f4a41f863b13fa4f9efced8295edeb2a33cf9bfbc1475b1ac73c18109e1eb92a

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PleasureCraft-Mod-Fabric-1.21.1.jar
Size 737KB
Sample260804-p724wsxtew
SHA256 f4a41f863b13fa4f9efced8295edeb2a33cf9bfbc1475b1ac73c18109e1eb92a
MD5 8d44bf359503f1857c47efcb4216a974
SHA1 4e70e26c77ed7c4e289e650cb9fca4e9da62d498
SHA512 0a90bed0d11d5d56f7247aa3a1ef3d367b0c7990f42f313933ff6ed4676ef2c220b1290ef891befe8506f96425a57916030f7e8ed0a25ba7a8b98a9897a8beb6
SSDEEP 12288:bdQ2I2MSwBbtK6P2VEaa7ED/tZXUhfEiD4t/i+ACjDaiIdcXdsFLZM+UTJUCoKHk:B75oX2Z/tZXUhfEAr1g+FVMFUBK9i+Cl
TLSH
T137F4128B79DBB99DDC5B8C3244A9C4831A2489FCC75261BF69A08C845FED8D71313A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
57	3836	powershell.exe

Loads dropped DLL 2 IoCs

pid	Process
5148	MsiExec.exe
5148	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3100	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ab511af7d208ca820000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ab511af70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ab511af7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aab511af7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dab511af7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303219689300335"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\node-v26.6.0-x64.msi:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3836	powershell.exe
3836	powershell.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
2384	chrome.exe
2384	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe
Token: SeCreatePagefilePrivilege	4744	chrome.exe
Token: SeShutdownPrivilege	4744	chrome.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
5216	msiexec.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe
4744	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5804	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 6032	4744	chrome.exe	86
PID 4744 wrote to memory of 4464	4744	chrome.exe	87
PID 4744 wrote to memory of 4464	4744	chrome.exe	87
PID 4744 wrote to memory of 3100	4744	chrome.exe	88
PID 4744 wrote to memory of 592	4744	chrome.exe	90
PID 4744 wrote to memory of 592	4744	chrome.exe	90
PID 4744 wrote to memory of 2688	4744	chrome.exe	91
PID 4744 wrote to memory of 2688	4744	chrome.exe	91
PID 4744 wrote to memory of 1004	4744	chrome.exe	92
PID 4744 wrote to memory of 1004	4744	chrome.exe	92
PID 4744 wrote to memory of 388	4744	chrome.exe	93
PID 4744 wrote to memory of 388	4744	chrome.exe	93
PID 4744 wrote to memory of 5160	4744	chrome.exe	95
PID 4744 wrote to memory of 5160	4744	chrome.exe	95
PID 4744 wrote to memory of 320	4744	chrome.exe	96
PID 4744 wrote to memory of 6076	4744	chrome.exe	98
PID 4744 wrote to memory of 6076	4744	chrome.exe	98
PID 4744 wrote to memory of 5012	4744	chrome.exe	99
PID 4744 wrote to memory of 5012	4744	chrome.exe	99
PID 4744 wrote to memory of 4648	4744	chrome.exe	101
PID 4744 wrote to memory of 5776	4744	chrome.exe	102
PID 4744 wrote to memory of 5312	4744	chrome.exe	103
PID 3836 wrote to memory of 5004	3836	powershell.exe	104
PID 5004 wrote to memory of 5172	5004	csc.exe	105
PID 4744 wrote to memory of 2984	4744	chrome.exe	109
PID 4744 wrote to memory of 2984	4744	chrome.exe	109
PID 4744 wrote to memory of 4296	4744	chrome.exe	110
PID 4744 wrote to memory of 4296	4744	chrome.exe	110
PID 4744 wrote to memory of 4548	4744	chrome.exe	111
PID 4744 wrote to memory of 4548	4744	chrome.exe	111
PID 4744 wrote to memory of 2088	4744	chrome.exe	112
PID 4744 wrote to memory of 2088	4744	chrome.exe	112
PID 4744 wrote to memory of 5700	4744	chrome.exe	113
PID 4744 wrote to memory of 5700	4744	chrome.exe	113
PID 4744 wrote to memory of 1004	4744	chrome.exe	114
PID 4744 wrote to memory of 2384	4744	chrome.exe	115
PID 4744 wrote to memory of 5216	4744	chrome.exe	116
PID 1000 wrote to memory of 5148	1000	msiexec.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\PleasureCraft-Mod-Fabric-1.21.1.jar
1⤵
PID:5860

