hxxp://verrerie-farinelli[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://verrerie-farinelli.com
Sample260805-by3geahl21

Score

9^/10

discovery

Malware Config

Signatures

ClickFix v8 — MZER custom loader stub with x64 PIC bootstrapper 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	SL_ClickFix_v8_MZER_Loader
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	SL_ClickFix_v8_MZER_Loader

ClickFix v8 — Suspicious named pipes: CPFATP_ (CLR profiler abuse) / Sessions 17 IoCs

resource	yara_rule
behavioral1/memory/4968-291-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-292-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-294-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-295-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-297-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-298-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-299-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-300-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-301-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-302-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-303-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-304-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-305-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-306-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-315-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-338-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2
behavioral1/memory/4968-392-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp	SL_ClickFix_v8_NamedPipe_C2

Complete MZER GetPC stub as a code-anchor (immediate wildcarded) 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_MZER_getpc_codestub
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_MZER_getpc_codestub

Fires on any WP-002 chain component 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_WP002_any
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_WP002_any

MZER polyglot header: position-independent Donut shellcode masquerading as PE (cross-version cluster 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	AS202412_MZER_Donut_Header
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	AS202412_MZER_Donut_Header

MZER polyglot: MZ-lookalike header that is also a GetPC self-locating x64 stub 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_MZER_polyglot_header
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_MZER_polyglot_header

MZER-polyglot Donut loader family: header + GetPC bootstrap prologue at offset 0 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	omegatech_mzer_donut_family_20260803
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	omegatech_mzer_donut_family_20260803

NEW in V12.1: native MinGW-w64/GCC-15 WinHTTP downloader stage fetching enterprise/student_s.bin 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	AS202412_V12_1_Native_Downloader
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	AS202412_V12_1_Native_Downloader

Native PE32+ loader: process-enum + remote-thread injection + WinHTTP stage fetch 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_native_loader_my_enterprise
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_native_loader_my_enterprise

Network IOCs for the WP-002 stage host and C2 gate 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_stage_network_iocs
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_stage_network_iocs

V12 C2/lure/stage-2 domains, IPs and stage path 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_V12_Network_Indicators
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	Omegatech_V12_Network_Indicators

V12.1 infra: new stage-2 IP, recycled V11 C2 domain, TDS, lure host, EtherHiding contract 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	AS202412_V12_1_Network_Indicators
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	AS202412_V12_1_Network_Indicators

WinHTTP downloader by imphash — durable cross-wave-cluster pivot 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	SL_V13_1_2_Downloader_Imphash_Pivot
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	SL_V13_1_2_Downloader_Imphash_Pivot

WinHTTP downloader/injector MZER stage, ~50KB 2 IoCs

resource	yara_rule
behavioral1/memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	omegatech_winhttp_downloader_20260803
behavioral1/memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp	omegatech_winhttp_downloader_20260803

