat
      4⤵
      PID:2064
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /BM
    3⤵
    - Executes dropped EXE
    PID:4236
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /SS
    3⤵
    - Executes dropped EXE
    PID:4788
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /BS
    3⤵
    - Executes dropped EXE
    PID:1992
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /CS
    3⤵
    - Executes dropped EXE
    PID:4648
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /PSN
    3⤵
    - Executes dropped EXE
    PID:4952
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /PPN
    3⤵
    - Executes dropped EXE
    PID:4004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:2944

C:\Users\Admin\Downloads\vxnperm\deps\amigendrv64.sys
C:\Users\Admin\Downloads\vxnperm\deps\amigendrv64.sys
1⤵
- Executes dropped EXE
PID:3624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\vxnperm\RUN AS ADMIN TO SPOOF.bat"
1⤵
- Executes a command shell one-liner
PID:4844
- C:\Users\Admin\Downloads\vxnperm\deps\PSWOA.exe
  PSWOA.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:4488
  - - C:\Windows\system32\taskkill.exe
      taskkill /im wmi* /f /t
      4⤵
      Kills process with taskkill
      PID:2064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config winmgmt start=disabled 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:3156
  - - C:\Windows\system32\sc.exe
      sc config winmgmt start=disabled
      4⤵
      Launches sc.exe
      PID:2036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop winmgmt /y 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:1164
  - - C:\Windows\system32\net.exe
      net stop winmgmt /y
      4⤵
      PID:1948
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop winmgmt /y
        5⤵
        Process spawned unexpected child process
        
        PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:768
  - - C:\Windows\system32\taskkill.exe
      taskkill /im wmi* /f /t
      4⤵
      Kills process with taskkill
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cd %windir%\system32\wbem
    3⤵
    - Executes a command shell one-liner
    PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmiprvse /regserver 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:3724
  - - C:\Windows\System32\Wbem\WmiPrvSE.exe
      wmiprvse /regserver
      4⤵
      Modifies registry class
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc config winmgmt start= auto 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:2448
  - - C:\Windows\system32\sc.exe
      sc config winmgmt start= auto
      4⤵
      Launches sc.exe
      PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:4524
  - - C:\Windows\system32\sc.exe
      sc start winmgmt
      4⤵
      Launches sc.exe
      PID:452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop winmgmt 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:4312
  - - C:\Windows\system32\sc.exe
      sc stop winmgmt
      4⤵
      Launches sc.exe
      PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:4004
  - - C:\Windows\system32\taskkill.exe
      taskkill /im wmi* /f /t
      4⤵
      Kills process with taskkill
      PID:2224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc start winmgmt 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:2064
  - - C:\Windows\system32\sc.exe
      sc start winmgmt
      4⤵
      Launches sc.exe
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /im wmi* /f /t 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:2036
  - - C:\Windows\system32\taskkill.exe
      taskkill /im wmi* /f /t
      4⤵
      Kills process with taskkill
      PID:5068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic baseboard get cat 2>nul>nul
    3⤵
    - Executes a command shell one-liner
    PID:1480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get cat
      4⤵
      PID:1048
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /BM
    3⤵
    - Executes dropped EXE
    PID:3972
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /SS
    3⤵
    - Executes dropped EXE
    PID:4612
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /BS
    3⤵
    - Executes dropped EXE
    PID:2824
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /CS
    3⤵
    - Executes dropped EXE
    PID:952
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /PSN
    3⤵
    - Executes dropped EXE
    PID:3732
- - C:\Users\Admin\Downloads\vxnperm\deps\amidewinx64.exe
    amidewinx64.exe /PPN
    3⤵
    - Executes dropped EXE
    PID:984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:3352
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:3544

C:\Users\Admin\Downloads\vxnperm\deps\AMIDEWINx64.EXE
"C:\Users\Admin\Downloads\vxnperm\deps\AMIDEWINx64.EXE"
1⤵
- Executes dropped EXE
PID:1256