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5804

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dfw30kbl\dfw30kbl.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3AAE.tmp" "c:\Users\Admin\AppData\Local\Temp\dfw30kbl\CSC756982FA84B4FAA9A5561A812166733.TMP"
    3⤵
    PID:5172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9fb7c728,0x7ffb9fb7c734,0x7ffb9fb7c740
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,15791266741596495358,4508532179515834035,262144 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,12360348439876322526,2549009331835420132,524288 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2232 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,1135500027513386517,14481850819144510180,524288 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2556 /prefetch:13
  2⤵
  PID:592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3068,i,2657717504484249695,18377532582266197430,2097152 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2908,i,9654989413221716393,8451627262362251084,2097152 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,9352676435139350489,5356861629523594527,2097152 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4292 /prefetch:9
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,8573087906316539408,13638187144297288867,2097152 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,13381863685767707905,13810866959786577218,524288 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5804,i,5253430584736797380,8640839220166995895,2097152 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4708,i,16678470934999536267,4553852114225723827,2097152 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3604,i,13027522610897033279,12126986348522913055,524288 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3656 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3668,i,12654925241544273493,389552071378755574,524288 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3632 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3076,i,4569317730980014824,7556805177400087702,524288 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3568 /prefetch:14
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3660,i,12809288133587926497,9186379536873674632,2097152 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3520,i,17603345704583929863,5765250244470417006,2097152 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5952,i,2408174156253604324,3462845382621232462,2097152 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3572,i,4005460741726862548,10569621049133888274,2097152 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=872,i,9908895853010097408,15879999021402745240,2097152 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,17546560435290119316,6157999840827680038,524288 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6536 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6504,i,14269876669110149744,4249355812953428649,262144 --field-trial-handle=1828,i,14823223986757065139,12209091898493981943,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=7148 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\node-v26.6.0-x64.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:5216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1172

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4772

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 694E7719E3FE309CA2FA70B19579774D C
  2⤵
  - Loads dropped DLL
  PID:5148

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68D3CB5DF8B60914CA2C29396FD1ED7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68D3CB5DF8B60914CA2C29396FD1ED7E
Size 10KB
SHA256 b11147e5bd756992b27929eb219549b2a4d11937713ed0e5cbd419f0d33f5a25
MD5 8552096bb3484ca67dc3c10f80ef548e
SHA1 04a0723ee17b0613946c4f4e52cba1e135d1d00d
SHA512 e6215e70673fbb46a6085b928e30f4adcfdf1b2a7a2044c8e388a7a0ca8e23656cbf58b56648ddbb8c649ee120096d18d679278cf9147983d071635b6649f2f4
SSDEEP 192:ML06KZr38AROC8Bx67q4Vo/pClYaMk9AXdrXcr:dvr38dS7ZS49ANe
TLSH
T1F132FBBC6A18AA9380D16E71CAC79FD7D9F650A43BD1E21F45355F884428FC3CA97382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 2KB
SHA256 fdf14037ef2c531a3efab89a7974dbbcd96c03241310994a19e1d5d74b44b24e
MD5 99c7f3acb2a875e6269a86f8ea275510
SHA1 dac472583b7073935fe2d69211c1c61dcd6cd264
SHA512 269f49b01eaeaa6f3da642d05c4b13a23e3f24642484da07238be2771178d06e831d129de27ea7b579cf77a32b806e87268f0d0c7aa09156f36c36f322ca6adb
TLSH
T1A3411A07846D1413DEDABEF2EAC5C97A78F88F221E0125633A6B9394181F3A1A70C05D
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 345fe296fe947276fc22f3a6e971fc4dd6c54869e2b898e7d5311077976c6691
MD5 a199ec033f0a1077b0f84f20bff9e427
SHA1 b5b860f87cb16bf2b747ce1c9a24c2558c249468
SHA512 ef3436c0ec9ad536f39dff5b34634a95095c73c7655bbeef006523c2ec52564e8061ea891afa795df861e184b845b32dc76c67714c20e91e4e7c88a1d7e2fc7a
TLSH
T1A2014162A53CB24945410949AA38EDCA7AB4EFD40B10382F207B61181665F016A36144
MD5 SHA1 SHA512 TLSH

