juko | 824e30b4a3603c12d1d64f1b76ca42cec377b46323185dcb95683bd24267c869

Resubmissions

09/08/2026, 04:27

260809-e3atqsgf5710

09/08/2026, 04:10

260809-ert38stvgw10

Analysis

user interaction
yes
max time kernel
900s
max time network
901s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_460c602bf9c62c468b09fcf2d7c44aa6_elex_wannacry.exe
Size 49KB
Sample260809-e3atqsgf57
SHA256 824e30b4a3603c12d1d64f1b76ca42cec377b46323185dcb95683bd24267c869
MD5 460c602bf9c62c468b09fcf2d7c44aa6
SHA1 2c88929a65ff59e611d7d483057c3f27be5f22d4
SHA512 d8d65ddc5263aeff545e7f34391013277ecada7dd2425dcb51c0e71f3f4593609b0bf213d67e1fb8cce3bdec0edd4aafbfcfa41f74cea29b3544e702a34a53dc
SSDEEP 1536:4LsF2Kerc64sTiX2IV0Dhuj4p4kojVR6h2V:4Ly2Kerc64CiGImVu8p4kojWh2V
TLSH
T180334C0A2BD650C2D56205B0E99A0F75833FDC3A2127A75EE740765A1C72D6BCF30E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution juko persistence ransomware spyware trojan

Malware Config

Signatures

Family: Juko
Juko is a trojan written in C++.
trojan juko

Detects Juko 8 IoCs

resource	yara_rule
behavioral1/memory/5092-0-0x0000000000400000-0x0000000000420000-memory.dmp	family_juko
behavioral1/files/0x0011000000016ccb-5.dat	family_juko
behavioral1/memory/5092-10-0x0000000000400000-0x0000000000420000-memory.dmp	family_juko
behavioral1/memory/2308-12-0x0000000000400000-0x0000000000420000-memory.dmp	family_juko
behavioral1/files/0x000c00000001c68d-13.dat	family_juko
behavioral1/memory/3812-15-0x0000000000400000-0x0000000000420000-memory.dmp	family_juko
behavioral1/memory/3812-16-0x0000000000400000-0x0000000000420000-memory.dmp	family_juko
behavioral1/memory/3812-1733-0x0000000000400000-0x0000000000420000-memory.dmp	family_juko

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
82	4180	powershell.exe

Downloads MZ/PE file 4 IoCs

flow	pid	Process
82	4180	powershell.exe
82	4180	powershell.exe
82	4180	powershell.exe
82	4180	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2308	WINWORD.exe
3812	WINWORD.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WINWORD = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\WINWORD.exe -r"	WINWORD.exe

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 51 IoCs

pid	Process
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4180	powershell.exe
6068	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5748	cmd.exe
1716	cmd.exe
2720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_460c602bf9c62c468b09fcf2d7c44aa6_elex_wannacry.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5748	cmd.exe
6052	PING.EXE
4380	PING.EXE
5360	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	chrome.exe
4236	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307232856376139"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\1\0 = 5a00310000000000095d7623100053797374656d33320000420009000400efbe8158a93a095d77232e000000a80d00000000010000000000000000000000000000000a782300530079007300740065006d0033003200000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1920x1080x96(1).x = "4294967295"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000020000000100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0\0 = 5600310000000000e95cbb7c1000526f616d696e6700400009000400efbee95c2c72095d74232e0000007e000000000002000000000000000000000000000000ff8e140152006f0061006d0069006e006700000016000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\MRUListEx = 0000000001000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).top = "229"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
6052	PING.EXE
4380	PING.EXE
5360	PING.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
1456	explorer.exe
3128	explorer.exe
5148	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
4180	powershell.exe
4180	powershell.exe
4180	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeIncreaseQuotaPrivilege	6068	powershell.exe
Token: SeSecurityPrivilege	6068	powershell.exe
Token: SeTakeOwnershipPrivilege	6068	powershell.exe
Token: SeLoadDriverPrivilege	6068	powershell.exe
Token: SeSystemProfilePrivilege	6068	powershell.exe
Token: SeSystemtimePrivilege	6068	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
1456	explorer.exe
3128	explorer.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
3396	chrome.exe
1456	explorer.exe
1456	explorer.exe
1456	explorer.exe
1456	explorer.exe
1456	explorer.exe
1456	explorer.exe
3396	chrome.exe
3396	chrome.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3128	explorer.exe
3396	chrome.exe
3396	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1456	explorer.exe
3128	explorer.exe
5148	explorer.exe
5148	explorer.exe
5148	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2308	5092	2026-08-09_460c602bf9c62c468b09fcf2d7c44aa6_elex_wannacry.exe	90
PID 2308 wrote to memory of 5748	2308	WINWORD.exe	91
PID 5748 wrote to memory of 6052	5748	cmd.exe	93
PID 5748 wrote to memory of 4380	5748	cmd.exe	94
PID 5748 wrote to memory of 5360	5748	cmd.exe	95
PID 5748 wrote to memory of 3812	5748	cmd.exe	96
PID 2456 wrote to memory of 2812	2456	chrome.exe	99
PID 2456 wrote to memory of 1592	2456	chrome.exe	100
PID 2456 wrote to memory of 4236	2456	chrome.exe	101
PID 2456 wrote to memory of 1592	2456	chrome.exe	100
PID 2456 wrote to memory of 5776	2456	chrome.exe	103
PID 2456 wrote to memory of 5776	2456	chrome.exe	103
PID 2456 wrote to memory of 5548	2456	chrome.exe	104
PID 2456 wrote to memory of 5548	2456	chrome.exe	104
PID 2456 wrote to memory of 3148	2456	chrome.exe	105
PID 2456 wrote to memory of 3148	2456	chrome.exe	105
PID 2456 wrote to memory of 700	2456	chrome.exe	106
PID 2456 wrote to memory of 700	2456	chrome.exe	106
PID 2456 wrote to memory of 3132	2456	chrome.exe	107
PID 2456 wrote to memory of 3132	2456	chrome.exe	107
PID 2456 wrote to memory of 4052	2456	chrome.exe	108
PID 2456 wrote to memory of 6072	2456	chrome.exe	109
PID 2456 wrote to memory of 5028	2456	chrome.exe	110
PID 2456 wrote to memory of 6072	2456	chrome.exe	109
PID 2456 wrote to memory of 5028	2456	chrome.exe	110
PID 2456 wrote to memory of 3392	2456	chrome.exe	114
PID 2456 wrote to memory of 3700	2456	chrome.exe	115
PID 2456 wrote to memory of 3392	2456	chrome.exe	114
PID 2456 wrote to memory of 3700	2456	chrome.exe	115
PID 2456 wrote to memory of 5456	2456	chrome.exe	116
PID 2456 wrote to memory of 5456	2456	chrome.exe	116
