7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

user interaction
yes
max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 102KB
Sample260810-mry17afe83
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
1372	forfiles.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1144	MSBuild.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3860	powershell.exe
4900	powershell.exe
820	powershell.exe
4756	powershell.exe
3832	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4308	cmd.exe
2716	cmd.exe
3036	cmd.exe
324	cmd.exe
3356	cmd.exe
4960	cmd.exe
1828	cmd.exe
3988	cmd.exe
660	cmd.exe
4080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
820	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308336039780916"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\Iced.Internal.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\Iced.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\Iced.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\X1MeC3NRV.bt:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\Directory.Build.props:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3860	powershell.exe
3860	powershell.exe
4900	powershell.exe
4900	powershell.exe
820	powershell.exe
820	powershell.exe
4756	powershell.exe
4756	powershell.exe
3832	powershell.exe
3832	powershell.exe
3476	chrome.exe
3476	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe
Token: SeLoadDriverPrivilege	3860	powershell.exe
Token: SeSystemProfilePrivilege	3860	powershell.exe
Token: SeSystemtimePrivilege	3860	powershell.exe
Token: SeProfSingleProcessPrivilege	3860	powershell.exe
Token: SeIncBasePriorityPrivilege	3860	powershell.exe
Token: SeCreatePagefilePrivilege	3860	powershell.exe
Token: SeBackupPrivilege	3860	powershell.exe
Token: SeRestorePrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeSystemEnvironmentPrivilege	3860	powershell.exe
Token: SeRemoteShutdownPrivilege	3860	powershell.exe
Token: SeUndockPrivilege	3860	powershell.exe
Token: SeManageVolumePrivilege	3860	powershell.exe
Token: 33	3860	powershell.exe
Token: 34	3860	powershell.exe
Token: 35	3860	powershell.exe
Token: 36	3860	powershell.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe
Token: SeLoadDriverPrivilege	3860	powershell.exe
Token: SeSystemProfilePrivilege	3860	powershell.exe
Token: SeSystemtimePrivilege	3860	powershell.exe
Token: SeProfSingleProcessPrivilege	3860	powershell.exe
Token: SeIncBasePriorityPrivilege	3860	powershell.exe
Token: SeCreatePagefilePrivilege	3860	powershell.exe
Token: SeBackupPrivilege	3860	powershell.exe
Token: SeRestorePrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeSystemEnvironmentPrivilege	3860	powershell.exe
Token: SeRemoteShutdownPrivilege	3860	powershell.exe
Token: SeUndockPrivilege	3860	powershell.exe
Token: SeManageVolumePrivilege	3860	powershell.exe
Token: 33	3860	powershell.exe
Token: 34	3860	powershell.exe
Token: 35	3860	powershell.exe
Token: 36	3860	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeIncreaseQuotaPrivilege	4900	powershell.exe
Token: SeSecurityPrivilege	4900	powershell.exe
Token: SeTakeOwnershipPrivilege	4900	powershell.exe