Submit Download

68D3CB5DF8B60914CA2C29396FD1ED7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68D3CB5DF8B60914CA2C29396FD1ED7E
Size 290B
SHA256 3b46fe66843b492ed41ba57497484d8643d2cef77ba3ae0439cfe3e4002f0d54
MD5 fc89237e3d881bfbe515ccb303b41a9d
SHA1 38bd43bacc43c889d152f9456b44c04ec79f2493
SHA512 936e9ab530d67b3254b4a2d8a86123b67a9139019675c542a94aacdf1c03b31c832c7e44ce8fe06c2397eeefbe27a89043263bf14f598863ec1d5c47a03f857b
TLSH
T175D05E1DA3F60613F151C67E96D0252379BDB8169905A3941BF1831830A8E01AA31343
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 422B
SHA256 61bd36c923992afdf8f50783145adb1fbe2812b324babd3784e87260a7b800e1
MD5 8951aaf5ee2a7a574c6badf70f28de72
SHA1 cfff981c9d59f507a57c2241771d5de881edf11a
SHA512 3b4f9319cf9c987315ef6074de8275bc6ede398ac2c9c47f52f23b468ef200cc12c49b7307982d092409bf949913f515f628001915883a3019ab183361b40695
TLSH
T1F8E0682028FEC159E373AC3E0BBA6A3F093BF313180C6ABDAB700115950AC05CD32322
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 872ffcea7bcaa224cf0a14ce38d176d8d99ee1da26f81a7ed08cdce9158ffc77
MD5 b4418b04ffdff0e92f9f049a1ab5e16f
SHA1 4fa8e6da14936187a1d6b04b69e6e2d70ba2f369
SHA512 0aaacd89712cb300e0bccf0603a8f0c0b13ca8a48a3a31b88b2d0d9f26d9e409d4b262a0d3ac0a12b018d9eadf8c907ccd0be67a212a35ad20e6da807b2babf5
TLSH
T1C0E0170CA7F60A22F181CA3E15E02A23B939AD609610834817F583087538E92A930317
MD5 SHA1 SHA512 TLSH

Submit Download

3552aa61-c506-428d-870e-93e5791927b7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3552aa61-c506-428d-870e-93e5791927b7.tmp
Size 12KB
SHA256 8b9ee7a416aa5d8df815f9f2ed857b18512001d227a0dfeea4310b469f863731
MD5 1fc7ceafcd3d77bc090f282fca708608
SHA1 0dd3cdb2bdc4659f0f4d708d7db45c78d9489ce4
SHA512 bdfdcaaa24d7b940c973871e325e4e8b9d1e0b0b3315c60dc292a647a5835fb7ba1b818217067895499ea2fe0b1d2e283bb464e86bd08562bed1f463eddde81b
SSDEEP 192:cRnwYuRunXCv7lpupAPRp2Ka9fHsb+WNn21yVq2g9eo44qbVyIsnAUgtaJ:cRnwdmOZgUX+RwgV2W4Dd8
TLSH
T1E142D72EBA50657B5CCBD31AFD227B53D3F6112521982E84EBFC8A2C14D7ACD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8acbe12e19bb38ae2747d539b74380eae39934184d93f4c01e59a36e75e40503
MD5 798f57a959d533e9c3010da1bb5a3e88
SHA1 014fa248f7f2ea4431a0b0f9a27292d4fb0f6299
SHA512 948a3470ef75457bfe80a04da1d687b1928206450957243664e50eabe7249b28a1eb026d72f926bb999fd9f95e939b31d92f4c1ac65d08ea37cc66913c8b0330
TLSH
T1D4E061E9CE22EC3708FD471865104741E7C013173A81491F363C551C8FF46378565D2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1008B
SHA256 903404a37748d36873ec9c292903a79ae0e5ba325f38e15fbbf5b4e4c4601317
MD5 cdc5cb644fe8a7b6677cb1361877f241
SHA1 bef9d78dbb7f34a5dc88786570e42ec05a2da0aa
SHA512 aa0bf2ff78b5e2517029021ae33b9d75591e3e8268fc7a736783d7a64f4168492bc313da206a67648342bdef5fa1976cc1edcc40e1bd4a2c4672b575b76c367d
TLSH
T13811458C4392A3D2CBA4413550C548B4366FB9465F03FFFBF997457C6E5A2A4900A0C5
MD5 SHA1 SHA512 TLSH