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
38	4968	powershell.exe
39	4968	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1188	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303672846823386"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1400	chrome.exe
1400	chrome.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
1400	chrome.exe
1400	chrome.exe
4120	chrome.exe
4120	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe
Token: SeShutdownPrivilege	1400	chrome.exe
Token: SeCreatePagefilePrivilege	1400	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe
1400	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 4692	1400	chrome.exe	88
PID 1400 wrote to memory of 1840	1400	chrome.exe	90
PID 1400 wrote to memory of 1840	1400	chrome.exe	90
PID 1400 wrote to memory of 1188	1400	chrome.exe	92
PID 1400 wrote to memory of 2952	1400	chrome.exe	93
PID 1400 wrote to memory of 5056	1400	chrome.exe	94
PID 1400 wrote to memory of 4876	1400	chrome.exe	95
PID 1400 wrote to memory of 2952	1400	chrome.exe	93
PID 1400 wrote to memory of 5056	1400	chrome.exe	94
PID 1400 wrote to memory of 4876	1400	chrome.exe	95
PID 1400 wrote to memory of 292	1400	chrome.exe	96
PID 1400 wrote to memory of 292	1400	chrome.exe	96
PID 1400 wrote to memory of 4292	1400	chrome.exe	98
PID 1400 wrote to memory of 4760	1400	chrome.exe	100
PID 1400 wrote to memory of 4760	1400	chrome.exe	100
PID 1400 wrote to memory of 4584	1400	chrome.exe	101
PID 1400 wrote to memory of 4584	1400	chrome.exe	101
PID 1400 wrote to memory of 992	1400	chrome.exe	102
PID 1400 wrote to memory of 1924	1400	chrome.exe	103
PID 1400 wrote to memory of 2076	1400	chrome.exe	104
PID 1400 wrote to memory of 1152	1400	chrome.exe	105
PID 1400 wrote to memory of 1152	1400	chrome.exe	105
PID 1400 wrote to memory of 5428	1400	chrome.exe	108
PID 1400 wrote to memory of 5428	1400	chrome.exe	108
PID 1400 wrote to memory of 876	1400	chrome.exe	109
PID 1400 wrote to memory of 876	1400	chrome.exe	109
PID 1400 wrote to memory of 2624	1400	chrome.exe	110
PID 1400 wrote to memory of 2624	1400	chrome.exe	110
PID 1400 wrote to memory of 4064	1400	chrome.exe	111
PID 1400 wrote to memory of 4064	1400	chrome.exe	111
PID 1400 wrote to memory of 3676	1400	chrome.exe	112
PID 1400 wrote to memory of 3676	1400	chrome.exe	112
PID 4968 wrote to memory of 5208	4968	powershell.exe	115
PID 5208 wrote to memory of 2688	5208	csc.exe	116
PID 1400 wrote to memory of 4120	1400	chrome.exe	117