Token: SeLoadDriverPrivilege	4900	powershell.exe
Token: SeSystemProfilePrivilege	4900	powershell.exe
Token: SeSystemtimePrivilege	4900	powershell.exe
Token: SeProfSingleProcessPrivilege	4900	powershell.exe
Token: SeIncBasePriorityPrivilege	4900	powershell.exe
Token: SeCreatePagefilePrivilege	4900	powershell.exe
Token: SeBackupPrivilege	4900	powershell.exe
Token: SeRestorePrivilege	4900	powershell.exe
Token: SeShutdownPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeSystemEnvironmentPrivilege	4900	powershell.exe
Token: SeRemoteShutdownPrivilege	4900	powershell.exe
Token: SeUndockPrivilege	4900	powershell.exe
Token: SeManageVolumePrivilege	4900	powershell.exe
Token: 33	4900	powershell.exe
Token: 34	4900	powershell.exe
Token: 35	4900	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3108	Setup.exe
3108	Setup.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 3356	3108	Setup.exe	87
PID 3108 wrote to memory of 4960	3108	Setup.exe	89
PID 3108 wrote to memory of 1828	3108	Setup.exe	91
PID 3108 wrote to memory of 3988	3108	Setup.exe	93
PID 3988 wrote to memory of 3860	3988	cmd.exe	95
PID 3108 wrote to memory of 4308	3108	Setup.exe	97
PID 4308 wrote to memory of 4900	4308	cmd.exe	99
PID 3108 wrote to memory of 660	3108	Setup.exe	100
PID 660 wrote to memory of 820	660	cmd.exe	102
PID 3108 wrote to memory of 4080	3108	Setup.exe	103
PID 4080 wrote to memory of 4756	4080	cmd.exe	105
PID 3108 wrote to memory of 2716	3108	Setup.exe	106
PID 2716 wrote to memory of 3832	2716	cmd.exe	108
PID 3108 wrote to memory of 1372	3108	Setup.exe	109
PID 1372 wrote to memory of 4212	1372	forfiles.exe	110
PID 4212 wrote to memory of 2848	4212	cmd.exe	112
PID 4212 wrote to memory of 4828	4212	cmd.exe	113
PID 4212 wrote to memory of 3036	4212	cmd.exe	114
PID 3036 wrote to memory of 4600	3036	cmd.exe	115
PID 3036 wrote to memory of 4172	3036	cmd.exe	116
PID 4212 wrote to memory of 4588	4212	cmd.exe	117
PID 4588 wrote to memory of 324	4588	conhost.exe	118
PID 324 wrote to memory of 4776	324	cmd.exe	119
PID 324 wrote to memory of 1144	324	cmd.exe	120
PID 3476 wrote to memory of 816	3476	chrome.exe	142
PID 3476 wrote to memory of 820	3476	chrome.exe	143
PID 3476 wrote to memory of 3456	3476	chrome.exe	144
PID 3476 wrote to memory of 3456	3476	chrome.exe	144
PID 3476 wrote to memory of 3752	3476	chrome.exe	145
PID 3476 wrote to memory of 3752	3476	chrome.exe	145
PID 3476 wrote to memory of 2644	3476	chrome.exe	146
PID 3476 wrote to memory of 3016	3476	chrome.exe	147
PID 3476 wrote to memory of 3016	3476	chrome.exe	147
PID 3476 wrote to memory of 2644	3476	chrome.exe	146
PID 3476 wrote to memory of 4656	3476	chrome.exe	149
PID 3476 wrote to memory of 4656	3476	chrome.exe	149
PID 3476 wrote to memory of 3180	3476	chrome.exe	150
PID 3476 wrote to memory of 3180	3476	chrome.exe	150
PID 3476 wrote to memory of 3680	3476	chrome.exe	151
PID 3476 wrote to memory of 3208	3476	chrome.exe	154
PID 3476 wrote to memory of 3208	3476	chrome.exe	154
PID 3476 wrote to memory of 1856	3476	chrome.exe	155
PID 3476 wrote to memory of 2116	3476	chrome.exe	156
PID 3476 wrote to memory of 724	3476	chrome.exe	157