C:\Users\Admin\Downloads\vxnperm\deps\EEUPDATE.exe
"C:\Users\Admin\Downloads\vxnperm\deps\EEUPDATE.exe"
1⤵
- Executes dropped EXE
PID:3104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\vxnperm\deps\i3782.bat" "
1⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:4612
- C:\Windows\system32\pnputil.exe
  C:\Windows\system32\pnputil.exe /a iqvsw64e.inf
  2⤵
  - Drops file in Windows directory
  PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1064
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{99c08ad1-be59-b547-96b2-064c0dd2bebb}\iqvsw64e.inf" "9" "4887e6b6f" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Users\Admin\Downloads\vxnperm\deps"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 28eb10ca2a86092ccdfebd933b7b4837751264d412ff28aeb38bf2b82043a027
MD5 252052b036a934ab6a8c5af8927494ea
SHA1 e38286f833e5edd6d872034ecfb944a14ddd711d
SHA512 4c8490bd8eb3c378763cd0027beccb90b236e1a866597bcf54caba427f074bb5127628c34e8b36890ed9052e8241b53dd912f404cf2f54571038d076bdd9ca7b
TLSH
T110E02B99C821FC275CFD471D50540646EB5113571760846F363C91188FB066B4285DAC
MD5 SHA1 SHA512 TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 81KB
SHA256 07e8b7f6011c1ba8b8248c36216f7b80e814c872609115b73f2995adde07b91e
MD5 6c940674500f3c2b95ee13333a5c8ed7
SHA1 baacb500d3dc6fe3b616175acae3ead350de9f36
SHA512 923fcc59936d654ace9c1fdb4aa387d991f8176b09a2fe9e696bcb420224d22df9a096f113d00c9fc614e3303fc811beabf9a40130175b3501e55dbc9b290d33
SSDEEP 1536:EHQXHVH7y2rGwOeukPjZRLifG9+cRBI6ZiXyGtrasRdX0duNsqpK89:fXJ7DyTqjZ5mgI6ZiX5RdXIuNq89
TLSH
T1A783022ADBE56027B024CF1900EEA285142AF42F575A5725B00E83F2E5AFA97DCDF453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 57dceb6188f0c20509a7687eea8b39425f845a53f0efb97677d0acd5dfdac126
MD5 8c6877e5e6149aa991e71e69c58ac1f1
SHA1 d7147090e4ce2192b3b0537e6582c1beb2cab573
SHA512 61158d358d5d6697b23436068487c402fde93bf0e3778ef062d2ed663b53ad92599cec0ab7b7344a0660567486a5452fecd1ecea4921ec1e006562839a0d253d
TLSH
T187311FE105A19676FFBF1E395BE11C117870159861C33ED154D63AB858167E1FC1056C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 a4f4bec774237e9219a6eda14b4160c3bc10ac934c553b2e20a4e56fc7660ab2
MD5 f912649d57a75f53540ca8c7c58e9edc
SHA1 6e7b852f69c8d9e6e637f96c9a80d441c2759889
SHA512 d9ce3c8e365f35a8662342acc907d9525c4d68990aef70d32fd0f9faa1a593fd07082eaad505fb5678462269cae75cf5d7e0d773adf77909e4735a10a80ba39a
SSDEEP 192:DIbgPjpBSJpaIsqp1gB0JL0+1oP7QRJyrci64nVeJVK:DIbgPjpBKpaIsqfgB0JL0+1oPkRJyrc4
TLSH
T116F16BF787E49A6DCD2252F0AA152F1FCE2E0954521C3C2AC9E4AF5B93E1471E301A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 78f632cbdba3d9ea5b527d55c6f6c452dbaac2691af00bcaf9a0e8e596406135
MD5 031d66d45b637a0e5ff5d72421db5287
SHA1 ac507c558e380acd00dba6cc645d59de1941b7d1
SHA512 2a4b4f9af2f7ee5d013395206563992ea8bf10e48c863bd3be9c041bb92d6f37d45f437aa45409181c17face2a653d2ac9e0ccc205f433d57c02ab08281d7e08
SSDEEP 192:D0uw0LG5xJdJ/eaIsqp1Ed0Mn05LA7QRJykci64nVeKY4jhTj:D0uw0LG5fd9eaIsqfEd0Mn05LAkRJykb