PID 2456 wrote to memory of 2564	2456	chrome.exe	117
PID 2456 wrote to memory of 2564	2456	chrome.exe	117
PID 2456 wrote to memory of 2580	2456	chrome.exe	118
PID 2456 wrote to memory of 5116	2456	chrome.exe	119
PID 2456 wrote to memory of 2580	2456	chrome.exe	118
PID 2456 wrote to memory of 5116	2456	chrome.exe	119
PID 2456 wrote to memory of 2824	2456	chrome.exe	121
PID 2456 wrote to memory of 2824	2456	chrome.exe	121
PID 2456 wrote to memory of 4128	2456	chrome.exe	122
PID 2456 wrote to memory of 4128	2456	chrome.exe	122
PID 2456 wrote to memory of 2116	2456	chrome.exe	123
PID 2456 wrote to memory of 2116	2456	chrome.exe	123
PID 2456 wrote to memory of 4244	2456	chrome.exe	124
PID 2456 wrote to memory of 4244	2456	chrome.exe	124
PID 2456 wrote to memory of 3444	2456	chrome.exe	125
PID 2456 wrote to memory of 3444	2456	chrome.exe	125
PID 2456 wrote to memory of 3348	2456	chrome.exe	126
PID 2456 wrote to memory of 3348	2456	chrome.exe	126
PID 2456 wrote to memory of 3976	2456	chrome.exe	127
PID 2456 wrote to memory of 3976	2456	chrome.exe	127
PID 2456 wrote to memory of 1888	2456	chrome.exe	128
PID 2456 wrote to memory of 5428	2456	chrome.exe	129
PID 2456 wrote to memory of 5428	2456	chrome.exe	129
PID 2456 wrote to memory of 2888	2456	chrome.exe	142
PID 2456 wrote to memory of 2888	2456	chrome.exe	142
PID 2456 wrote to memory of 1392	2456	chrome.exe	131
PID 2456 wrote to memory of 1392	2456	chrome.exe	131
PID 2456 wrote to memory of 1728	2456	chrome.exe	132
PID 2456 wrote to memory of 4256	2456	chrome.exe	133
PID 2456 wrote to memory of 1728	2456	chrome.exe	132
PID 2456 wrote to memory of 4256	2456	chrome.exe	133
PID 2456 wrote to memory of 1548	2456	chrome.exe	136
PID 2456 wrote to memory of 1176	2456	chrome.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_460c602bf9c62c468b09fcf2d7c44aa6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_460c602bf9c62c468b09fcf2d7c44aa6_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe" -r
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2&del "C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe"&ping 127.0.0.1 -n 2&rename "C:\Users\Admin\AppData\Roaming\Mozilla\00002B4A" WINWORD.exe&ping 127.0.0.1 -n 2&"C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe" \r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5748
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6052
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4380
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5360
  - - C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe
      "C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe" \r
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:3812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffecf58c728,0x7ffecf58c734,0x7ffecf58c740
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,7792507618835599049,7118921443461647946,262144 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1428,i,9649649543384397829,15334873912848596936,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,2534991486722962528,7046541742470927879,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,7211207391032498097,13899768326164064627,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,6678708052887013642,5524492659477422260,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4364,i,16756468924070869331,17286134260928703960,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,15420504674287710122,6846909988720550943,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,16816896290807876609,18177210935724718164,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5380,i,5327284037131022547,4143689350202024744,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5392,i,13075244936902723825,14293531077367951438,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5708,i,10722361623541326057,2650129004628519750,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5572,i,5557864790884847818,2086032374577982912,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5580,i,9049028810264303591,3020431668304904455,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5484,i,11759664974757574785,12057379967401577835,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5364,i,11423727485201978193,16533409983733323313,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5664,i,6679703023431290030,4100727326115793866,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5688,i,4168589191003087817,5041886606309513124,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4656,i,13545549110470962901,13299808967321517245,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --force-high-res-timeticks=disabled --metrics-shmem-handle=3592,i,8446430210708841180,11380091486039332569,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5632,i,6997457131187324472,11178407432961645528,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6112,i,16105969901299289605,6264048752245696463,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5288,i,8043956091683553294,15194848623737535797,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5808,i,4576761737804002139,3106717155905939326,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,4252998811994817426,17317393018428783470,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6552,i,2198301262818439978,14305209501732930976,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6644,i,14687420460877575920,10547984953200364346,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,17140172601587881092,9722560280808972168,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6776,i,12890038240650597081,3107115737266591206,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6764,i,11888588670476555963,10574284440847099607,2097152 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:9
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6292,i,8742990769705457301,15895567160930963966,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6788,i,370249035161442740,3829517769815119649,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:1176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6800,i,18070778601699665103,13378402186224387066,524288 --field-trial-handle=1800,i,8967644531832129239,140285047530834286,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:3132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2284