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:3356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3832
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy /m X1MeC3NRV.bt /c "cmd /c ren @file X1MeC3NRV.bat && call X1MeC3NRV.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "X1MeC3NRV.bt" X1MeC3NRV.bat && call X1MeC3NRV.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2848
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:4828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:4600
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:4172
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\X1MeC3NRV.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4588
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\X1MeC3NRV.bat /launched
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:324
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4776
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\Iced.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaf657c728,0x7ffaf657c734,0x7ffaf657c740
  2⤵
  PID:816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,9427846112975588315,2358162873899636716,524288 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:3
  2⤵
  - System Time Discovery
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,11470678866247427040,10450605191023659579,262144 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,12057709169423813682,5622711449061330317,524288 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,12468880646695992045,6389705793027224021,2097152 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,17941231727546780752,4458680630853038765,2097152 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,9098386650648360238,6304099542000691035,2097152 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4680,i,13506276626046004586,16884411330824121092,2097152 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,16766966567434616718,5990404834682718394,524288 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5924,i,2697059452347733978,7740571677523031943,2097152 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3384,i,18069486470612324603,18373574055700060489,524288 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3400,i,12038692095818480148,15268495512161209039,524288 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,6124759563665613941,5901101684513850236,524288 --field-trial-handle=2016,i,15982385644900787552,3313163448800065988,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ec9392f121b499ed547a4796220af55000604a8c369c8da51b0deec6926ac165
MD5 4142ec7c2ca1a3e9a72b5823e439ea4b
SHA1 b5696b77799e9872165df4a5aba3674d16a8cdd6
SHA512 147ed3e29835b32b1d6f3819926ff8dbcaa58f399df8a8695213ed71f68202a51a42a9cde3ce07db29d93eb864d6ed3970bb18316580a9765eaa33356f0e6aab
TLSH
T12EE02BA6C971AC3B19FD0B1810924B49FB5A17563A80992F3A3CD20C4FB062A4686C9C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3f44ebf38e6e13ee57280c4613403f7bf2830471a596d2c47e29c827578a8dc7
MD5 5132bfe6ff34b5860004ba5a1cee6f15
SHA1 c1b23b33a92791c1eb9592c542e4a679f6a14e02
SHA512 475e6f1b62ccddf254575ab6c984c499ee8dc296f734f4a334faa275709544408dbf2648741376bfa9272e29f22b4d834a4670ef09c483278245b899959cfdbd
SSDEEP 192:XRlOL/zv9XIev7hhAPRp2W95Hsb+WNn9a0iD9d7W0dO1sVyIsnAUgtaJ:XRl47Oa98Xtrw80gDlYI8
TLSH
T19742E92EB914653B9CCBC229FD637B47D7F6142135A41E88EAFC891C15EB9CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 171606b491cdd0ee408dc52ae9328a6e5be63080fa6dfaed494eafd09ff5145b
MD5 dbe3123d2a3c0cc9aa259935fbd33ffc
SHA1 7ee5df7de9e5617a0ca63e107bc96f6e46522c88
SHA512 831a9c5508d652b011ae354aead7a5cb935abe0c2f3b95c69a36836bb4c2146d5810b36e0236f6768249bd58df435effd597964e1afb4007ed6b854772acef36
SSDEEP 192:XRlOLvMwnEO9XNXv7hhAPRp2Hut95Hsb+WNn9a4lq2qD9d7W0dO1sVyIsnAUgtaJ:XRl4vxP/98Xvrw8/2IDlYI8
TLSH
T17452E82EB914793B8DDBC225F9227B57D7F6142135A02E88EAFC892C15E79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c66b7e435ba852d0fa1c91f8ed6b2b844c6d0f5c9ad89cf073ecf80761d34d75
MD5 78a72c71e0fada9dfb91a41641715ad4
SHA1 aba5b10466e6ee08bc3fbf8b22114a426908da56
SHA512 29bbfe10db86f0d607fe194605f92de77e7b10e80334a373b32dacc86d8b37467381417ca7fc02a9bcfa011d29a54df3f47ecbfdbbe999b38ed40d792dae7d4e
TLSH
T17FB0120180055501C04606F11142A4CCB1285F10DB0B170183E06A22C8271618225051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a352b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a352b.TMP