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://verrerie-farinelli.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffabbe5c728,0x7ffabbe5c734,0x7ffabbe5c740
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,7065624513940508834,7649657901906798489,262144 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,7438472351898193611,2360351092974894778,524288 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3024,i,9217846155387808295,17558441852934729086,2097152 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,2959933609872407498,14504627034064762850,524288 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3016,i,17591395383004644423,971525934496413800,2097152 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,14586071316066459708,15307596958138074647,2097152 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,11630404692111281554,292490390609933224,524288 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5572,i,15089858862268766043,13613097546482900801,2097152 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5616,i,796647104793275627,2504509241573954452,2097152 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,8033187862713883453,2567792560586900283,524288 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,17289848768393707046,1740249229581451972,524288 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,12125721725629125895,2529055485054796831,524288 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:2076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5768,i,15889613397571009926,5558126971935481686,2097152 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5608,i,17524629026512743835,5865855250503957702,2097152 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4900,i,3409345248341012991,16951633980207126512,2097152 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6132,i,11520715161623144573,5404899048640032705,2097152 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6248,i,2924980753520838160,3013490197312429962,2097152 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6048,i,4094063363900897696,10984426044099732893,2097152 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3284,i,18335292552105642780,17407352709767712277,262144 --field-trial-handle=1928,i,11461946149260412885,1130470196228803962,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zmj2w1ha\zmj2w1ha.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A1E.tmp" "c:\Users\Admin\AppData\Local\Temp\zmj2w1ha\CSC4BCF6BAC28794159A8F399A3C7188D8D.TMP"
    3⤵
    PID:2688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 57e19e8f531fb9f8aded015dbc99bdd4bee9b6d714a5be505983297881c8dc41
MD5 e7352ddb1dfe60aa51cf1c97d8f882f0
SHA1 53db369b27c5a153f95ffac1dda5b40a75d7fff7
SHA512 9d17c82aff722572176160f52ea5b2cbea65854bdb9134900a9fcdce9d872f388d0c5055bd92159971de2294f4c4fdf3357b25d29849707ed6090479a30f6fde
TLSH
T132C0924044A2180DDF45A1B05ABA1CB0235609AA5D22062AC5FC828995237B20641841
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 028ae7c266db2a882211d7237fe03f04a7ccf586150e616068f1cc3bf8d8edd0
MD5 279e36e5a165db261e25673460368aa6
SHA1 6dec044621bb382df3afd7490d12a63d38fc76ac
SHA512 389d01c3a3b6a78a5d6af15e4b35dfed79df353db198a96691928e4e14dbc4d2a4ab0757c04b183a8a89cced0764ace3b6dfb65839d6fed6a2c200a0975a6e0c
TLSH
T119E02BD51ED12D0ECF1C41F759E50DB8531244AB1D11135BC1D971844F1F2F31D4385A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 519ac55ac3febf3499d4b952a755abc8b81a6db8b84cddccb46d6c9a8950ea5a
MD5 27d947d197cf463cc1a25ecffc13767e
SHA1 46f3bc1a86d2c4746578f5baf4b447ae3e01bc7f
SHA512 f0917955e77fa2a0509ecc87c4167645fa7e9e8083855c5e59f8055e4e593142fed5dd19e1eeb111175c1f196694803f74bfa2f21fb0128966d0aa46d823e3fd
TLSH
T13EF055C42D801A1ACF0EEEFDC0AC0D3E7611055A5E41630F8CA18584969BBB32D43647
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9da3f5d7bdd76a91720138a7ff8b5babbc9d96698d95921148785dd37ece4e9a
MD5 fafe6ed01c84080d2a46088f3827e956
SHA1 77b67cb3b1a6c65651fbb2a7d95640f9efee0033
SHA512 ec52295b462669e2e11757feabfe9f290f0f9f0472c35740c150618d0225643f8101eb6626e70854986382f3f223989e4b1a70bda9834ea44d7b9d3dccf4c43c
SSDEEP 48:YALl9n929MP9zUh2sJCSRsJWXLsJufoKsJrfsJbAoskozs/hsa4sj3slVuzs9gXO:DBoySUSrJu3UppjcVRE3TK
TLSH
T10A91DDF3C3D9C62D884156F4E7197D17CE290E28522C3C16CCE8BE5BA7E2871D261A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 00b0b11b01a2665b45636858f8e78502d0cd15923c047dc5ad27fac2d7e29795
MD5 475d65e4636b25feea4971e658a7a889
SHA1 0d9da63f8a49685495b4255db60dd81664e79efc