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Analysis\RunDownload.bat" "
1⤵
- Executes a command shell one-liner
PID:1716
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:4576
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "DownloadSysinternals.ps1"
  2⤵
  - Badlisted process makes network request
  - Downloads MZ/PE file
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Analysis\Run.bat" "
1⤵
- Executes a command shell one-liner
PID:2720
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:2196
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:6024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "Check.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6068
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eb3b1rxr\eb3b1rxr.cmdline"
    3⤵
    PID:3032
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D13.tmp" "c:\Users\Admin\AppData\Local\Temp\eb3b1rxr\CSCFDB2528E50794274B96CC566F4DB123.TMP"
      4⤵
      PID:3740
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" /select,"C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe"
    3⤵
    PID:264
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" /select,"C:\Windows\System32\zovem2qqrrsugg.dll"
    3⤵
    PID:4300
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" /select,"C:\Windows\System32\zovem2qqrrsugg.dll"
    3⤵
    PID:4036

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffecf58c728,0x7ffecf58c734,0x7ffecf58c740
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1820,i,7737003845431376092,8159823045166010549,524288 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=2012 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,9917377183613218511,516178018037644673,262144 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,12292372212716380022,17677669157984648207,524288 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=2236 /prefetch:13
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,8356651673146769506,18008259719122789669,2097152 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,9073369590655971315,14445154457439246787,2097152 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4612,i,8683612601088166187,3647828394816414686,2097152 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,15730206490489209893,785360293063411507,524288 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5688,i,594065879345837708,7264601267251142762,2097152 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5744,i,11813905034803284539,8590689508015695472,2097152 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5952,i,14171306205617985953,7538608929539968852,2097152 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3588,i,6916550785691448973,1299529498223767671,524288 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3512 /prefetch:14
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,6061187159441213358,12835761891126304611,524288 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=4616 /prefetch:14
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6168,i,2234457662328965835,16914886150742775344,524288 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3564 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,3309784396838134470,1140720358749396848,524288 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=3540 /prefetch:14
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5288,i,8183935699736024915,12133478607880259774,262144 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=5960 /prefetch:10
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3120,i,16436755182349602193,9093204847910728000,524288 --field-trial-handle=1776,i,1034227815464332655,4374358776649728970,262144 --variations-seed-version=20260808-030039.458000-production --mojo-platform-channel-handle=4744 /prefetch:14
  2⤵
  PID:3140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5400

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2624

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 19f7bcb6d46a5486d85a7f7555974fb784e6f76066521a18910988910a2a6a83
MD5 073c6d601b9d60bd7f0f1abeb39e8990
SHA1 4bdfe54850857ef74dc5eed74a79d67707b8d0f1
SHA512 0c1b7c34d016141b5eca2cb7db218bc983d6be484adb01db1fbf2a606531539010df3392b779a15dac7f123b60e1ca7140759b26c9f787321d677cac66f449b1
MD5 SHA1 SHA512