Size 96B
SHA256 978b325ed3d18d07b754ce5ddbd2aa9c895aa64f0aa1eb7afe26e5a07824d747
MD5 6cbdc0dc7504d100c854b7ee2c284341
SHA1 6dbe5da883cbb87ebb3df5245e96d4e9b596a397
SHA512 a1b9dee130ce744a3c969386c188ec51358001c99b47c4db0b539a7ce468d9a3fedfbba655ba995125e3f42ce68ca83b95e2a833df2b2fd83553537f747235e9
TLSH
T1D1B00256C1466312D05217F029E6D5D8B270EF67CA03222292F01E6ADD39F724525160
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 93c1ad8aa01133c7888ab65ce3fb6f58ec79301d47e7dd5279deb92f770cd007
MD5 0f81edd84a67c3ed42631bfdf444710b
SHA1 cae2c683860106062a5d7e9e994bdce6d4c591d1
SHA512 f4cf96cdee2702b9d26e8cc3a553618161c473247ee7fdd2793db833c919d029313b38d39776428935c3f32923ff54d9e61a41d82149ce961f16c936bc998b13
SSDEEP 3072:jitEVBTjyc1i2YjvUxVGZGAPJygkj8xqYKV1J0Rqfd7NtZL8cHQRZEQ6Spsn:WuPhY7oVKbcjOjKLSRqZ/ZLW3Exn
TLSH
T11634127AAFC32D37198BCD28F8431BD947B584EA4470A701BE8DE7EB2C019839655C6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e633034893380c5d72eeff2549ec6df327db31efd42e29cd5db50f0a54452788
MD5 a29f3aa4cc421d78842004c26881e314
SHA1 9cfd111cb496f159bb4203ec47dc87f2eff16291
SHA512 c841e7b2086ce46c47b248f2e7d8fa7a7cd617734af5f80851d7df63896f33cb8ab9d8cda96c306be9b119e80078d73634063845a4d679cfb86f334e850bd695
SSDEEP 1536:6oyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:rqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1EFC30237EBC21F339D92CB64BA534FDA97B644A99030D301AABD3BFB6C93451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8158346b3d0eae7e1742711395cb58cdeed152593c83058bb0cb80cb18b7e058
MD5 c007dece9bdc5be306dd8eef2bb21f1c
SHA1 378edc1cf0a78ef4356f1505634b7d3d92477e01
SHA512 e7e223d8cdcb392e5c861470398c84667894b64fc0c0298a815b7c0ec9e40b40f65c64fa007d48ea1a60932159993f6aff83da0eb5e468ff8f39bde812f49384
SSDEEP 1536:OuNyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjH:nTqfd7NtZL8cHQRZEQ6SpsY
TLSH
T178C30237ABC61E335DD2CB70BA130FDB97B544A99030D301ABBD3BBB6893455658245C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 15d5db2d709306df16fb0ebf06aec3ef91af94ad8e40f66cb6466d0f37edcb50
MD5 92f60af406d2b80d372ba1a490ea18d4
SHA1 40607747a3551da0aa1fd80ae5e7bf0375f1fe32
SHA512 8a7a9a072d42c60c84c64322c3f01b7264d904ebd16bcf9e6cfc8d6ce5e39db00f8ecfe864fcaf09fff50deade44516c5ec7fdaa632218b3da232809f754a1bf
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq6fBPOIzoZcm0vmlvWPfsNySI:iqdYqGAjdx4qKkq3qktznEuZq6cIzooB
TLSH
T1EB81CD323375B0D4C8667F072A2819D063AF4396EA94AF4CB25C621ED92751BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3d3aee6d48e3df05cd69b056b9ccc95fadf600eff4f8a0bf74b78876fd502ec9
MD5 3f900447f6034138e20383fa99e1910e
SHA1 dab3ab05d7fe1c8985f5ab37458a76b0c6b3f7d7
SHA512 3d578c7f18d63c45ce36efd5840444e15baeaac7b54af543f96b559f4f66c54732911f06754f34613fb9d8cb0fe8edc2b623a0a26c4dc38225c990d8f33da3c7
TLSH
T160316627B3DC8822CCC9153B209C9C1172A682C7819EDF9F6F80D225957FAD9CB61594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7dcc224ca74de213d5264fc752e583b7617e647beb0f657cd27a99b9c92f8c9e
MD5 9ccfa932737ffe2157e513ad1c1af30a
SHA1 72dca9b1b510b30d926891b90d14871d39947b26
SHA512 54917b8d1f2b6ab593793b8b8b92a3317c5871d196784e584fdea547b18702d4d2323ff2cb9749d96398aaf4d7829b6575ed196647700bcd3fccf2e301805bb2
TLSH
T1C7216527B39CD8A1CC95253A209CAC5172B783C7409ECF8F6FC0D224A57FA94CB61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 617aacd41cbfa2cd78a160ee30fc6b79f646d363b9d42aef8fee2e26b5e5f96e
MD5 8dfcf32d8ffc2510a3593bbe5531baea
SHA1 d4076d1200bd7eb049450cc16d77d08975607bf8
SHA512 1b596b20d455567e5ed9dca911d14f098f20755d394c407ab876371f1e7ede276d85cb1c6f7a9cc34cdfc5b504719e3597ce54196d1af5b1e61b345dafbd0e0f
TLSH
T100216527B39CC961CC85253A209DAD1172B683CB809ECF8F6FC0E224A57FA84CB71190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 34a96024256235e2dffc9c3e74f42f5fb95a0d2b9c795b72619510533ace1323
MD5 be340465e4abc8c992b607ab0a121235
SHA1 1722d01bf0417117248f6eaca55ca27c4cb56278
SHA512 bc1037c8a8554dd6e7de69f1d0d377306784c529a568d4b408a47f1787513f729f19d45766f69287ff576aada28e42af8d7660e721beeaa2f942d76e79eea4c4
TLSH
T13B216527B39CD9A1CCD5253A209DAC1172B783C7809ECF8F6AC0D224A17FA94CB71590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qkq3g2nk.e3t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qkq3g2nk.e3t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