TLSH
T1FCE1ACF787F49A6DCD2252F0AA156F1FCE2D0914532C7C2AC9E4AE1B93E1471E241B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5f958a6a7f3dec25b173dcead5694924c3f296eb537e851e3972db614b8589bd
MD5 52104cb364b76cbb02acd08ba3a668f4
SHA1 0b3110df8169300f159845ee95fb4e8343b811c1
SHA512 c255b382ddb71db120a15088a1997e874bf99dfb7e345fad426f928dee5b2dbd531c026cd69fc186e7adb9c2ee9a47bf5255fba7989132ebc9024ef30f2d081d
TLSH
T102417CB3C7E8867D890156F4B7152E1FCE290E24536C3D5AC8D4AF1F67E28B5D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 0e87fad39e5bbbedf51705adc98f93c867cb6ee356990355494ae59b3482e32e
MD5 90e0750d2f7a0afd17fb323a461cd593
SHA1 f01438b9b029f495ed08bd50cf2a2b642060854e
SHA512 6c7e92d2f9072c7b4a4c22965c0690fd968efc29f0d607a945f74095b6d66804ae5e695d0a0a24dc5f6f96cc58408d4ec76362a9d17d612231409e77fbbd0f55
SSDEEP 192:DIbgPjpBSJRJjaIsqp1gB0JL0+1oP7QRJyrci64nVejYEj:DIbgPjpBKRFaIsqfgB0JL0+1oPkRJyro
TLSH
T1C7F16CB7C7E49A6DCD2252F0AA152F5FCE2D0954522C3C2AC9E4AF5B93E1471E301B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 bdcaee44ed41fc9f9c3e726e2c1e5d083da23ddfc963735651d9a6204f8ee5a5
MD5 1a467297c1accf854f38b70a723fc289
SHA1 1fd564db0f57027ec5b4ca4d2a8868994e1cf8c0
SHA512 a60711c587ea59df7cfdde0d2142d0a8a6d6be7467251832911225f88e27b1da87d961042d5b6a1f5b91e5053e558ed8539958cde1eb7158d76b2ca298fa44d5
SSDEEP 192:DIbgPjpBSRaIsqp1gBoF4JL0+1oP7QRJyrci64nVg:DIbgPjpByaIsqfgBoF4JL0+1oPkRJyrk
TLSH
T1D5E16CF787E49A6DCD2252F0AA152F2FCE2E0954531C3C2AD9E4AF5B93E1471D201A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 019a3f581e98cdaeca913902cbc9d3e3dda6724a646a975d3bcc0cb4a7cb4f1c
MD5 6f7b03b0b8df2d313fc3f7349b9ceb58
SHA1 82c2e9b917b29f3204a5b2f244f76b49579b7014
SHA512 b8043cbda03ca51d72a83dfd45abedde575eaee16f8fca2c064a6f2c2a53fb3cd630f629cbf2f44c7f44c7a9af28bf0bd21b2bb6d439889e0d13a4bfbade8d2b
TLSH
T15741CE638BFEB85B246908BB0F45BD091C79B4390791E4F5EFA6916CB0904B31B12077
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cd873e288e0d5fcc083fe599feebda9280a77271908ddbf8cadefb766a6e5495
MD5 f353b9b6e409da4c27812c86ab9e10c7
SHA1 03f69c91cd16fc58256e41bd74411924f09d10c2
SHA512 08e2160603f96b261a328b3d648df4ac42662e68b38a900abbc6b76ea4724c86c5ad21da09a7cdbda451039f063b0203e41526226a18e1fa533f851ff1967c8e
SSDEEP 192:gRBaYaxOK8DPjv7AhAPRp2l9qHsb+WNnfE0qr0/iBkw7t+VyIsnAUgtaJ:gRBapxO7bk8Xmkw80UHx28
TLSH
T17D42B52EBA14697B9CCAD329F9163B53D7F5203921942E84DAFC9A2C18E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 688901669d675453141525c9e81c7a5f3c7f7d4ac2adc6ec1f3b2c75a03e4881
MD5 40dd5c5e25f39f3bd457b9c2927768d6
SHA1 b3fec2e80c56000c27a270a3ab283b3cbabf571d
SHA512 3aee21eb98b46370a9ae65668355ccc3a90d55e197ba918c541c6e32985d0c26c113a21f36cdab71d22b002542a27453e9d0cb11a2f5e8325974b38482cabf43
SSDEEP 192:gRBiPaxOK8DA0jv7AMmPRp/se9qHsb+WNeFvM1fEUy5ear0/iBkw7f+VyIsnAUge:gRBiSxOU0bkPX3kw/CXeEHr2e
TLSH