Submit Download

5bcf8704-7ce8-4c07-9de9-077bb6602b89.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5bcf8704-7ce8-4c07-9de9-077bb6602b89.tmp
Size 414B
SHA256 3514df250744e08513d293d136922a2f8a73aa7dea520caf557c65dacc404c86
MD5 f5103b4ce66b2fc9b896632d660e5dd3
SHA1 5a2a2d0adffd5f445050b74b70111130ac04fb65
SHA512 df5790b3410191e0da6289dbf976206512f7bc3f992fad773edd85af4e45f376aa64ba2c217f3e0ba3ffe28b0a99c309a11c313b7818daf08afa06d0f701ee7a
TLSH
T1B1E02B65CD24EC3708FD172868510346DA54236B37608E9F363C81088FB4736459685C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000032

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000032
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
Size 52KB
SHA256 0c72ee36fc8f17f1973a2d2cef4805a369b78e7f25cd8276543e59ddb1ad0457
MD5 293c8b9dd1ce5b12ae9cdb2730347f0c
SHA1 9bc0055cf4dd0371390739d151ae6ef5f66098ad
SHA512 eec52a1e161389e5336e604b2a97613a50038b11444c948b59052cbdd51fcc3c300aab7c659fafbe9eb7b223045a1cd43811c65b1df334792ef86baf0c421b49
SSDEEP 1536:jmDhqE+FYOqTbzsx7ehMeGAxHL18DnOBcLysp:j6qEiwTfsx7eh3FynhX
TLSH
T11933F1B5674174BA3AA7F87DADE9CB876F3F3D0F569810ADA056893F18C84C27182091
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f7482625dbab1f1f189703bb8e77e3ad9744e52b2fb4cf5239eb9abc17ae895e
MD5 f16317f79608105f27d37392a993cfc7
SHA1 71e68f6a23a7b5d0456aaa2dbdacb2e132a6ed17
SHA512 3c9747579761c2d104828df6cc74b14c3e84c0bb55f6c0480df2f4162c75b0243afa2a88a42f4ef34a6ed68c15825212f9683a6cec1e44c80d81f4374e4a72c8
TLSH
T1C431F6CFE0BAF601CFFD3C3589A38D25696404528B14AB2F0104AE283702EF206B9830
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 98981b689c57e4012066ff77ea4cdd30e584a13a3bc4d03b6ec3ae0e0dc222fe
MD5 1eb401fa3cf6d3cddcc3290b962a37dd
SHA1 61adc4d89b70813778ab463f19d08d48f50c2ebc
SHA512 95494465ee08e7a824b621f7b670b3cca3bbb97ef2b54379f7becb85a5d0a7c1e3c72f46b81afb1568268f6f444ceaa8a38cdb824c36d242310035f1318d7603
SSDEEP 96:yUAd2aup/Xr8G5bpn/Rvlxdg8lfFhtlbS+pBM95kNZoaLSZDlD1dJI:O6XrZ5VLbOsulD1dJI
TLSH
T14E91E0CA9975ED08DFBD28380DEB4EB235390112C36F9F9F03855E643762FE5106A516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 d639d48aa7112e8e4ae46c49efaa6046a979ff0fab508092ea1e84b4030d03f2
MD5 1a0d2e19236726812676e0d0d50ed770
SHA1 0049b97463f067400059cf5ad52269a5b04bd9c1
SHA512 a90566860528cae181ec23594973d609d255a166f5bf3c439f2bd7c25b61364b923007ee7033ecbdeaf6b98b795ec977c92f71f4fee15f5f2b3b57d9f7baec56
SSDEEP 3:MsEllllkEthXllkl2zEklEOS+l/l:/M/xT02znEOS+l/l
TLSH
T14E4404147FDC4407C50030304011C35D0371F7504511DF4F3C511C575CC55450C40000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json
Size 10KB
SHA256 965203d541e442c107dbc6d5b395168123d0397559774beae4e5b9abc44ef268
MD5 90f880064a42b29ccff51fe5425bf1a3
SHA1 6a3cae3996e9fff653a1ddf731ced32b2be2acbf
SHA512 d9cbfcd865356f19a57954f8fd952caf3d31b354112766c41892d1ef40bd2533682d4ec3f4da0e59a5397364f67a484b45091ba94e6c69ed18ab681403dfd3f3
SSDEEP 192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
TLSH
T13B327DA05F9EF1DB9F9873F82F132C12A8564B518A95E9647F90DBC5B38D20F520243E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json
Size 7KB
SHA256 52a24fa2fb3bcb18d9d8571ae385c4a830ff98ce4c18384d40a84ea7f6ba7f69
MD5 0834821960cb5c6e9d477aef649cb2e4
SHA1 7d25f027d7cee9e94e9cbdee1f9220c8d20a1588
SHA512 9aeafc3ece295678242d81d71804e370900a6d4c6a618c5a81cacd869b84346feac92189e01718a7bb5c8226e9be88b063d2ece7cb0c84f17bb1af3c5b1a3fc4
SSDEEP 192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
TLSH
T1EBF1A568CC5D758CFC56B77987AA36768B48C5C9E14D3E2E12C30CA178F6A4888B30DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 24KB
SHA256 b7ac16d6ec77ba86e6681c500affc259dccb64b57014f045b4a57597f8dff1b6
MD5 fbdf671069715144757fcde164db1e89
SHA1 5d5f8b9064dad87b44a1eb7831a1cbc17e6a4964
SHA512 a9897b91dfa1f62ebda08cdd815eb317e11812679d64794a543fa071605b6113db5286c4513e5d732fff9087a67a6b3ed16bc9c327e0f82597e638d3ce5ef7ab
SSDEEP 96:neBCP7GUymDjyV8CymDQyj1jeQJERhxx5qZ9qgt:ncJUDj7CDQydihjyB
TLSH
T1F8B2E7ABAB74F807EF000D3A102F9137EB7BD4983FA14D65B41438608EB4757906A6BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 ab7ff3beb8e137e3a6b990dbd720a86f9393dd3debf2e9e9ff02703400667b23
MD5 9fd7a3fbea8ffba56b2702a41734cd38
SHA1 2cd8025e21bbfa34e25324fea8b6d454bfd30e5f
SHA512 1ef5e278d7b68dec001c82ac6497f9c181961c1c724b038db7da92046492b81e0a1a2034dc15e91232138816aeab5919666175fbb46f404312570ed5c93b90f7
SSDEEP 192:NDLHszDu+pt/tH+bF+UI3iWGV5WNkqp3GbqDoB:185b/tIkUI3ijV5WNkqpRw
TLSH
T173F371AF6F306602CCAD803B68A745B359ADF02F471365C69C6128B0CFE1757B05D5BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\000003.log
Size 24KB
SHA256 388ef3c2c862a8a6158da62461218cb4ae70e6ee669730fa577e66df287c804d
MD5 1187cbd000fa1baf680c5c69bdfeecec
SHA1 070471c9889042fb9cf731ece48831a94486759d
SHA512 f31daf1dc0af20b3273fd2bf37b3c0d7a613282945789b26d50c142901b0122cc0649c62697f7db921f1451d5d9cd2178831228bfacbca076a9f7cbd6c1fcf11
SSDEEP 768:euCfsnjMZFqwwrwFdldLgUCWPfsgwYTzJ:KsjMZFqwwrwFdldLgUCWPfsg9zJ
TLSH
T19CB2431DB4E46222E2B6DE3D95E615C7B9737A677C50CE4D40A2238D0966B22ECF060F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\LOG
Size 357B
SHA256 72c53804ee2bb1e745a32026f03e3b8be85fc504628e8fb52d6519063ab57eb4
MD5 5210f26d9f9a6be1232819a3b24f9585
SHA1 85b2da67647a6ce6fcbb4c40264827e24a0a4734
SHA512 25708a8ede164c0b31ab028d0c63cfef422f541f2ea3f7bd4250be4ff029a8b87a9a3f4aa62aac667c449bfd3dc67519feda3356957006b09bfc4ef1a82df03d
TLSH
T186E0682C44C8D26F067480A72464FB0EDAE7250CDBDDE8454F41D42431C900C60FC620
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 553e4be72c4bf7e0c05503ae164c117b0bf520725d444d65aad5ab243f616778