SHA512 4cb66db5f26d3ce71b14ec765c8ad3589b23778148236c7fd0bbe57d68ce695668fd8ad2ba2ea7a2dcb8f064e0c5d57f99ac5f365226a70c61f31133c4f4a97b
SSDEEP 192:5BR3qal25v7QvAPRp2Ym9XxHsb+WNn0UEtI42N9jJkwrVyIsnAUgR:5BR3qRZ86Xefw3142dNR
TLSH
T1E632A62EBD14693B7DCAC22AFA627793D7F6102165E42E84E7FC8A2C15D75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0a731ca474cfed2f2843cae008604fed7791f5a37e135c03722c2eaeb3fe0783
MD5 4efef76a9683f4d1dd8a7133d7f1e388
SHA1 9f3caaa334a70bed870b1cc39fef43d5ae8aab99
SHA512 5933669a650ea42505f25acacabb9b22186de73869722a1767141cb184b7343e1ba835572c36201151a5fe065d8bf350409cd6f1f0d953f0f23482badc5a9341
SSDEEP 192:5BR3qal2gv7QvSPRp0Ym9XxHsb+WNn0UEzW4ec9jJkwYVyIsnAUgvb:5BR3qR888XAfw3d4eKcvb
TLSH
T1DC42B92EBD14693B7DCAD229FA617753D7F6102161A42E84E7FC8A2C15EB5CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d40fc45b44a4135e019c641b224a69c6350e73264a34b62296d03eb397932c72
MD5 85b677d4ff587285d9f83ab26875362a
SHA1 b7a6cd2a9d35cf153fb76ac4315f6265c8e5457d
SHA512 3cdf7c0dee2419ddf81b46a62518e4387b6c9bb8f27b2b09868648bb496df44b62ca91cf9e86638baf92d4a9ff684c3b0ba26a1660ab1f53d225e206ab30dd05
SSDEEP 192:5BR3qal2gv7QvAPRp2Ym9XxHsb+WNn0UEzW4ec9jJkwkVyIsnAUgvb:5BR3qR886Xefw3d4eKAvb
TLSH
T18C42A72EBD14693B7DCAD22AFA627793D7F6102161E42E84E7FC9A2C15DB5CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 05fe3e5cf146a4ebe8cb9bfc9205d676e9242091a012a0259e5ca0bd0bfcfeb7
MD5 8afc7afa2401f7fcb471b70631c188d1
SHA1 4abdbc05135c2f3ab61b36f8113e9657a615ea26
SHA512 26ffa69c6198495b133dfc2680cda2f81fcaa88577d4988388fa01349bc64473c0c344aa0e770c54df38ee2c3d3fdb916ff4f96332b2ac2d3ace14eb4a34b1c2
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934ZMeSl8h4otop5IicD/B64Gyvn0Srh6m+9kKRNC39I7:Rt0ITo+TQ0IHiU2iJ4PSrh6m+9kKuCj3
TLSH
T1B9C11971A06C5C7B08A6A486B1132D53CDA5306BAD65BFA4FEE90E0D01E74DC1383633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2cda547f7302d7156335fae1ff9cee1c2439685000cdf25d5eadfc99814b133d
MD5 582c4372279971b16e75706f510fc085
SHA1 81e1d9035bfa10d80c9c4e91b0fb5c67bab224fc
SHA512 579ec1739522e8fa81c36c1b8e1ac416539da03adde9d6a55b5303023efa3b005eeeffd8f1715d1753f35fbfb2fe1049f9347bce481558127a029f02465e89fa
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934ZMeSl8h4otop5IicD/B64Gyvn0SvQxwzQ6hjm+9kCA:Rt0ITo+TQ0IHiU2iJ4PSIx+hjm+9kCr0
TLSH
T18CC14A71A46C5C7755A3E542F1223A57CDB5306BDD51AFB0EAEA0F1D02EB0EC2382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d5d488826a4126dd5ccde57c9298a1aaa162e4f026ef1c511dac45a9c68d9847
MD5 a627d4f6b4b3e3e301a150e35c35882b
SHA1 e4d5385e19f0ea51cd948588c85b2b716539f6d8
SHA512 ae5937a4a8c78952a5284a9b34eb9f8c27ddc3acd5f7062c0c84737eb0876aa199d597ca0d19ea4383e35b1c28cc420729a5f1c1a80f1e3fc151f3d8dae3545f
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934ZMeSl8h4otop5IicD/B64Gyvn0SRhlm+9kKRNC39IK:Rt0ITo+TQ0IHiU2iJ4PSRhlm+9kKuCju
TLSH
T1B1C10871D06C5CBB09A6A486B1132D57CDA9306BAD65BFA4FEE90E0D02E74DC1383633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 d3e16ed3e9e210be7c7823f0245269d5612ed347e4af86aa3de1fb887b5cab68
MD5 fd9bdcac84338a4cd731bf448eb5ff5c
SHA1 5d6548e4a6225e64b2ef3ee45638b6e0ba283eaa
SHA512 068d80392dbdf461ce249128d7cad4b11cd0ba84e59591a7b8cdbd9df10121b8761324da24e0bce840bd66aa0d121b2f3d8d89b7066f54a3378704fdef1cbf11
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5ImD/B6nGyvn0b4T8kybJv4a:xC0ITo+TQ0InDUDnJPPb4T8kybl
TLSH
T136A10935A0284D775476D44AF1A22A43CFB9706BE972AFE0EAD90E0D15F70EC1342A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2e2447007facfb64a90cd1c4c2230245273fc99699945774e38b0dfa5b58fe94
MD5 e07c34ffdb450cf4dae7302ef14f8ee6
SHA1 264ca4e80271887ecf271781d1b4e69d04b2b4fe
SHA512 5c79aa28bd82ed2bff8bb8218331456f75dc03144ef719450e31b6616db7440afeb57739d84dc20886b6141087bc2bab2c3fcaaf3d9d87d7908711ec23eed5f7
SSDEEP 96:xC0d+r2io+TJ/E0f6m934ZMeSl8h4otop5IicD/B64Gyvn0SvQxwzQHhj+9kCr09:xC0ITo+TQ0IHiU2iJ4PSIxzhj+9kCrUH
TLSH
T12AC13A71A46C5C7755A3A542F1233A57CDB5306BDD51AFB0EAE60F1D02EB4EC2382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES2A1E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2A1E.tmp
Size 1KB
SHA256 1e5a1e1cb945a27e39889a73917af6b2e5d21417c2b8a5cf9e86e8543ee2d80c
MD5 2fe59bf9db236a7a6c70328a0440721d
SHA1 027189b68e4c976d3c792ae68629213fd435a872
SHA512 7ef1e23b0a137131c1e35acf92b731c2667d50f6e7a47c2536ce2e2ba72938dfa3b9c36b4d9085388041f51ea25870215a9e7d786d566addf5334bade018aca0
TLSH
T1FD21AF05A3EC471FF0778B3169F6132B5674FDA4DF61A39B8680422C1C22504EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