T17B52D72AF9106A7B9CDBD329F9157B23E7F2203521942E94EAFCDA2C15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 51cafb08db727d190a5cd969fa163e81372cc2a2907b1591cbe05696c58fa1d7
MD5 07a783e86e9dd88036d80225b992bed3
SHA1 38620e7f63c8322dbe3e20ca2573952f071a6804
SHA512 2c3cdb479fbae4349907bd1089dbe54c7937632352fcfa9a07c0962aad3a3b030137431334502f340fc3b9e8acee6c6dd0977fccd8fecb274c5b9757c43a3efa
SSDEEP 192:gRBaYaxOK8DA4jv7AhAPRp2l9qHsb+WNnfE0qr0/iBkw7t+VyIsnAUgtaJ:gRBapxOU4bk8Xmkw80UHx28
TLSH
T18A42B62EBA14697B9CCBD329F9153B53D7F5203921942E84EAFC9A2C18E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6a557d3414aa5cfd2ba98bf5f8cc2373acc70875785a86cb7e035af2d2fcdf41
MD5 3e0a0cbe85a9762df0463be91d51b7b6
SHA1 0d4a841072e9a0ff73f9854a54a707cf320ff5de
SHA512 0b53f1ec44a930bf6ca26460471cae334424f5c3ec8361a208f262c0e2092b774236cb56eee19376403d4212e5fbcf8e3004df02613591a93ecaf8a7206413d5
SSDEEP 192:gRBaYaxOK8DA0jv7AhAPRp2se9qHsb+WNnfEU0j2br0/iBkw7R+VyIsnAUgraJ:gRBapxOU0bk8XOkw832PHt2e
TLSH
T1B852B62EF914697B9CCBD329F9127B53E7F1203921942E94EAFC9A2C15E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 122543bc69045035eefd1a3c365aad81e81d5fcd646fdaf5b3fec97fbdf6cd08
MD5 9e84e864724595ac8f7eebc392e3e6c1
SHA1 c907bb8a732f4791b033fe4de48c11edbc4d922d
SHA512 1bee0fbc18fbd353ce655b832793c96cb8ed3dc8a5183dd32a3a5ba29e1c644abd9a26e93e1cff4a57c4c5457847e9010fe1beaa59a3a894efe5e84cca195b29
SSDEEP 192:gRBiYaxOK8DA0jv7AMmPRp/se9qHsb+WNeFvM1fEUy5ear0/iBkw7f+VyIsnAUge:gRBipxOU0bkPX3kw/CXeEHr2e
TLSH
T16E52D72AF9106A7B9CDBD329F9117B23E7F2203521942E94EAFCDA2C15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 33a305374b96b2b31abc9058f922de7c678748f8b5a4a510d0355c27a2b8bcf5
MD5 5caf1545dce1606597a50979bbd11e47
SHA1 d790d59f03181af75d5926125a1581da11d4344b
SHA512 332b5c299acd9b0d521e25a70d425a858f53d88e1c0877eb6a1294bab41413ae392fa6f900c956104d33ee1d3bb0e62bae92abc1f57dd9bc063ea51ee3dfcc66
TLSH
T106B0124081025501C06306F431421488B1549F10A70A171243E06A63C826350C214150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 9cbe4dd81a188740cee9e1a3514fd0beb822663ce56d3f8eb8701e8012748639
MD5 d13b24183d30167c2d5b55120d726132
SHA1 0919579240192be4f3d92d77d5ed75ee5ff34c88
SHA512 f369e1c93960efdc50246a307ab11f55505d646fc2100d75b42363bef96f4bee9d208a5bb19f77160ee43657e9db89a33f9a7a21228fb1d683356b1d3bfa161e
TLSH
T13FC01201C8027451D04B03BB196298BC7624AF64C62A239C62F43D27EC3C131C128399
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5930ea.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5930ea.TMP
Size 96B
SHA256 ce5c536f22fbec913bfda01d5361aa01d1ec70699715b77f063d675ff394402a
MD5 0e58e82b9414e502218ee80233d4aacc
SHA1 ed712704d097b64eedc62a04d8ba88fa408b3876
SHA512 2a954c75d4432413eecd7ac856833bf11fac725a32ee8364092bef9d24b387abf44f1c96a2dbe987abe8bbd3a409c8f6d608e58d7434b6cb5fd04ba4f4026e85
TLSH
T148B02200C0023302C02303B0288880CC3030CF2CC303222383F02A32CC302F0002C220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 9f935ed9814d26aeb0cd68765532f73b815d3e00cb214d88e1d7a4c03e955432