Submit Download

08a22401-cba2-4d33-9f34-f41e97ef0151.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\08a22401-cba2-4d33-9f34-f41e97ef0151.tmp
Size 3KB
SHA256 013864c28a793e47008474ef3281b8513e1ce48553793ea19045c2cfc3927ca7
MD5 efe1328d9f5d8a8d704be758860c5918
SHA1 9b0716ac5b8584341703ae10e66d0fe8ac0b7502
SHA512 be79b49a421e71ee2bb6c9e3ae7dc8eb70d7e836d781f1d703f38009ea2af6ac0e748af2084ec7f626893e0d3c77ef114a42e28f86113504149c79a067f0646b
TLSH
T18161BDF3D3E486AD891152F5DB246E1FCE6E0A15522C3C5688E4AF5B43E2872D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1fae12e90ee734b2ff64992ff83896af074acd9e9ec55a577d5d6abcac71cf49
MD5 c776200292d0e3ec02bbd0b7d3be8f0f
SHA1 a4cd3d6873fbe4cd5b442c436dbc2d5fe6f56c6f
SHA512 46491d2bf237a564226b3e1af1028b4fb1ff3aee894b079dfef897d83a1862fed130faabdeeaeaaf40e2b98c2718a13dd7b46588557bb25ea8bdd0587ac118e0
SSDEEP 192:cRnwYuRunXgv7lpupAPRp2Ka9fHsb+WNn21yb4ef9eo44q/VyIsnAUgraJ:cRnwdm8ZgUX+RwgNeX4DZe
TLSH
T17A52D72DBA50657B5CCBD31DF9227B53D7F2212521982E84EBFC8A2C14D7ACD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f5c8a28c67a18bd25fba07de8aef631e49681a06bd3795fa865e3d61b1a5ccde
MD5 eb34f1b9f95435681bdc4713c7d12007
SHA1 c50c70af57ec243ed8a854c37d4307e6f99d84b7
SHA512 376c6bf529798f6db3f1c2acb1596d9f97af7a47cdefd70a63836aa8acd7a884cd53dc9a1f1f53abed42e580612562dfa1ead63ad986bf15bdd7784cf39be3ad
SSDEEP 192:5R7cBzEtuRun5gv7lpuTOPRp0ZQmexN9fHsb+WNvSeTjZNcjodb2i9eo44qjVyI9:5R7mzEEQ8ZgUXJnRwvtBmy2k4DFvh
TLSH
T1A362E72EB950697B5CDBD329FD21BB57D3F2212125942E84EBFC8A2C14D7ACD2207427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2d7a113978441ed7ac8035d0b773647f4e5d5fb3b6461d7a7fca77929ddc0e04
MD5 1b44058da64791323d7d2643dfb51cbb
SHA1 fd70569d28de11f69f8de3b106e2a35aee05da57
SHA512 a90e45e950d2f7fb92ce5fb13254d23cb8054af2bb39edb0e5dbc2683703993bbbc9284f410c08ee543cd1482ed3a7fb586380d46e85a7dd074359ce23ece0af
SSDEEP 192:5R7cBzwtuRun5gv7lpuTOPRp0ZQmexN9fHsb+WNvSeTjZNcjodb2i9eo44qjVyI9:5R7mzwEQ8ZgUXJnRwvtBmy2k4DFvh
TLSH
T1D762E72EB950697B5CDBC329FD21BB57D3F2212125942E84EBFC8A2C14D7ACD2207427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 67d3b59d9baec70906997ffc97348b4134d2e63ddf8622b2e4edd8ba13fff588
MD5 cfad60ccc9c6ffc82904d47a09d01142
SHA1 caf82761c767026dd4d3139aaf07ec3efa3c0aad
SHA512 bf904a0c6f4ee864f63a13ad3614d5e492c1b00455c6d8dd84f232f2694d2da4029d6f77d0598db38e91d37f6e6e9fdb2594f42be63b7d2f300a40315a81be8d