persistent.1786359883.tmp

Path C:\Users\Admin\AppData\Local\Temp\data\saves\persistent.1786359883.tmp
Size 1KB
SHA256 8693d123dad0e6f3151b50640d04a655ca3c24abaa2f1be4439dae0857e62990
MD5 fb37459262e2a727498f7b65e5772b30
SHA1 a1cc4b5b609553add314876c33722391fe762f83
SHA512 cb34a00827d971f6a75743c3bdf505bd0763ea9eebae6904a5322a3a4814e349667c78ef3decb2408438cc671cde5ce98eb71927b64eeaadc7722081fd1f956e
TLSH
T141310CA3389006D43F9DC23A5BDDED5932F543D47CD9B2DF739013223A6D1910105650
MD5 SHA1 SHA512 TLSH

Submit Download

Directory.Build.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\Directory.Build.props
Size 679KB
SHA256 3dfc62072ae78b460b0535768b30df5270d63b9245713cf9546bc8afc6751672
MD5 f8fa26ce03ff28643be215b020a74d2f
SHA1 599e5102cca658b4f105307a23b3ef4dd714412b
SHA512 243b865a8817d7655378c136cf29572f15587be21706fc7d5d992139fc2c5fb5ca74a3f41fe939cd2410e503a3ebd2ace36a5a83514505844bd74fc325d87ff1
SSDEEP 3072:JdGWjUDuTyrN84eUaTXphc/YhcUlLa9mfOjuwhIj9ozeYZAWOjF/:JdkeU6cmfOjuwhIKhZw/
TLSH
T1EBE491B85DEB0095FB5BC470A5FDBE7452F33193BBD71E900B2DA50C1B78A522E9060A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Directory.Build.props:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\Directory.Build.props:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