MD5 b434df15bbe593e7720db4d61fbe82bd
SHA1 24812e7897b189701cf3271754239c82433264c3
SHA512 98893bbe44a8f7f7c1ecf367fc77742a98d975990163f3b1d5a766720e508b7ad61b89c7a98fb8b4d072c0bfec11f42ec9c5520a738747d8233e7770d0933213
SSDEEP 6144:+XwItyezjAG8tlswm7Rkm1tYpBeh2BAob:+FnzcbtlsD9oBGcAob
TLSH
T1A334123B5D35CD33E5AC572DA04E360F2DF35E97CA15EE9B8DC82A043BAA68E1905530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 f6d9184469ab697c014c1deb43886a62bed46be240e0f8d4144deca180bc1bf0
MD5 2934f8d2c46d3cff6728ada13ca2b64c
SHA1 2466e1e3361b69979f453c0f3e583978cf4f1cf4
SHA512 b8602316d469127ac6d41acded00eb6459834702f6e3e5f3501fb4ccbca97468b22ed24b752d68aa6a0faf316b0bb53a25bea407517573d5c081e2b24a993d46
SSDEEP 6144:uXwItyezjAG8tlswm7Rkm1tYpBeh2BAob:uFnzcbtlsD9oBGcAob
TLSH
T12534123B5D35CD33E5AC572DA04E360F2DF35E97CA15EE9B8DC82A043BAA68E1905530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 19f7860ab03591aaadecf2b5bfc3d430970d5274d87ea84c06d4f92c362fb1fd
MD5 5a1dec3b9ed97c428cd6454f9a14975d
SHA1 5e49d6b0032bd23ca64efaae8394a11397ad7cde
SHA512 42da86b9ed7db09b4bf3100cc17f57a1bcf2dc9a04626310f89be8006dd31af719ab868f8834d9e31158f4d2075439c34cc2f57cf3d84372c484b37ad620dca8
SSDEEP 6144:u6HItyezjAG8tlswm7Rkm1tYpBeh2BAob:ujnzcbtlsD9oBGcAob
TLSH
T14934123B5C358D33E5AC572DA04E360F2DF35E97CA15EE8B8DC826047BAA78E1905630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9e0ece6346f7af13674843426e23cd1f5f50c2d2a57e94df94215355cf8fa095
MD5 f24b0de820e4f29b13299b5805bd2785
SHA1 40ac33f66d134c52b030bb49e46e7324a2829965
SHA512 4c27e1b9ac625a5dc5f43200225a5d01b7e606222436b934096970ef8545af412c18c196266a46aa3ff5fd7184b94f98f40fa6154a8ed074ccd4d623b913bc2c
SSDEEP 3072:AEGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:gm7Rkm1tYpBeh2BAog
TLSH
T13FC3023B5D75ED3B5CB5A74EB08E0B1E2EF249A6C930DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 f30ff441f7219b47e684ca4054b00459cff10926270bf2b4966da3da35f5eee9
MD5 2fe9a799e46f706b2f4d577e617860c5
SHA1 7b59c5653cb2cb42540ed425cd4cc5a3401c1d0c
SHA512 7e0ac191e07e68a7a2001a60626f1da4b306e41f2f33f25b7bd5e4ff3baee3bece5885c7ddc333ab3f5ff4891f42fc18e149ae710213b270797573c9e2d9c10a
SSDEEP 3072:riYI27T0rlM+fzj07Z4sSmmeaoObosuIGm7D5Lk17ox1tIpud63U8BehbCBi9fTU:uYItyezjAG8tlswm7Rkm1tYpBeh2BAob
TLSH
T1F634123B5D39CD33E46C533AA04E2A0F2DF34D97CA19AE978EC466083BA67CE1505631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 f3f3dfd6ba45f3468450e431a41b0f83fce480ab58dfded60415c84802fd6bfe
MD5 c0bf752f3d5e076e77cf6c118ea02825
SHA1 229a45be28697b855c6a842557508e9442303749
SHA512 5aa0f5f1dc08b713eab6fe1c222ed70ef9d93696f2f2d80c0bcffd0ed3845d454a4d191cbaf918835a36b0286be462cd0ae3722088591b7a33365f786a9a65a9
SSDEEP 3072:6iYI27T0rlM+fzj07Z4sSmmeaoObosuIGm7D5Lk17ox1tIpud63U8BehbCBi9fTU:vYItyezjAG8tlswm7Rkm1tYpBeh2BAob
TLSH
T13334123B5D39CD33E56C533AA04E2A0F2DF34DA7CA15AE978EC426083BA67CE1505631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iqvsw64e.cat