SSDEEP 192:cRnwYuRunjgv7lpupOPRp0KN9fHsb+WNn21ycjEr9eo44qjVyIsnAUgv0aJ:cRnwdW8ZgKXPRwgRET4DFvh
TLSH
T1A952E82EBA50657B5CCBD319FD227B53D3F2212521942E84EBFC8A2C24D7ACD2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
MD5 5d35f09b8c86835fb4877dcd0cc40e4a
SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
TLSH
T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3c52d850a3dfa84d4b7738b94601f5c4e2d1e84498b2faccfa84a6bf48a45af7
MD5 0c20a042c72828b086e365bbf548e36e
SHA1 901aa1f9d9b82dd3da026b1c2446b8938badd92d
SHA512 d7d3b25c7ede43343b8a5e01bec31eb42736dce9d4f22820269809cbd014a25c172891aac80ccd4d68ec6991e3abe0ed58752af3e89d623b1c43f241b088e176
TLSH
T197B01260D5015602C00602F4118654887224AF11A60B170243E0F9229825A50C029150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587598.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587598.TMP
Size 96B
SHA256 962ad749437d631d757bb0376a1bc478ef67a9aafa3788289c4a1b166e06b255
MD5 71d7f737c848f476423c673a3c19edd6
SHA1 3458919c27a9eb9ff264d06f6cd3e2aa3b94d6ee
SHA512 a2615cd18f3890041064e81974b5cc3e7a73d8945560c88769271d170b70e1be26d6cb1da7377571a1f3208f05a9276014df17e13f6eb9eea9eaa85bce656713
TLSH
T1FCB02238C003A322C02203B03882E8CC30A0CF28C2030282E2E00B22CE203A00020230
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 9e25b2434c63582f90a24f934537313892b71689645a200ac97c4d1560c9b77b
MD5 7b8f50154b6f1474be4eaa21157e659e
SHA1 36fd8120f1f71b360d94860f5a2c91e47d1784ce
SHA512 cf0c5e171a88157ecbf0a7e71f8e656a0866c37e3c7d15c50b3671b28149acf451abf10de47c9a2d25aaae4cda26db418b69e8b6690e833e914ebf48217f1a03
TLSH
T191B0023D30501D56EE4463F024E3844AB323BE20778BC67379E4D498CC927508AF5CD0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ad7fb45ecfd49371599264a7abd8c205e33ae0df1f45f8a672fa4e4b98b80ca9
MD5 32728fa1721401c3805de65967314255
SHA1 547a4e9e7871970061f80e3a101d65294a1bef51
SHA512 ba45c8d168784c77360862c2e68b53bd289e07748c50869b7ce91c0809a37e530571d64d076276a1169415ff01b8d6886c90b1e0f2a831e8d08d47fd5c0ecd61
SSDEEP 1536:nEueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:HDFpmzNA9J+zfAsJDREge7oWg+95hy
TLSH
T125B30212CEAACE9BE4A49C79A4C413F3BEBE5F9523F1B9424166E4023DCE7042395770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 b6391504f1d9703c758280beb35d86434f50938d629c7433b7e5c1c206e49883
MD5 77d24cc47fcbaf8fa951d023de7b609e
SHA1 0fe640209db10c7471c75d1a7d1c0ab206fbbb97