MD5 331b6330140f2b5adfa858360135d3e0
SHA1 d3cf27bb4a107da1a0106924f85992216fd083a1
SHA512 519e9072470b95dc7b82356fe4d57927066f8e35cc6328c912354d0efbb5fc71e0e06c77e1fa0008cb7fdf5dc7c31262930baf5f61467a97e0e8afd4692d2b7a
SSDEEP 192:D0uIo9AW/P1xqDs7mI2BCfR31/V2PW28WlNlznEd72hVp3sOUpJOVxyz+mSjhn+K:D0uIo9AW/P1xqDs7mI2BCJ31/V2PW28O
TLSH
T1B82288F383A4862DD81172F59B287E1FCE690924636C3C76C9D4AE4B93E2473E24064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3e1d6490d636a411ba083a90bfabf52c2042017d066d3479012080ff3803fcb5
MD5 207367214ce89fa526b7556117621096
SHA1 b1aa39a185c72a1532b141d3dd5e425be2005711
SHA512 d6fffb01d5844127efd08a4be5463470a496c07bc9b428576969f94a5de8a244d54c5cdd65cfdbf2b593e9b18e8113ab50fb21ec8432e42a513f1bcd47b2ccb4
SSDEEP 96:Dpw7uDunuRI2MR1mU0uNuKRurEuquuusuLuYuZuXu1uZuouaHwuO:Dpw7sQcI2MnmU0CfRh1/V2PW2GWlNHwD
TLSH
T1FBD199F3C3E4862DD81166F5AB156E2FCE691E24131C3C26C9D9AE1F53E2872E24124F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 91b7ded83b030895127d10036f3fa6d71b3a8de9d4a6db7f10d6e96f7eca65df
MD5 d89558e96885e5a9c12aa58e9bcf2e96
SHA1 9630420f5c7bd79aedf79faad7e3d690ebfd1e3c
SHA512 f05495f9956b27d0efc47d87de320d6cc77e2978232e84606c960c38b1095ae1c09914e73459af80f4001ed884aa5c9cd89f997178c03abae67a488569897911
SSDEEP 192:D0umIo9J1iJwTAsAI2BCfR31/V2PW28WlNlznEd72hVp+sOKj4OVNgZDA/qst:D0umIo9J1iJwTAsAI2BCJ31/V2PW28WR
TLSH
T1363288F3C3E4862DD81172F59F283E1BCE69192463683C26C9E5EE4B57E6472E24064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 8fa8e51b9d99b35ab955546c40d51eb70a42a568b06a5d6a04cd51b15571b19b
MD5 384af00632222c3eeb02a0744462090b
SHA1 c7cfa535f201980c52d61a071957305a9dc6d535
SHA512 36c937f3fce18a8277411779afdf272ef669c2bea0224248897cb16fe03e4c09856a85aea5035863c35304c5590130bd14bdaefba01d4db87d0d1660d2ad1921
SSDEEP 192:D0umIo9J1iJwTAsULI2BCfR31/V2PW28WlNlznEd72hVp+sOKj4OVNgZDPe9Ljhq:D0umIo9J1iJwTAsULI2BCJ31/V2PW283
TLSH
T1EF3288F3C3E4862DD81172F5AF283E1BCE69192463683D26C9D5EE4B57E2472E24064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 5114147dfb8bbd3affe2d69f5eebb51b416d2a6e19d3e50a740485bc91ff325f
MD5 2d7ca8cd7d3cbb53c1a92e58a1e9d340
SHA1 f4db188e9c3847d872ba82202455a2b1108c8a82
SHA512 651f773631cadd5fc46e0a4c0b3ab566858605e4b2644d05914927fe24d68d4ab5d060978c5249a7f709b70d67ec866e4ad56a455e545991ab80d2b1460344fd
SSDEEP 192:DsNxjfFJ1iJwTAsAI2BCfRh1/V2PW2GWlNSznYA72hVp+sOKj4OVNgZD77t:DsNxjfFJ1iJwTAsAI2BCJh1/V2PW2GWW
TLSH
T18E328AF3C3E4863DD81172F59F283E1BCD69192462283C26C9D5EE8B57E6472E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 bc782dfeab28d85f948c7f51acc395a469492c55866e83ebe19fb01f286595af
MD5 81545ee2d7b92aa30a2eee8b3e80e371
SHA1 121dee37ac646d5bee2a057635ae6c1d21255030
SHA512 05dc10d093d7630f508acf1d2895f884a0b4fcf8dcb2a109cb70675b0052d3711f7cfe66a5849f08531c323f1aff70cc56f5c0d7e5cdae98a7eb698c47d91304
TLSH
T12E415B63D1FEB867612C59BF0D0478052D7BA431029268F9DFAB82ACA0855F71B06462
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 e55ff622061a6d225c34cd8e317e8e72071a261f4818f11c95e0167f55ed2331
MD5 a5cf61f28cbb2e503db5cdfe0a59491f
SHA1 e63dc49ee84279cfb665978d34f5f36e0a32c288
SHA512 6326e8eca6431dd2ea131d7ee503ccd7ba78a9a88f405e1c995c5d4e439005c3f23cecd3f1b998c2c9b34daebcd506132f50df8b6066de40af75540e3e222d65
TLSH
T1C9217C53D1FEB877602C59AE1E0578056C77A43102A2B9FDCF6B82FCA0956FB1706463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ff1e35017667d9fae255c6f854b1b0dde11a317152c7bbb183f0705aaaaebf5c
MD5 90d9e52a82d2e149b7080b7772b1dcb8
SHA1 fb84f7d3be3b1f10e6443ee5cee4f9c6a001d298
SHA512 d10c5abb1ec6b69e987fe10d67d8445acf70052e37d1f480b88f897b9fd7f16afc179de67afe0218b370e244c1b398d133557e24a4d7e1a5d6ac6d63442d1669
SSDEEP 192:iRa/Rypdv7FwAPRp2c9CHsb+WNnWC0xkoNkkwvjahVyIsnAUge:iRa/cpd5BXfkwn0moSLaHe
TLSH
T19B42A42AAE10797BADCAC229F9557B53E7F5102531E42E84EBFC9D2C14E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f8a8a8ef1e38efa63b941c66825c1165b4278ea0d9c6f41344388d344d1bfd01
MD5 32113eb7e5d61052830dce5e9fe75add
SHA1 3f0fb30a57d423ca4f60ea04cb447dfa8a0df3e3
SHA512 4fbe97529fe7c5a62cb510e72a44780a449e7b16576e89f3025c5fded306e5bb52017a5b0a0d4752ddf0f42ffcba58f26cccbf64010fc09b081a2d409419a826
SSDEEP 192:eRa/RZpv7FUgPRpT6JSR9CHsb+WN4bSZ+vMsm122koNkkwvja7+VyIsnAUgraJ:eRa/fp5JXJkwR5r2/oSLa72e
TLSH
T10752D72AB910797BADDAC229F915B753E7F5102261E42E44EBFC8D2C15E76CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 27bb62f489e4e2372d11e7a2ceb0d81cf9b75e547dba52fd23e2b35f4d6e9efe
MD5 7155d2fea920bbceaf014f03b4784aa4
SHA1 6e17216d22ca95957207da9d99c1b89c99f1080e
SHA512 cae967baef10db852f79370f5ba27a73f3f4a1ce97152005042da625ef872a2c6fa35b2a08c03e344114b2438bf6e393ea163588befffd6aa4ea4a8d6ac8d0a6
SSDEEP 192:eRa/RZpv7FUAPRp21SF9CHsb+WN4bSZ+vMsm129koNkkwvjaH+VyIsnAUgraJ:eRa/fp5FXPkwR5r2ioSLaH2e
TLSH
T10452C66AB920797BADDAC229F9157753E7F5102261E42E84EBFC8D2C11E75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4ecedfc7a18e65a90dc7c1291529e971570353f2a54f5516c0bd0214a7ff110a
MD5 ff01737e609bff22f52de96c7057c98a
SHA1 883542ed124b4934d6f8a55b9f53f24edf6600d6
SHA512 56876e719e10a28474acbeff7b2c54638dcb3c59d54f3689bdc2509565c1f2167f8ac6b4b4d98c3c345309efec66d8700d82e2bdc0dfc0ae4d08ba6adce8105e
SSDEEP 192:iRa/Rypdv7FwAPRp21q9CHsb+WN4bWC9vMeLkoNkkwvjatPyIsnAUgE:iRa/cpd5BXfkwaqeYoSLa5E
TLSH
T1DD42B56AA910797BADCAC229F9157B53E7F5102221E42F84EBFC9D2C11E75CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 eae5d1fa9222bc4b9f0c2e257179508a7c8ca119311b8d58c70547f3ce45617f
MD5 c47367564d879d40f092b589cd44b856
SHA1 ca372cce94f9bf2bc9600f10e44c2e079af2b306
SHA512 f6ad6ee8be3dac1101284353ea28839d1d954cb3eae876c81ea1684a3bd683fa21b942c1c12d1e37023e907bd0cf106e534eb69a8b4dbf1aa8d73a9bce83a20a