Path C:\Users\Admin\DOWNLO~1\vxnperm\deps\iqvsw64e.cat
Size 9KB
SHA256 bd4f42c45db35f9b042d610fab4c9810132dffea07265422f360b342b4a7790e
MD5 93e365f71c2e9c8d61c64f2783fa0868
SHA1 b3662eecbeafe5af9ee3be504df77cbd99fc7c36
SHA512 031e615503633fc643dd72f44eeee7961361945a5ba4e6d2dc0ff184b38f7e2b65a5e9ab53315b40e895a9d7fbce9a91f180bac6738ee681744f6301ab0c5838
SSDEEP 192:Qt83i2oJCuvyyKwnsFWQF7aCOJxZAqnajKsQcLIm:cdrnsFR5aCOJ/AlGsQcsm
TLSH
T1DC22D7E24A6C54C3ED53286043A8E567BC3D6BCB2C50856D31AFE7A51C83BC5E70856D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vxnperm.zip

Path C:\Users\Admin\Downloads\vxnperm.zip
Size 2.2MB
SHA256 861888ac64c2e0d0b2492bed2fc7e6d298e98a3eed5979e50bd83f70f0159e27
MD5 ced68ce2f1953788f9150cbd52c6bf4a
SHA1 05bdba9f90c3b27b37c0161920a7d8ccd4b040cc
SHA512 f103d053c59c4982f5b5a8e58612672c37337f90b6f4772654a6d41869aa96938fa845da9182e2697628894641c0cec81e5dd249886855459c3482e77918ccb3
SSDEEP 49152:56pq31lOOiTF0AmUxTKMfGICFsdPmj42QklJbMWrE5w1wv+/1tgXpmVAhRSNvi:sWTU0AmUZffgqdPI42QkHM6S/2NEmV8/
TLSH
T108B533CEF3C89F56DE0F2379A15EC1D9A5EE39F41074983C6812280C6EC36958D82AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUN AS ADMIN TO SPOOF.bat