SHA512 fd3236912a6907a9716c0a212eb7dfd373d6042fbeddecba47bbda8707cee82cd4d3cd6204c15e03094c2d01cf5f849c96a4444265463e23c67ec7e2df14baf6
SSDEEP 6144:xDOlsPQCfjiXVzoJHg6JOMxheoPNf+zfAk3Wbh/:hOlsIejilEJAkbzdgfaF/
TLSH
T198341232CE254DAF9C746D2AA0844F93FFC88E9D77DABE9182927582374F5806743724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 9adfae8941eb3f0b8e3394ebe52df05a82373040a9022d036de128da568997ca
MD5 497fcd49e2f6a6d46596974b732e7835
SHA1 8fd1a56110b50b45b057bbba5edb6bf3af42b1e3
SHA512 eafc8310c78cbbb79c25137fcbd3e854ccd3537bd95a62ca8771c31a964b032b007372533aa4bc3186acfcea03c03ea708dfe6fd2a084271d6ae6d969e481296
SSDEEP 6144:XOlsPQCfjiXVzoJHg6JOMxheoPNf+zfAk3Wbh/:XOlsIejilEJAkbzdgfaF/
TLSH
T1DE342312CE254EBFD874AD3AB0844B97FBC88E9873DABA9183D27556374F1406753324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 5a1a8545a4ae884f0640702703797ec49df75392de97329bfc6f9e744c5ba83d
MD5 554611c72a4d16673a2694be75dd240a
SHA1 2cb7ddd283085baa7cb6654ef73b02cbf2d67ac3
SHA512 a2b9e921dca468040c8352e627884fba2e963fa00a47a5e5ca3ec25e8bbc9a37ffcee6eb61e21fd4d9e184d82beaeac4f494e23ba5d0ea9231b273ab06999d75
SSDEEP 6144:EDOlsPQCfjiXVzoJHg6JOMxheoPNf+zfAk3Wbh/:sOlsIejilEJAkbzdgfaF/
TLSH
T175342232CE254DAF9C746D2AA0844F93FFC88E9D77DABE9182927582374F1806743724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e011e5fb-1698-4062-be81-47e539de52bc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e011e5fb-1698-4062-be81-47e539de52bc.tmp
Size 235KB
SHA256 42a8f33dfe9e74ba7bd500a0ddac7cb58503d0be4b22098d67a3ffe35e29c70a
MD5 3f3bac6ad672eec25022c994502046c7
SHA1 105d6cd3430a92b96990743c28d6cddd88abe764
SHA512 4c45e2ef6c44455ae6736d95a433eb4ef4d273def46db03c30bee569a1576a8298eec23dcc685a108b6dd3e786d4a57692abf55a189f7b50bf6aaeec448a2765
SSDEEP 6144:YOlsPQCfjiXVzoJHg6JOMxheoPNf+zfAk3Wbh/:YOlsIejilEJAkbzdgfaF/
TLSH
T186342312CE264EBFD874AD3AB0844B97FBC88E9873DABA9183D27556374F1406753324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 abc8915ea21a5e6965080e1aa7d8456f3a89b435609602855066aba905dd3fe9
MD5 0bb8a1501d88c988e65fddffad72e8a4
SHA1 2656d3cb6efb0e211c535071e4783a7754a5e05c
SHA512 0ae2501c244291292bc84f98ee166e4e712b1cf3263a512ac5426cdf6b3498bc67161985a01923b149ca49c77e6168953c336ddd7b0f60dd3ce8e16b2f63ffce
SSDEEP 384:kuJWJzVca12krtuVm+SglBOVjeQ8RJo3hghFUjUXPW35PIm59+GDa50HIsYAVocU:j+zVcWrPl8RJYhgTUjUXP6t9+GDa50Ho
TLSH
T1DFA24D743AF51319F3B29F759AF1A95A643AB866AC00DB4D0162038D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hi.bat