Iced.Internal.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\Iced.Internal.targets
Size 1.6MB
SHA256 9d50cb87bdde8807114598757a5e171b1ae93068beba56eedb5a36006a063258
MD5 c239d907e746ce0b69deaecb5dde56e8
SHA1 ef589554ce9df118d3b3fc9f3f4b08331a0d2453
SHA512 390b4e8afbc240b4ad09afe1971dec5fc350c2b296525069c194d453d8d4f945bf51d7d85694048e9163abc83b7742b34488b8cb0d9ecc2a1970c35907725a62
SSDEEP 6144:CJ+dxeoiN7ecGrpigyunLeBsH60lKpZQ+ypVALMEFv9jV3McJafgttHF8HWlD6oe:CtoiwLeeH60lKp/ypVA4EFN8
TLSH
T13B7569B816EF4070F79B8C3563FEBD745172328B97DA7D44062CA4405BAAB613E21E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iced.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\Iced.csproj
Size 9.2MB
SHA256 8f0152760c67632c2d970cb2ff32ff50aa17a16aef79bbef7a766f600e299851
MD5 4db4c33b34d033c82f88695c4ae927ce
SHA1 f7fe863cea0cdd30f5e0ef93d9e37f75ac8c21b3
SHA512 691cd5d759d0b6c5816a0884d03b90763c0a63f65b1032714c3e98519a6660f0799a0c0a5a1721ce15c4c15f02fe6b5ff7b4677d337f5691c9377e8ada68cd65
SSDEEP 1536:tKWvyTtWBg4bk18FMv7/bd/+GqE1P02LV7sIxIA4WlaMX5+S2b5Yf9Nzl9EekqSg:e
TLSH
T1E7A6AC7A078047BAE3D447C0885B215E3AF4E525BA253159F73369EFBC2A8DB8078753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Iced.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\Iced.csproj.user
Size 1.4MB
SHA256 b5a61b799e30029d5b50f88543449e2327b685b48ec932eac7a24dce26e0d310
MD5 f524c3a9c5c95afea82cb628b3f42461
SHA1 16dbb0ec89e1037a70e65e345e4bca3466c1a43a
SHA512 9759cf3cf550d6137c7097ad56b1bd1eb528a231ce8c8f1e8535966fb59bb19b3b356414af65a59cf19def170f4f1d77c0d277b8a111dbaa83d542c31b325fda
SSDEEP 6144:b2t+lazHFWlJlxZpJ05o1i1hN4c2pc5o8f1IdY2/Fhli6O2+Oe2GmOyqInR+Alfp:dNDg/nTAZOA
TLSH
T170652FF4ACBD5459D21BCDA03AACFF7901F2B0DB9BC85B144362A3654BD8A257E42C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X1MeC3NRV.bt

Path C:\Users\Admin\AppData\Local\Temp\tmp-15761-gijqQTSI1FNy\X1MeC3NRV.bt
Size 1KB
SHA256 e2f07e5dca234c5d0a9c009e2bc852bfe52bead6b7f7cd85db40ef0f67e52f93
MD5 deacfb42361c05dc389da68b7bc10ce1
SHA1 95d0c51cb4224c4a3507744209a46688001106d0
SHA512 0a4aeb7b1ad832e0058d19b4f575d3ed5590cb6f06617c119739c095a0e4a5c6aec36166ff890e38983a99fb0a470a4986a81dcee527817bd3147e28ae5e4d78
TLSH
T19631B89670211849C4B1B67B67B14333235EA2C33884F5BC70C8D9A8789F56FAAA51E9
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

memory/1144-346-0x0000000000A00000-0x0000000000A40000-memory.dmp

Download

memory/1144-349-0x0000000005410000-0x0000000005440000-memory.dmp

Download

memory/1144-347-0x0000000002EA0000-0x0000000002EBA000-memory.dmp

Download

memory/1144-348-0x0000000005500000-0x000000000565A000-memory.dmp

Download

memory/1144-355-0x0000000012860000-0x0000000012B6A000-memory.dmp

Download

memory/1144-354-0x0000000009000000-0x00000000091DE000-memory.dmp

Download

memory/3860-260-0x00000150207D0000-0x00000150207E0000-memory.dmp

Download

memory/3860-270-0x00000150207A0000-0x00000150207C4000-memory.dmp

Download

memory/3860-269-0x00000150207A0000-0x00000150207CA000-memory.dmp

Download

memory/3860-266-0x00000150084B0000-0x00000150084D2000-memory.dmp

Download