Path C:\Users\Admin\Downloads\vxnperm\RUN AS ADMIN TO SPOOF.bat
Size 318B
SHA256 dff0fdf728408791b0fd6505e800a7ab75101d973c921c77ea334ec63fdc36aa
MD5 60972c42004f8c1fb66bfdc828d061cd
SHA1 4bb0dfc693820dc04da065ceb00aab1cdc82dcea
SHA512 0715ccf5eb85ddbdeb8e63357b32d38808f7f09046d8fa71d1392a6fb8c27a30fd016824e89afa5fb882bed42220dcc32b891a89adbd967d084d55a7e3cede06
TLSH
T162E02601308A72114CB0489A1FB9A8AEDF4F826B4127AD14747B80395E6924CA1E80C9
MD5 SHA1 SHA512 TLSH

Submit Download

AMIDEWINx64.EXE

Path C:\Users\Admin\Downloads\vxnperm\deps\AMIDEWINx64.EXE
Size 377KB
SHA256 47c16703fa7df006f9559fca8b1482b4c59111017a0530c1edac3caf0bdaaf39
MD5 6dea36ae7a414e376b00829e16da52e0
SHA1 5ddb6b72867002a03f26aed612f320e82598464e
SHA512 f61f6a661e816ff72a91849c8363dbbbadadc24d34c25072a3cbb3be16ce9a540c8f86ae2c031fc97e5484944d8957cd7a7e3104dee2a2091b2b344422e30487
SSDEEP 6144:u0lLNvLmP/LgoYG5HViOlHH7qKPUcky2FpwhPa24UW3Plqr9hUURgr:lzmP/Lgk5HViOlHH7qKPfky2FpwhyV3X
TLSH
T10084F66AEB9220F0EC77917C88922306FBA075684771D7E7B7AD450A4F337E4A939710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EEUPDATE.exe

Path C:\Users\Admin\Downloads\vxnperm\deps\EEUPDATE.exe
Size 4.5MB
SHA256 bc195aac847d8015d875562be929804e59bf0c0cdab5407a06f3359be98641a2
MD5 4325420a99393a6ad6044818ae61f945
SHA1 cbe636eee83e6a016d0ed65a09dc88a5cb8398a3
SHA512 30a7456f6c55d957a9bdf9ca1f9c2fb76f6144015f24ccfcb5168275996091c425dd86e08b6d0b4940ff63af6876b1393aa8926bef62a880a5ff1b9551f5a0ae
SSDEEP 49152:xVBQSmh7Dtk/bX5YuWI4zAXFBVTf9UnoGvlG0unS9w:9yD+/VYzI4zA1BRf9FGvlG0unS9w
TLSH
T1C626F957E7B321F5D4BAD1345143733ABC7274698338DBD79A808A1A4732BE0A93EB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSWOA.exe

Path C:\Users\Admin\Downloads\vxnperm\deps\PSWOA.exe
Size 397KB
SHA256 8fbc5416e6ed54acd4e917b53adfab4ce22f84980211e6b49b98b4758b7bd462
MD5 d30a3ee3eafd3f37015366868c09e725
SHA1 505c1b4e2f4fbcf3707f0bd50148e722377c5e40
SHA512 4d76cfea7601a8c799ee7e9837b6798c7fd4b0967c268c85226ac94ae7a84777fdb69bd88f5d5a51fdc77b9d225b62c4017e0f7b0e095681fe426809580e4afa
SSDEEP 6144:IR1r7t5NyBRatI32wlSlvtBqmG9AQ5/v/I:ITtTSaM7lUtcAKw
TLSH
T129848C09F99145F8D9A7957889220646EB31BC4A43B0DBDF23F849951F17BF06E3AF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

amigendrv64.sys

Path C:\Users\Admin\Downloads\vxnperm\deps\amigendrv64.sys
Size 36KB
SHA256 811e5d65df60dfb8c6e1713da708be16d9a13ef8dfcd1022d8d1dda52ed057b2
MD5 9accebd928a8926fecf317f53cd1c44e
SHA1 d7d71135cc3cf7320f8e63cefb6298dd44e5b1d4
SHA512 2563402cc8e1402d9ac3a76a72b7dab0baa4ecd03629cc350e7199c7e1e1da4000e665bd02ac3a75fd9883fa678b924c8b73d88d8c50bf9d2ae59254a057911e
SSDEEP 768:cBOmh786zi+NqkO8Ouwn3uivOyiRZSFInq1os29zjTUD:cXi+NXwnecOyiaFInq1lCz+
TLSH
T1F6F27CC25B7824C6ED97993082E8D673BC71F6A61B1083EB01B0D0251E93FD16B3922F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i3782.bat