Path C:\Users\Admin\AppData\Local\Programs\hi-eu\hi.bat
Size 71B
SHA256 5394cadcf2c442574dc1c1d8a5f5bb892470751753208333e2fa35d408f93540
MD5 98020925e1095a953abcef1d4cd38f65
SHA1 6e8eaa132a9d7acef2b0909ab7f6f48803d2d911
SHA512 91b85ecf22ef39c96b5c8e56159056bf89dcccb3f4a1eff78925d43ad22d5794174746cb027d9868fecfd80712f05474701baf6834719ecdc904ce51cdc8bd28
TLSH
T15DA02232800F0A833C32AC3EB2CE00E03C2E0CC320B8B300EC000383BC8E0008C08003
MD5 SHA1 SHA512 TLSH

Submit Download

MSI1BD6.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1BD6.tmp
Size 142KB
SHA256 4c7ef0c4d17237b1b98f0bcb92b2df20d07f0b1584d576f000b69e93f103d6a7
MD5 5c63fe029eeaac510a9450731c1c8198
SHA1 dc2faee49ab53ee2ade83deefc828ce5031ec4ba
SHA512 139fc321846b792b3ee57deb4805cfd2432fcdd0664ef924ada29d1f9da5a30f82347219d8a1904d1e1070409c9c2fa02ae53f15b5986d9d872a3890460dea8e
SSDEEP 3072:IqrbMw7g/wrO6sMgpZEHinwCJkLzrSYfS/:drIrdHEHiaf0
TLSH
T1A7E35B1BB3A500BBE1B78239C9670A45E772785117609BEF03A443662F273E49D3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1C54.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI1C54.tmp
Size 390KB
SHA256 6ad2dc761ef5e3f2048148e390cf314c3a2a47c75be57917eb0b66783424bf8b
MD5 476928c3c78e75cef1c141de94922c63
SHA1 254e46ff1e15aec93356301ad15a1cdff9655f46
SHA512 c833eb6dc6d56ce06c5aaf0e1300d8d8b85bd87e76736a9d35dec8957140ab21ba86770c92932dba30abf53fd8218fb8cd95beb3f75cb1c4812e7d25d9d5f681
SSDEEP 6144:O3TAWENBGWFraHfbz27n/e6yHdb0lLGuyI8MMggT5:O3TAT+erw27WHdwLGu38M0N
TLSH
T18B846B29F7E418EDD5B68276C4A68534FF75748C3320D5AE47A8852D1F3BAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES3AAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3AAE.tmp
Size 1KB
SHA256 d931902b106e6300521df0c941380a2ae6801e9f8641d2787ec08bbf90349c04
MD5 c5fd1a55c721a8658da697c31e9e7faf
SHA1 51a27cd3eb1a01a9e48d113fec61848b3c612d9a
SHA512 36a60c505ebf440f3ec235188ee2414f86e8f94bfd63f174e9b6903fdeed000d0cfb34290f1c99309ab137daa21a111b8c1cc2b459223e0da4270a35b8f98b7c
TLSH
T10921890593E8471EF0B34731B9F5072BA264FE50EEA2935B854042282C51644EEB1A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_swn3llqu.jbc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_swn3llqu.jbc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dfw30kbl.dll

Path C:\Users\Admin\AppData\Local\Temp\dfw30kbl\dfw30kbl.dll
Size 3KB
SHA256 9a4c3c9fc00106ee929002b769e3d6dde353e52189512efc8bc25d8525ad3639
MD5 6c0c66a94d6e6662e3839f1a03d9a6b1
SHA1 e4ee2827c0b8171d23e9fad5b3eeb4b5bd6e5d30
SHA512 9661acfe25987463e8f22354c181b43a1341fa2436b21df84f2aa55a10027163758243e3ffe49f5201f84439ba8f19b8e5d3eb59bd7b0e84656b0330116579c9
TLSH
T17A71F316A7E5466BE4EA0734BEF717632274F8509F63976F199012296C207682E22FF0
MD5 SHA1 SHA512 TLSH

Submit Download

node-v26.6.0-x64.msi

Path C:\Users\Admin\Downloads\node-v26.6.0-x64.msi
Size 34.7MB
SHA256 f260a2b468a72c7071edd57de032cc8c4097bb5bdbb1f1d76454cec60c68cf5e
MD5 e78456488957816dd3b705c5dcbbe756
SHA1 bdc3c32678e25e7bec9731275de0da42ae512ec5
SHA512 bea79167f8e778d826f539373c2b72c09d1295c244ea9770fc739e7b10c6bfaee382ad9bb6b24dc1b039d1ff3baaadc93736bf3aa729df3814b7397fe5be95a0
SSDEEP 786432:zmMXQUPFmQijuvbXS53z7q70/zKsL+diVDa0+mcEvMynb0hxqPbJzjtN2z:SMXxVmuS533K0/zKsSdikLmtvQ2JbK
TLSH
T1BB873327B6920933D5EAC131E0A7C751AB3A7D54771045EA4B74A48CEE372F06BFA702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node-v26.6.0-x64.msi:Zone.Identifier

Path C:\Users\Admin\Downloads\node-v26.6.0-x64.msi:Zone.Identifier
Size 140B
SHA256 160b24680a3ea25bca002fb066e244a2ef09300eeff10e51f04bcf64c81ec600
MD5 0e7595625d751efbda95352923fa2bec
SHA1 e7e096dc9e5984515f03c6a46f692b3e9f92ed93
SHA512 62c4c39e774a996d20c43f9d45c573c48ad65c85101607b0881ec2d6a676202c905822b90bcdec0fa4e6b59ada27018fa34a92361ad4814cfcc9fb0ce7f452ad
TLSH
T1B2C09B6745018671579112E0559AE17DF04F15551C91414CDC5404ABFDD44B485A459B
MD5 SHA1 SHA512 TLSH