zmj2w1ha.dll

Path C:\Users\Admin\AppData\Local\Temp\zmj2w1ha\zmj2w1ha.dll
Size 3KB
SHA256 7a915e25167aaac740c16b8d00052f993538cd00ff61fdbde9835850a2b8e074
MD5 57ff9eb39e12fa1c076d0dd0a90dafcd
SHA1 1d6457591a2a6279757680c661503ce360b817de
SHA512 c940b1e8197aaaef7012fdcb4af9be54799f13119e914d9df410eda9a3f75919df691b11d0e4b0420d425217f40ba36e784b96cfe51c497ca39824ac0892d434
TLSH
T19371010AA7D80667E87B0734AEF3031337F4F8908B73972A499042686CB66640E71BB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4BCF6BAC28794159A8F399A3C7188D8D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zmj2w1ha\CSC4BCF6BAC28794159A8F399A3C7188D8D.TMP
Size 652B
SHA256 7b3b7db8e863f9468ee2e5add3f6ffbbe20637f432137b3deac78fca5a547501
MD5 5e7a02a6ce4755d852e2852fd2c060f1
SHA1 4b6a62be9b4ba78a63d3121d6a314b516e328589
SHA512 0606a23eea4ee1ab350d841a5198b8ea744e6c881e4a9ef4df709a77661cb596b449e1293e22daa2bc9494ae19d386deeec83c660047a8e537ed525c9ba004ec
TLSH
T1B4F0540963FC020EF4F74B31BDF54363A568BCA4DE3293ED1590031918655149561F75
MD5 SHA1 SHA512 TLSH

Submit Download

zmj2w1ha.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zmj2w1ha\zmj2w1ha.0.cs
Size 601B
SHA256 e1220a1a15413251d6fece5e5fd8a1654e75305c523db347e34a49ae639483df
MD5 acf75c87ffdcabbd4f3b02611f1c385b
SHA1 8c1b7833f269104a5bf206fd893b1be5ce7e5c5b
SHA512 fd1b6ff423c14ae8924340723fe371f483b79761051c0f4c88528c93b7410210b820cf2fe16bef44ab93316105f076d00802f2318f87f7663af2f1232f6325c8
TLSH
T193F0225423529BA2A423943E8987F4ADF213807322FE2C00EAFC2722CE47145E23965E
MD5 SHA1 SHA512 TLSH

Submit Download

zmj2w1ha.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zmj2w1ha\zmj2w1ha.cmdline
Size 369B
SHA256 59c25319893ab9de036d4839ee6d932447e7b850f26a114f700ce3e223b4f7a6
MD5 8f0ef37707958c7c3aefcd69b0d3b128
SHA1 4d71efd56b6d26fa0b70e964e54bd736e70a578e
SHA512 0899c90e524dfd05127af3afcdd4d267454d9b600930821ec519c8110fa2a410a7c77cddbdaa4915ef0ef735db613e85c6d45331ce8cc22c0b3287b883467058
TLSH
T112E0C62A6246C37D03FF200B266AC4BDC2730B832982BF84D042840DE0378082BE2FE1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4968-294-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-297-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-302-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-303-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-304-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-305-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-306-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-300-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-315-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-299-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-298-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-301-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-338-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-339-0x000002DC4BCD0000-0x000002DC4BE92000-memory.dmp

Download

memory/4968-296-0x000002DC4B9B0000-0x000002DC4B9F8000-memory.dmp

Download

memory/4968-295-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-292-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-291-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-352-0x000002DC4B970000-0x000002DC4B978000-memory.dmp

Download

memory/4968-290-0x000002DC4B5A0000-0x000002DC4B5C2000-memory.dmp

Download

memory/4968-353-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp

Download

memory/4968-391-0x000002DC4B980000-0x000002DC4B98D000-memory.dmp

Download

memory/4968-392-0x00007FFAAF1E0000-0x00007FFAAFB84000-memory.dmp

Download

memory/4968-287-0x00007FFAAF36F000-0x00007FFAAF370000-memory.dmp

Download