Path C:\Users\Admin\Downloads\vxnperm\deps\i3782.bat
Size 5KB
SHA256 5d1c7fc83a9b03ec15af37328df37e71e222d0433dc513e01b6ca0e161457e07
MD5 b3c2e53412fa8d74dd0a9ec7811f16b9
SHA1 3d1f49a3fabd821967a943d353444bb3d08f08f5
SHA512 a55ddec20d0658e260190b236cf0692501b94ce2ca0e32130f5a613bdad2fd9171574df8e875df0ea61709864ae062f57960676f8e0f278da2e79b65e1097498
SSDEEP 96:3UmsVWzs0hTky9a/Pijqp+akPijQBMMwVgsFgH4VfFtK6zoyN7t:EphyOYtfsFga06zRN7t
TLSH
T14BC143BC6ED0A231DE9AC716AE2650C2F366D1B60126558C30DB90A8F60747C737EAF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iqvsw64e.inf

Path C:\Users\Admin\Downloads\vxnperm\deps\iqvsw64e.inf
Size 2KB
SHA256 4af639c5c9f9106f73985a8c53a916d73c78a3bf67b450eaf4b06387129c3975
MD5 9fc2029a6ebf64e1af9f656b82fdea1a
SHA1 20c6e51b5dacde55d80b0873720f987d2593c47a
SHA512 1ccbb5c488e7967baadca45d241f5d66ea1559d886662bc25c86b91634a7639416d5a8777f1e07a1b7d3cc638b857d32a52ef2960e935cb03c682abe4827dd02
TLSH
T1D141CCAD19E34E49767B34A193A3CAC2F210200609443D8D345EF4A5AB3ED9DD3659BE
MD5 SHA1 SHA512 TLSH

Submit Download

iqvsw64e.sys

Path C:\Users\Admin\Downloads\vxnperm\deps\iqvsw64e.sys
Size 61KB
SHA256 a1c886d0e3b8dae271940d6c366f10fa54aff9582ee571394d7b0ead60f9c609
MD5 a04fa610c631055c3c7b11df5887fbab
SHA1 b37916fb4a764aa82cff5faba997437d3d93fb30
SHA512 4fecdb2de280cd251421e3f09188b62fa95732db19488846677e75277f0a271d06f5ae2d38b62b65b359c03d715ece14cc5ff11aab0f7c4520bdd10904740f92
SSDEEP 1536:LfeG1kQWHBqSfyAXy5IFCxxoPt1Q+8iAS2w2zB:LfwFftuQCr5D3t
TLSH
T1255349C72BB420C4F8FB9575869AC66BEFB0B19A17324BEB06A5C0550E533D1873D683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MAPPING1.MAP

Path C:\Windows\system32\wbem\repository\MAPPING1.MAP
Size 207KB
SHA256 0bc46d8c221bbcfe525f2f7584417ce9d68303eb902695b36ca528eda27c3fb9
MD5 dd1920aa6ac1f7440d8246505ca1580e
SHA1 89166846110ff7e6e32827c3d4ce5123110a654f
SHA512 3441e4e07e66bbfb669951b7100162906c863ba0e9854b9ecdaf0cac77e67d26deb4ab5b471ce35303be9919c07c6f486c491df7a80697717db23bd3ad077578
SSDEEP 3072:3MoiJqVm99yEL7m8MAhSuX1PQbKmRaY6umNLir9a:3MJMVm9Zfm/AIi1PpY6umac
TLSH
T1C524E54BD8C0FF57DDEE0C72869A87710AF6CB4F3F51860B222992643912712E6DF259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download