b72fda6d7b4c768b374539996c4c602c70d500f122ce7db95a2a1c2780d1167c

Analysis

user interaction
yes
max time kernel
599s
max time network
446s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/08/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
victim.exe
Size 93KB
Sample260825-tmpqaavhmc
SHA256 b72fda6d7b4c768b374539996c4c602c70d500f122ce7db95a2a1c2780d1167c
MD5 0e0f8a5dfb834b83e1fdac4106cfa47a
SHA1 7cf457fcffd765af79cf76439f0f58a2eb305db3
SHA512 a9b20f8fc1a3936aa9422e07c0cc7dce12941e66cb1824eefba05ffc6e2ff7e97fb3498a0877efd386b6afdef9b7d90d98abf691c44e567e7e0a948c406ad127
SSDEEP 1536:8u+M1+Rkd7Lwix1GE+UoyK9Csz9fzTHPdF1Bc:8u+4eiLwix1Gwox0yzTNBc
TLSH
T17C93C6D476D95CD9EA55527C41EA82323A3CF9E0C6134B1BA520F7321F13EC17DDA22A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
87	3992	powershell.exe
91	3992	powershell.exe
92	3840	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Loads dropped DLL 1 IoCs

pid	Process
764	victim.exe

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
30	pastebin.com
70	raw.githubusercontent.com
74	raw.githubusercontent.com
84	raw.githubusercontent.com
89	raw.githubusercontent.com
97	raw.githubusercontent.com
1	raw.githubusercontent.com
33	pastebin.com
34	pastebin.com
85	raw.githubusercontent.com
91	raw.githubusercontent.com
3	pastebin.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Caches\\wallpaper.custom.png"	victim.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3840	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2552	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321478553837152"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
2000	chrome.exe
2000	chrome.exe
3992	powershell.exe
3992	powershell.exe
3992	powershell.exe
3840	powershell.exe
3840	powershell.exe
3840	powershell.exe
3840	powershell.exe
3840	powershell.exe
3840	powershell.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe
Token: SeShutdownPrivilege	4936	chrome.exe
Token: SeCreatePagefilePrivilege	4936	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe
764	victim.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe
4936	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
764	victim.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 3352	4936	chrome.exe	81
PID 4936 wrote to memory of 2552	4936	chrome.exe	82
PID 4936 wrote to memory of 4160	4936	chrome.exe	83
PID 4936 wrote to memory of 4160	4936	chrome.exe	83
PID 4936 wrote to memory of 4832	4936	chrome.exe	84
PID 4936 wrote to memory of 4832	4936	chrome.exe	84
PID 4936 wrote to memory of 1568	4936	chrome.exe	85
PID 4936 wrote to memory of 1568	4936	chrome.exe	85
PID 4936 wrote to memory of 3792	4936	chrome.exe	86
PID 4936 wrote to memory of 3792	4936	chrome.exe	86
PID 4936 wrote to memory of 668	4936	chrome.exe	87
PID 4936 wrote to memory of 668	4936	chrome.exe	87
PID 4936 wrote to memory of 1344	4936	chrome.exe	90
PID 4936 wrote to memory of 1344	4936	chrome.exe	90
PID 4936 wrote to memory of 3364	4936	chrome.exe	91
PID 4936 wrote to memory of 5596	4936	chrome.exe	93
PID 4936 wrote to memory of 5596	4936	chrome.exe	93
PID 4936 wrote to memory of 1880	4936	chrome.exe	94
PID 4936 wrote to memory of 1880	4936	chrome.exe	94
PID 4936 wrote to memory of 3944	4936	chrome.exe	95