Submit Download

CSC756982FA84B4FAA9A5561A812166733.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\dfw30kbl\CSC756982FA84B4FAA9A5561A812166733.TMP
Size 652B
SHA256 ddab559d1c56977bb1b60ad76b58f206af35745172021f888847256145f47aa3
MD5 8384162870eac26a82e8dab9243c08ba
SHA1 76f620fbf1c539d299566eb4d97b31fa80e14e0c
SHA512 bec38fb11fa6ac4108571dee73dd86b570db2248e5958e9f981da2b10c88ac8b4c9cd14ce3ba4ec23a67402bb1b30e21d6eec641761e38eec7d60b071f4bd86f
TLSH
T1DDF05E0963F8120EF0F34B30BEF643A391A9BC65DE7293ED548003192C646109A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

dfw30kbl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\dfw30kbl\dfw30kbl.0.cs
Size 517B
SHA256 5c7b41cfcdba24ef9fbf55409ad37874e60c27da2bdf82d8a0419334fda96692
MD5 9b422ce2b43735dcd103133f43dd73dd
SHA1 95ca6c16308ef36ba85913d3df5bb79cc9443333
SHA512 4d1acf3b427b102413838a786a0add63d7d14a402b7a37741ea60905bfc5b96de1ec4df66f34827f059f8c6b29546d54c708a5bcf5deb383886ca77b5c706ed3
TLSH
T148F0971466A3896A694360097DAE74AFB233903323BAA610F8ED1201CF1B854B572F25
MD5 SHA1 SHA512 TLSH

Submit Download

dfw30kbl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\dfw30kbl\dfw30kbl.cmdline
Size 369B
SHA256 67136120d229a8e98727b442669483e8fd0c0524da364ab555d1e7faf80f294f
MD5 03194774a68374079da8d0eaeb3a8152
SHA1 5c01d578f1a32a42dc6d5e9979f289b26871880e
SHA512 c93eef56dfa698da4d0b1ed9fa6d5d2c97a06a981826c6736aceaa29a5fe0fbf328dbed6e166ac70026bed6725608bce2e337007806a76ff1878118e05b285da
TLSH
T13EE0C02AC25FC2FF01DD140F2979D5ACC272074369403F84D068480DE037000B7E1749
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3836-175-0x00000212D8990000-0x00000212D899A000-memory.dmp

Download

memory/3836-164-0x00000212D90A0000-0x00000212D9262000-memory.dmp

Download

memory/3836-228-0x00000212D8AB0000-0x00000212D8AB8000-memory.dmp

Download

memory/3836-147-0x00000212D89B0000-0x00000212D8A63000-memory.dmp

Download

memory/3836-152-0x00000212D8A70000-0x00000212D8A78000-memory.dmp

Download

memory/3836-146-0x00000212D8990000-0x00000212D89AC000-memory.dmp

Download

memory/3836-174-0x00000212D8A70000-0x00000212D8A82000-memory.dmp

Download

memory/3836-149-0x00000212D8A90000-0x00000212D8AAC000-memory.dmp

Download

memory/3836-150-0x00000212D84D0000-0x00000212D84DA000-memory.dmp

Download

memory/3836-151-0x00000212D8AB0000-0x00000212D8ACA000-memory.dmp

Download

memory/3836-30-0x00000212D84E0000-0x00000212D8526000-memory.dmp

Download

memory/3836-148-0x00000212D84C0000-0x00000212D84CA000-memory.dmp

Download

memory/3836-29-0x00000212D8420000-0x00000212D8442000-memory.dmp

Download

memory/3836-154-0x00000212D8ED0000-0x00000212D8EDA000-memory.dmp

Download

memory/3836-153-0x00000212D8A80000-0x00000212D8A86000-memory.dmp

Download

memory/5860-11-0x00000293600C0000-0x00000293600C1000-memory.dmp

Download

memory/5860-12-0x0000029361930000-0x0000029361BA0000-memory.dmp

Download

memory/5860-2-0x0000029361930000-0x0000029361BA0000-memory.dmp

Download