SSDEEP 192:eRH/2Zpv7FUgPRpT6JSR9CHsb+WN4bSZ+vMskbeokoNkkwvja7+VyIsnAUgraJ:eRH/6p5JXJkwR5jeRoSLa72e
TLSH
T1AE52E72AB910797BADDAC229F915BB53E3F5102161E42E44EBFC8D2C15E76CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 30ff0ef923bc9ec2a54f3997515ec48c6ad4f812284b46d95641cebedbd4b43f
MD5 c5fa9af357a716c3edac8a06a0027442
SHA1 2a515026d95118ff9759b172a2a13fe64c48d071
SHA512 ba15751447e7e71415d969904297e1e62ee99c18501a5ec5d46a383bba63b59b2836e1ca8d363a6a35473e6b7c1431b95d7e2218def3a2b045ea37ddc83d332d
SSDEEP 192:eRH/RZpv7FUgPRpT6JSR9CHsb+WN4bSZ+vMskbeokoNkkwvja7+VyIsnAUgraJ:eRH/fp5JXJkwR5jeRoSLa72e
TLSH
T10152E72AB910797BADDAC229F915BB53E3F5102161E42E44EBFC8D2C15E76CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 f04f2893d8031a97cb72a1ec8581af89df388211aca56aa6329627451f53c6ad
MD5 44a9d569ccea9ed83af2371d261dd50e
SHA1 389e58dbb081769ef5a35e80b4e7a0b5cb0b2cda
SHA512 a02d6a7401245e5914df328468cb888075286108829fe55ef473ee78672dfa03a821bbaa0093a29514b5944bae47dce7513c9aeb6c49835f317dcd214fdb2447
SSDEEP 384:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmXODdc+ErU36hHGh1X4GgdkD:BLbC7KxkXqKf/pUZNCgVLH2HfgsPsOZD
TLSH
T1EA52F767648D9A3F4FC8DA4CDC166F4FACB5025666A84D2493FB5C0803A97CB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fd24befbbb505c8ddaa9d31c9c58980da2280fb00dfc2557a9c5e9f8dc38b48f
MD5 281f197f289b24874af7645c3298522d
SHA1 4ec98daec1bfed90bf85d62873080b69ed04b849
SHA512 9d11e4ad66887f1629d29a1654235e9380f206784eb51d92b3313c980830e860fc829c4581f6c2261f53fdf478d5f49b753df551f55932bac89a404993fc2893
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKNznQ1XdSGoZ:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNmO
TLSH
T1CD32D827948D9A7F4FD8D90DDC126F4BBCB5029672780D2897FB5C0803A578E214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\10931ba9-e4e4-4187-a478-af8861c40372\index-dir\the-real-index
Size 456B
SHA256 b85897b91528e9ff653c1f42e232b2f83b1aa37d7b45ef1a68ab330885980aa6
MD5 73e4337c23da75625d0da038dc0ccbb5
SHA1 589a62159cb05bfb140c78c9534aa7ffbaa0e2f9
SHA512 fdb6b3f35473e6e2b9fbb12e30cdc1b56682a2d9ecc7ade6447272dc26e84ce401f20b01d0496d5df951d8460faee5056363fc68976b9d7ae10b31d6a68092a8
TLSH
T1C3F07D5DD95D929BD01B09FD0120106C0169A229FC31820F01C03E447C4DC03391397E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e5f35.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\10931ba9-e4e4-4187-a478-af8861c40372\index-dir\the-real-index~RFe5e5f35.TMP
Size 48B
SHA256 729e850a9bff11a0d8536feb2ffb5a4ecf37f8417297d2b71af4c1c434034243
MD5 25fff703a613e89453da23af8d239c38
SHA1 34df5b39313a3e6e98a0152493f6ceec5d7e0490
SHA512 971af541568f0e71815c4ca3f2c6d1f20f846e3c7280b577eec7c72d0e08dee397a9706f5f264e458aac1806cc6d2c4c2b3503a9318da7e3a8b78beef920fb0a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt
Size 147B
SHA256 763eda83938d06f5cf96d8e26bc5245386d092076074d0c2602ebefa570766d6
MD5 18915c222b5fccb9b71d9a76c238edab
SHA1 54c20b3154a4aa29513f4ca852f0176db90e273c
SHA512 d3db4affbf7e433454115f9a40b64b19390599ba4df96df7af8eb9e1a5b2fc564e46171b9ed350ca84865a76e6bb6cf0fa89909a0d360eafbed98a1318e6d0bb
TLSH
T161C02BF30420A0404F14F1C020FDD775C31324A6F4EE48CCC450D0E098C012F0420F13
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5e5f64.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt~RFe5e5f64.TMP
Size 152B
SHA256 39f7baaa625a06afe281d94f43e0255e6c6f970a8b096c2b3202990e1114bd15
MD5 476bef04e002a1a9b800d59d1aa9c353
SHA1 f42fcf505bffc934d66346a30bef20977678c5e2
SHA512 67efe510043d6ed47b3a35dce36445d27d58ea9cb35f91ddd33656206230bc6707c7e066ff0ff69d6d1114ed89042a20621925f73a100d5386bcc6146d472d2d
TLSH
T103C08CF3042060000F14F0C150B9C7A5C7231CA5E8CA48CCC091B0D198B012B0424E12
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 333B
SHA256 65498a321028829100e57e74d75138b69e4bb60ccbb05646ff6e257fe905402f
MD5 b8a0e0ef71e316a53e0df6cc97a39885
SHA1 83e20ecaa077dc64729642b5d75d291975aeafa5
SHA512 02ea6509f5f9045f26fdc9ff6df9b342354ab3fa0722b964348d569be06d70eef38dc47ea0a1e96ee1d85edab2e3b9dac093fa749c0a58dc870772911ec74d0a
TLSH
T144E0CD592DCAC1BF14D5C0131274A71CE7E8780FDBCDB8461FC9D98812C5919B5D3AA0
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 169KB
SHA256 1e53653e043fd54f8f7c3a419106a7b508c97bf25f2b7133939c79da2a7f81ac
MD5 1467018be0f0f8a26ac9e4f49b3b4690
SHA1 d73b999a5ddce8fb1903d45d93f78fc1bd24dc60
SHA512 22fdb7b8f660ee94648842984492c7b873845de73bc9cd40144ce60f296f0e924c21908cdd375e508288642bbd92654f1f60e7bbdc238741115be884699a43b0
SSDEEP 3072:+LejzWM9SNxPCD1hFiY5KcukCQG1KUfC14Tv:+kzWUF1KjjOdQv
TLSH
T14A044457D1F899636F6B0443E8857E82B32C3147E619DAA1F987BFF0101EA2A70F5835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 223KB
SHA256 99977d01c681b5d172ef37e568acf6ccbb7649d1b12104744c263d7d104c576c
MD5 223de510186f6199afe82eedc0f08c72
SHA1 49b7960123265b0225ca82e0940f01097f69b369
SHA512 6ef3484832c278c91ff75ff1ec02f9721e7898b1a1621119e3f9b556a237b7806b5bcb6830acb4b884a704247e0422dd0cf6ae51e1ec94b316a836487a54197a
SSDEEP 3072:JKft7RVaGfkGIZa1CwCRdfxa5U7ksewUqy1mqhSElhX:J0eeiwCwCR1A5UFewjIms/
TLSH
T16B24099A632217BFDF7943B95103BE5113210140EAD3C0C6374A579A242EAD7B6BEE3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ea99b005c35179184a75480a8372917993ad7792ba6a823660ee09dc7b5786ea
MD5 7621a52930a1fcbc12b75c777651e3e5
SHA1 e991131d91d2f1bad6ba61ad2e17439fbab20642
SHA512 48f711c7752a5dd36af2bffbf29716b6be430c64e0dca6799c3975df88713a786107766a9c88f0bec0dbd381165fe0a2b79ca7a4800fd3d49a1eb8c7dc55f585
TLSH
T197B012008146A611DC0141B01E46114E61006F22C0103286A7F4FEE6D8570F03219100
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13430723311878936