PID 4936 wrote to memory of 6008	4936	chrome.exe	96
PID 4936 wrote to memory of 1416	4936	chrome.exe	97
PID 4936 wrote to memory of 132	4936	chrome.exe	98
PID 4936 wrote to memory of 132	4936	chrome.exe	98
PID 4936 wrote to memory of 2000	4936	chrome.exe	99
PID 4936 wrote to memory of 3124	4936	chrome.exe	100
PID 4936 wrote to memory of 3124	4936	chrome.exe	100
PID 4936 wrote to memory of 2416	4936	chrome.exe	101
PID 4936 wrote to memory of 2416	4936	chrome.exe	101
PID 4936 wrote to memory of 4852	4936	chrome.exe	102
PID 4936 wrote to memory of 4852	4936	chrome.exe	102
PID 4936 wrote to memory of 2040	4936	chrome.exe	105
PID 4936 wrote to memory of 2040	4936	chrome.exe	105
PID 3992 wrote to memory of 3840	3992	powershell.exe	106
PID 3840 wrote to memory of 3332	3840	powershell.exe	107
PID 3332 wrote to memory of 4428	3332	csc.exe	108

C:\Users\Admin\AppData\Local\Temp\victim.exe
"C:\Users\Admin\AppData\Local\Temp\victim.exe"
1⤵
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1fcbc728,0x7ffe1fcbc734,0x7ffe1fcbc740
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,7204492968197770645,13041180969709120328,524288 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2124 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,15854857280073314391,13459171257073104105,262144 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,8251070989085156961,6322045169301415506,524288 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,6263724382362142006,3069390828360589526,2097152 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,2859452177863954096,13089759451184119830,2097152 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,17379862410809346148,17587733648777387488,2097152 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4628,i,5696793881941164693,6631450216686961644,2097152 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,1446861735735309880,17690470766891508941,524288 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5848,i,13057621814651216606,5943759873393366053,2097152 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4780,i,627148825248009869,4013752452231946561,2097152 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3656,i,16563813179296942165,8013632605844517065,524288 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3660 /prefetch:14
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3608,i,12254431732165007518,18287770676863916050,524288 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3628 /prefetch:14
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3692,i,8736472002795989621,14733037856673729515,524288 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3608,i,20109785251844276,8104399350946787871,2097152 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5784,i,6336738836777670348,5003674680934226231,262144 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3908,i,3956107364792860843,10888786356881521409,2097152 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3652,i,3324099666077896159,7800839698226791371,2097152 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4884,i,17183729126478003208,6536195782269543423,2097152 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,12831741344526078841,855073582050168314,524288 --field-trial-handle=2100,i,17229815483736155205,13397046337003776330,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:2040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\fejker.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i4htxeqn\i4htxeqn.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES140C.tmp" "c:\Users\Admin\AppData\Local\Temp\i4htxeqn\CSC9E9D34E5139A49319E75A9B2D86E85D.TMP"