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13430723311878936
Size 8KB
SHA256 517d3972b9c77649b21bc5175aa28794ac3b5edde4a725ebd44414328cda0fa3
MD5 b2e3975a834a8d93fe3994b467781535
SHA1 317d5491c43004ae2d21ecfcda194e3b2c05fe60
SHA512 6fed6eb09e4ebcff3e325cfb0dd1ab02aefaa0d4dfe67f07570a910ad0353fddf8fc4965f481db0f7bfe5692cdc5bd36b0d9c43b11ed4736db238ba5f0433db7
SSDEEP 96:3KkwhCNmAymD/9NxymDDeRYt9qVywHcOlNQDlg2B3s:3KkwUIAD/ZDQYDwHcKNQhg2y
TLSH
T14E12E0157BF8113AE1BF863CE8F521B3B976B6123A418E6F455142140C13B425AB2FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 692d8f403f5ca20d4d9cb3811716f92c1a7c33c67a55b7271a62fda9a03229a5
MD5 98145023f55e05ade28933e2601fdf5e
SHA1 bf42913627e5ac3eee5b956502734dff0379f997
SHA512 bf8acc03fdbe016b87446598251bebc63dae849304b3b06cf63f1f1a6f5d2815424c73a7c073b47d95ca5d0e1d25dcbf9e061b887ba5707c47867385d8512b67
TLSH
T1BDB012803F116116C0C969B1079187D35A61F087203048239C2C5F704E1A19C3E068F8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 eff52de85d132107dee6c8223866f457665ce039d01b839a7469f68d72d84385
MD5 e153d067c9f764376b5e1b67d0f8a560
SHA1 310ecdb6fae1774e4b6ba107bec5c56275b6d23a
SHA512 32030f1baab7211671d9ead8ef153223a3b89e2dfac902ffd6cc8f0ea032c52fac4ca45fdf8c22ba89da2df75c6f3a31078d3c2da36f8984436ed4ce2e407eaf
TLSH
T144E080642DCAC76F1546505B6254FB0CC5E2780CDBDDA4511F5DE5485385514F1D3F90
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b6ca1166a77c4abe5a22800f26f606e91de4dbe627061fbae755489ecefc89b3
MD5 ecc4b80f469428255de0346b9419c486
SHA1 71ebe92c19c87c5b9bc76f6f019e8b8efbfbe01f
SHA512 3af70d8a876d530b273ecac904e5d1452e99b8f4ad68c465950be7d105f4b280f2e82a4627542e147e23517643074d3edd32f4c5aa3f5d0d028a4d9bffe64fac
TLSH
T13FA0022045E40461CE5945B0A52116417641491916D3971FACAA6944DFAB0C0810D614
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b15d6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b15d6.TMP
Size 48B
SHA256 a3121bb457211f29bfca99ea0f2095a9f939518cab03d527b6616ab422069677
MD5 8ab1ac779f0dbcc7861bb9a3596dccbc
SHA1 9edb03de493c385493e0bca85ded47483ba103a2
SHA512 d053d2af4fc6b1b14299a3c7ef5f4b9c5571c4c201d0b829d7951187d1b523838bbfd7479a55169b4f92d3c82089fbd4a1296d5c92f9f29f0ec2f5c9f487dccd
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 865c03d4b1b0dd91e37ec4c4d7ec0e963c3491641ec87a2e0a751879fbce7e2d
MD5 8c67d78afb6fd9c82fb14ecc9dc808c7
SHA1 42dfaf156ae7a14bf49380bb2f62582a7a0c337d
SHA512 86c38571801e859da9ec1b3413ea41d968aa88307c9f3ec832979f8df32d5f7e6ad83aa17b992aafc30d1fd98ac8e9c17856131550f508f6d0645800978c6aa8
SSDEEP 3072:bzXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIq:bkhxNPRW2PYddqmY7U52FV
TLSH
T165C3123078BA6E784C5AEC0C32473C1A9EF6DADB70D87FC5E9649F0A015FC54A663854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 18977daf2ba2bea0a33e532f86b3c6cab86164209cb4274138823ec5502bbe6d
MD5 b0715d32f76014f5ad47894b55b37cc3
SHA1 9ee8aa3f69b3c75cca9aee22b93ffac3a21abe2f
SHA512 3a56900375086c61e974af7e074d5cf8d062251bf81e4b0f211d1f2dc73f29de08c940e54b3922883bcb6b2e942077b04a536381e9d9a03eba670379759376b7
SSDEEP 3072:lXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIT:GhxNPRW2PYddqmY7U52Fq
TLSH
T132C3121078F96E784C4AEC2C324B3C2AAFE69DD870E83FC5E5659F0E155BC60A1B3954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 e3fb8d4ac06f83cfc1a65e9149e31ecf611491b71c4f3ee66aab60bd35cec082
MD5 f88de9552ef85d5dfe6fe613c1380486
SHA1 915a09c60b38ed3839c1a8118760ac15f9f34203
SHA512 a95bc17381cb1e8dafe20becc68bb450bda3a4da89f98264e4daf371330919bf90f24cd0d9ed86eaf38a9dd770a29570d2d35a31c6cc55f8937ca8623c801441
SSDEEP 3072:A3XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIq:AwhxNPRW2PYddqmY7U52FV
TLSH
T1DFC3121078B96E784C4EEC1C328B3C2AAFF6DED860D83FC5E9559F0E155BC606163954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 85592c54a8922f7f5a3d89803257d387ab13ef7e9b3bd5303044c1e87326bad6
MD5 19cc32805cf14bf303d0d1cb2b843718
SHA1 7696f5caa97d121a3180a5a53662c37b8a8b9190
SHA512 de8d0c0f6d5fd035939ba476a4d6491aa72183908734ca14cadbac003454e44b85359f1e30c54f4451792bc79a627ab56ee2ed33471e41263912cd1bf21d2e28
SSDEEP 3072:43XQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIq:4whxNPRW2PYddqmY7U52FV
TLSH
T144C3121078B96E784C4EEC1C328B3C2AAFF6DED860D83FC5E9559F0E155BC606163954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9b11b6586c291d50077397354de5afec1b0dbb62f028cf87bf71240a3db365a8
MD5 b14a4dadce3baf3fd770f59f24dc5421
SHA1 1787e439b1b3355215cd9d785d8cf9ac5b78d70c
SHA512 4d30d03b1922080eac968699958c77c1d69b928b8ea7b8f5b85e370066354c0b3c2d454de5cd55c1150fc07c0a0f3a90177773842b806b7ca9277dc31ce464d8
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5yAVDDB6xGyv1T5yqbKv4a:MkC01N2c6AGDDUDy8d1U5yqbU
TLSH
T1C1A10932586DACB788B2C549B5522E03DEB8712BF921AF94E6DD5F0C11F70EC2381617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 db245d7871042431bab65425672102f06f409f28d1700bdc0db831a2289633f3
MD5 970c34cf1f88ad5e01907499f174487a
SHA1 342eb65120b6a3eeea359ff8cc0b418714986208
SHA512 2ffa4512484e83977fecd8bd666ebba22adccd9c6bbe99f6580d8a4deb7c4cca523dcdf744f21bbc72374f54b0ea945df4572ba5e160ccbbe0010c023b294a93
SSDEEP 3072:YXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIT:bhxNPRW2PYddqmY7U52Fq
TLSH
T1AEC3121078F96E784C4AEC2C324B3C2AAFE69DD870E83FC5E5659F0E155BC606173954
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 e7708a53473510bebf4d7c94ce52a510e1674f993602e34db3bf1d4fe7430446
MD5 70d4f275bfa41dc490c49131189bddb0
SHA1 a5df07d8a9f59b1274a3195e0f93a1840e789fb0
SHA512 946192b4430147bcebe2b07ab0fa89ba3ff4d357809d7d17702e5c28bca3bac5630cf23b0b099bb430a3627050f811c7b49d6e0549a8beecb46b82186ac15d92
SSDEEP 3072:XuXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIq:X5hxNPRW2PYddqmY7U52FV
TLSH
T1B6C3123078BA6EB84C5AEC0C32473C1A9EF6DADB70D87FC5E9549F0A015FC54A663854
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 02e817f7f49733431bd02789166524a47aa42d31f6ec1803343dbf3a4c4ccd00
MD5 f0b8872883bde149773116eb425aa723
SHA1 ef7910e5460a6db873c24c4f1a4899f6b886c1ec
SHA512 78c49d8f6ab20fd0c91902c084376f6f7c870c9dcd1d24268f0e4c41e4894d57886295edcb2284e76cd48188bcd41734ba167a55d0b82c55a85a4d88f4f3b00b
SSDEEP 3:MsEllllkEthXllkl2zEklTa/l:/M/xT02zn2/l
TLSH
T15344040C7FD00407C50031704035C3500370D45305315F4734510C775DCD7400C14001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 4e965cf56adad362a9390384bc01cbf2ddab3da8ce9bd855991d7f613b12776c
MD5 54b00ca649dced4309a73255731b7ca7
SHA1 5375e3a3b1467b4b0bade91b896db8a354d918e7
SHA512 eec03a31435aac43d10ed813038a763a1033ff5086e64cd95d6b8a4cb1193c3e456c6087c05b4c45cc645df78278fdf81cc04d7c334784419ebde92f6ba943ba
SSDEEP 24:T66Qcn/CVdn+xxnFn6ZOTs0n/YSRltqtD9ijuoxAYGduhr2fk05b53HxOSRtK0Je:TkkhCU2QB2zbBxxVS+FmDg+FS+f
TLSH
T13E23CE4E276861EAD4E5083EFED34D6278BE1F588A2B68D245D01C728DE159F903F0BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 376018e6acff14b5a76b2d14c837ab6ab5eaa0fdb0e2ff1b0a1f0743848bc372
MD5 a9844034d2468072e216ac643a44678a
SHA1 195da9249eeb27cbdb78df3696b61853dcacd99d
SHA512 fe7a4898898ad0444b6b2a6d10115cace3b01ee4dd3de257066a54d89502fd896ad79c4052ab0f04a363eb176f8efbfb967f41c255255c8f64fdeaf86b1c63ca
SSDEEP 1536:1KLg07Yo2hkovpfKQVAflJdpHYWh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hkovpfKQVAflJd9YWqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4D13.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4D13.tmp
Size 1KB
SHA256 2095dc90874c11a3c9793cab92d27e07eafa87daa961555f79e913757cc036ad
MD5 1322e9f51f1a88fe4950c0f12c98c84d
SHA1 0a1bc5c1a28dfc6d981b777ee67afb8ed2eecfd5
SHA512 a9b732e17250131a2409a7cae760a47c312b0021460eae4294e4b302ed54cc3a1f3e9a4db44a90d82bcb75b5dce90726e2fc9b955feccddf97046a9f1f503931
TLSH
T16A21EF0553EC030FF073473169FA175F9779FD55EFA2579A898002292C61144DEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tugfsiyu.qi0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tugfsiyu.qi0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