      4⤵
      PID:4428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E8
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 befe1882bcfd78efa026fdd73917de00dd8e9ed9b71fc1f64898b9739a697217
MD5 d74ffa275856d66d3cb6c5990a11198f
SHA1 a2718ebeb68e22ce59647c47a729f85052365271
SHA512 077b979003a7e66f707639ce42b18c196f117a661c82ae4c3ba511dc7e9fca9f15d2496953c0cc83a101362b831574d39c9812e5db92303d50cd7f0333c28053
TLSH
T11FE0ABAACC21DC3B08FD0B6850844B47E74413562A50484F3B3C845C4FB173A418AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 840ccb37d6a7c2f23b82b93a771c91c07a6ac1788e366a6edeb63da44c014148
MD5 4568289cd3d79e8b148d452f05be9cbb
SHA1 f04321707cf974c9d04555745d0c33a588b18c97
SHA512 448a5c0fb125385b5e28da567f0ba703f9fafa8731d6b7750df192bc3834fa4144350613329878b7aa01f056ec4ce09c4009a035e6cffd7e89f376e90505b8ef
TLSH
T1D2D080971B9D30C5FFC72E783C610D02313C0AD896D34BD281DD6010F71679050451EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e020351c7f18339055996c5424a48c9058943e91c75e1b03d352305f6a65fcfb
MD5 8509e4e327ecf26f9c359f044700578e
SHA1 53312ca75568c115b6e8e09b81306204255584f9
SHA512 f6b60ac381b14bae90807bb8e04f4dacc756e7b800d78ba470ce9f890db3eed3185d66b6991c05fc23b177731be058ad4f66bde501bb5e73e808bcfc0fca4ff3
TLSH
T13461D6D84E8C4860DB021E7018EB4687FE3E4244A9BB5E12CCE5453F9876F475D7D46B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2549ee0ff0ebd183063801935da4e26a2781bd24c188dfb051b5fb7a13112c90
MD5 9565f3740e492334ae6a0a0c8f574dd7
SHA1 9d3380ed5387da5ac3c13bf88421053a9499ea67
SHA512 43b482e37e080294d3705ff82eb8f31ae0e1efb485a77b1fb55d4ed150132274faac99206cb4b1b9aa72bb394c83e91b033e5e0487b1a70bb58f533ebc42a15b
TLSH
T1A471ABF7C3E4857D8A1196F49A246E1FCE6D0A14431C3CA6C8D4AE5B53E2972E241B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 20fb46ef63da2db609e5e8ba07ac358a85a0d3863bb9dec2f845cb1fb0d9ac37
MD5 6e4a8eea4829cd96a67a5892a9c4b39e
SHA1 59e2d3d43a525911a6b176204bf6ffd4c866faaf
SHA512 78960a5a7433023a46816f2874621093bce355babad3ad3d1e975c5d59d4ab6afd75d5c5f177a33ac4a88fcd6dce86e43d8c0c3c770284d9671e432549c1e058
SSDEEP 192:D3uzmFmIaI3/v5dyHtGtbBN60eajmAmmmgmQmDmtiBmdl6:D3uzmFmIaI3/v5dyHtGtbBN60eajmAmT
TLSH
T1EBD19FF7C3E5996D8A1195F0EA146E1FCE690924432C3C66C8D4BE5B93E3872E24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e8fd48e7ff94809b804dced122b40962fd4b0ef603e7bbdfdafac7761e1a4e5f
MD5 5ef3c225d49f80ada0437c14aedcee4a
SHA1 4a27218f4f03d1f816d24f7ea81ed22c99c7439f
SHA512 4d1369615fcd0bb834e2e42b63c7bb874c81248c720cf7128925117da473877e63c65f0fbab5efc3af7ec487e46b288bbc9e9252884f7137f4a7f2ca6f4bdcaa
SSDEEP 96:D3uzmdaI3/v5dyHtGtbk13N60ec/wmDmrmO+mtmb/mR:D3uzmdaI3/v5dyHtGtbi3N60eawmDmrr
TLSH
T10AC17DF7C3E4997D8A1195F4EA146E1FCE690A24431C3C66C8D4AE5B93E2872E24178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 721e0a9e8e7dc1f51eb84a5707fbe57064e8829c7ded499fde7dcd447e3d323b