eb3b1rxr.dll

Path C:\Users\Admin\AppData\Local\Temp\eb3b1rxr\eb3b1rxr.dll
Size 23KB
SHA256 80e6148d2a95373367b2fc18c46614d63b043202fd027c02a4d24846124fda3b
MD5 691e8570b1f08c604147ef7a5d4951aa
SHA1 550cebe28e5bba7236e3c09c5d663f6153203b40
SHA512 c5b09a123af9291b49eb54cf2884e7ed16d566ec0af81ede6f723547741ca021a69ff37ef7500db00c45f8fcc58ba26eae9c6fa809360430149ff9d0643e9b0c
SSDEEP 384:XLiqzcs60ZTi1U3D0WaXRp1Ktsn+qxrY3RFG7xpsWiVkn3sfkbA87dCQrUdT:bnv609EWwj+eYBFIEZ1T
TLSH
T1B1B2390EE3D945D5F4FE1B7898B305292BF0F45A6A72D31F19C890A91E737A086207F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2456_2140269786\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

00002B4A

Path C:\Users\Admin\AppData\Roaming\Mozilla\00002B4A
Size 49KB
SHA256 21fb6a32ba346b399e291caff7a4fa2516e48e99dd3048a70e512ade0f29f57a
MD5 8c7bd697979ea030994852c71525607c
SHA1 c9ba0cf54e531488c73912130fe2493ec6f880d3
SHA512 e301724f81f431c0cbee713c38c29b9774ced0a0f45055dfffb4b5e2c93ad0c2ed97a51917a4909f65478587381e8e9fb7814a84db5c61481f8d9a292cf339f6
SSDEEP 1536:4LsF2Kerc64sTiX2IV0Dhuj4p4kojVR6h2F:4Ly2Kerc64CiGImVu8p4kojWh2F
TLSH
T1EB334C0A2BD650C2D56205B0E99A0F75833FDC3A2127A75EE740765A1C72D6BCF30E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINWORD.exe

Path C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe
Size 49KB
SHA256 824e30b4a3603c12d1d64f1b76ca42cec377b46323185dcb95683bd24267c869
MD5 460c602bf9c62c468b09fcf2d7c44aa6
SHA1 2c88929a65ff59e611d7d483057c3f27be5f22d4
SHA512 d8d65ddc5263aeff545e7f34391013277ecada7dd2425dcb51c0e71f3f4593609b0bf213d67e1fb8cce3bdec0edd4aafbfcfa41f74cea29b3544e702a34a53dc
SSDEEP 1536:4LsF2Kerc64sTiX2IV0Dhuj4p4kojVR6h2V:4Ly2Kerc64CiGImVu8p4kojWh2V
TLSH
T180334C0A2BD650C2D56205B0E99A0F75833FDC3A2127A75EE740765A1C72D6BCF30E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Combined Tools.zip

Path C:\Users\Admin\Downloads\Combined Tools.zip
Size 34.7MB
SHA256 b2ada564ab0c6dc1e25b8129af74fa1d647fbe26fbaf6c72f464cc99399ef13d
MD5 ddde57cdec3b671fbb8c10e9e4f4413a
SHA1 4095c07a0f35f598024fd92cc94373ea5d81dbcc
SHA512 6fe16585f132715a95571fdfd7535a975844d22c29f3dca0f2658686d37857b26a92bee87932f2ac94da6f1ae77740fd526accd39b8768cedac8c6b39f13fc34
SSDEEP 786432:HQDYgze5foQHEeswe4AL4N5JPfVRKxhOOjzpmtIR0:HQDLzyPEzwRPnJPfVRgnjFmKR0
TLSH
T1BB873366BBF8495F580A74E3F47AA48881F9F47A4C806463FF48D31782D93D366B424E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCFDB2528E50794274B96CC566F4DB123.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\eb3b1rxr\CSCFDB2528E50794274B96CC566F4DB123.TMP
Size 652B
SHA256 deef9d20eb9ea7be742898062a7b43e8c13004ead31973a9da1b32542003698f
MD5 38b48a35bed83c3c0e108f3a94ffd155
SHA1 77652c55cfa9be7c0511f390e4f6c0c19dee107b
SHA512 d4b2d2596a9a2f174f94fdc28d3033cca5ea1c55eeea17324f916a86bcbc5251a12be88b1c09e1cc9df261043e68e8e3eb7af81dd3617f632cdf86dcdb4e9eb4
TLSH
T1A9F05E0963F8020EF0F34B30BDF643A395B9BC65EE32A3ED1480132968745148A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

eb3b1rxr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\eb3b1rxr\eb3b1rxr.0.cs
Size 50KB
SHA256 f18ba548610e12206c3c8c4ba0b3a67d3529c7d1d20a1f2ab9e68b32ee318808
MD5 6bde19d9c032ca55c654950fac61b154
SHA1 7ca77f0f799dceceb28cbcee9e55ee2e2bc060db
SHA512 a58e80f9898c1fec02014a6586ac143b42cf2ebe50825f1964a181cb52384c1227362b6c16d050dd6f1801bbd4bbff4d1ea58c2d2558356d8470881ab2cbb680
SSDEEP 768:4MQYsfx/8PZb7Nlp6TWHxpD4fZ+qDGfpttRI3YP9b:4qh7NJpD4fOrI3YR
TLSH
T159333109521995A94CB27379EED1808AFF13407706BA1720BCED93502F76528E375FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb3b1rxr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\eb3b1rxr\eb3b1rxr.cmdline
Size 369B
SHA256 0600183bceacc99a0e0ab32501e6a9e6b380d54ee09345f284d4c5c65b0c754a
MD5 5ee30dbb3cae1c6ba65a4392f05c1b07
SHA1 c826d2ddb7c2f1d36a652b7ad6d93f60dad3f8f2
SHA512 232a6b5b50c7e9edef0e0829e2eb94a7fca6c66e71210e13c97380e5b86fa0a1ca41a41c5d17e9ad8f774d45c2f31932b473bc0257d5b74088d713401d662391
TLSH
T1E8E0D82AB356CABD15E911072169C9BC8372164729417F8455544C6DE117005AFD1B57
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2308-12-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3812-1733-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3812-16-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3812-15-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4180-972-0x000002562C820000-0x000002562C842000-memory.dmp

Download

memory/5092-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5092-10-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/6068-1003-0x000001AEEFD30000-0x000001AEEFD4E000-memory.dmp

Download

memory/6068-987-0x000001AED7590000-0x000001AED759C000-memory.dmp

Download

memory/6068-990-0x000001AEEFC10000-0x000001AEEFC2E000-memory.dmp

Download

memory/6068-991-0x000001AEEFC40000-0x000001AEEFCF2000-memory.dmp

Download

memory/6068-992-0x000001AEEFD00000-0x000001AEEFD0A000-memory.dmp

Download

memory/6068-993-0x000001AEF01B0000-0x000001AEF01DA000-memory.dmp

Download

memory/6068-994-0x000001AEF01B0000-0x000001AEF01D4000-memory.dmp

Download