MD5 c7d1f19c67a09bddec5e3d3635c452c7
SHA1 7fe3180c6a963acc204496b2193b258d67fe7504
SHA512 a8fbfc9c5be06873f6e6f6435198b92326189e4d059b8c7d289d8272f6cfd67a55514450c17fb99d8816239f6a2be0a22d333eee241813d10a69d2e7eb053e5e
SSDEEP 192:ZRJdT+LviAfoL7pmv7+pdPRpJbjB9wHsb+WN5nH3Pwzz6WFR28zodI9P8PJQTJVK:ZRJFiq3L7pS6LXbOw5/Y6+224eP8PAe
TLSH
T13C52E83EE9546A3B5CDBD629FA11BB57D3F1203225951E84E6FCC92C18E76CC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d4a91f653d5c7283a47e8a000fa6305b4032c274bdb306421fe3d01ee91e430b
MD5 99ae7739a2b3232fa3b197c70135d92c
SHA1 dd7a66a2164fc60db856d676664f6f982f91e859
SHA512 a19faaada8c5a95589a97ad25114ba06e6d767cdf0df6e0874416e731dba2beb096b1c333a741146017bf8ef2d06f0b5ed48c5acd6165d3de0190a53e7bbea54
SSDEEP 192:ZRJdT+LviAf/Jmv7+pdPRpJbjB9wHsb+WN5nH3Pwzz6WFR28zodI9P8PJQTJVyI6:ZRJFiqmJS6LXbOw5/Y6+224eP8PAe
TLSH
T13352E73EF9546A3B5CDBD629FA21BB57D3F1103225951E84E6FC892C18E76CC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fefbf17bec99629f3ffe4674bbf3485a831834cf2b17ce5756ae4c2f64277f54
MD5 ff50ffe31a487501a8e88bd93b810c63
SHA1 a50c92c9f552998f4965fc03493c27e2221fd89e
SHA512 bd92b5ec6892070756c4c74924226d580542044dc622e4fda8c0fabd6b972cea43fced87bcce05ca87deda2c1a464959f83e16187d1ca8f12f785defd03d746f
SSDEEP 192:ZRJdT+LviAfhdmv7+pAPRp2AB9wHsb+WNn3PUWFR29zodI9P8PJQnJVyIsnAUgtK:ZRJFiqUdS6UXBOwfU+2p4eP8Pi8
TLSH
T14042D73EAA546A3B5CC7C729FA61B753D7F1103225951E84E6FC892C18E76CD222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ba866f607f2076cb5f9573b2cd2f4ff524ea5d24137457c0e7d3b6f539254d39
MD5 f69123cfcf827d91f7fb3b0605738c54
SHA1 fd6132c7048b1423286a73339fbb5af3ba6a6d42
SHA512 f9b6c08a6349440de1148a310c77af8c44464f27c17568eb57fe5038931c4d8b46a13051c00dfd27f61b20286b33b74b358c8bb5024f50495ac3cc58c8f9af1a
SSDEEP 192:ZRJdT+LviAfWfmv7+pAPRp2O9wHsb+WNn3P0jzodI9P8PJQnJVyIsnAUgtaJ:ZRJFiqPfS6UXpOwf0P4eP8Pi8
TLSH
T19F42E73EBA546A3B5CC7C329FA61B753D7F5203225951E84E6FC892C08E75CC222712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e88e4f5c4794ffd59e26ae3260b83496d55c8a06592cf1c9cd4ea3d4ff35d3ea
MD5 7e612b9a7a325a26369780abce67d713
SHA1 517fd5981e6bf4ca4e756c1a600a3664cc7c201d
SHA512 df345ff9c79aebe0998c491e0c582346bce6f61de36e6df3aed147c7970b26df68cd8e9eea1bc1210acb1ed725fc4f52cbe444aa1a5fc1a60155991c7de98b79
SSDEEP 192:ZRJdT+LviAf/umv7+pAPRp2bjB9wHsb+WN5nH3Pwzz6WFR2IzodI9P8PJQRJVyI6:ZRJFiqmuS6UXgOw5/Y6+2S4eP8P8e
TLSH
T1D052E73EE9546A3B5CCBD629FA21BB57D7F1103225951E84E6FCC92C18E76CC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cead694dbc7237954deab91aad994b8341f7f34a6832b55032a8668250e83c85
MD5 c8ae6c1ba59a4ecb008c13ff97b12da3
SHA1 c64bc57a1ee7c2bf0671fdd4fc3fdf750f35fa19
SHA512 b29d599e5d709d3352ac86524a713d089a949128ac3abf1818f324b2f58aaac1c1de7fb9a5d55ce2c5979cbfe1331e81ebc4a7542a8b8947c8efeab1d36464d2
SSDEEP 192:ZRJdT+LviAfN7pmv7+pdPRpJ16yjB9wHsb+WNF2nH3PvWF6zz6WFR2RzodI9P8PJ:ZRJFiqI7pS6LXBOwg/UW6+294eP8PAe
TLSH
T1D062E72BA9546A3B9CD7D729FA11BB57E3F1102225951E84E6FCCD2C14D76CC3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 67cebd44cfa0407718b45b93686377b713201eccc9fb14bbed6d1e0be5e3fe44
MD5 761faaf16ebe859a56e9e316cc471ae4
SHA1 8b9b697b51f84b787bae818c73fd43c6b3f11c74
SHA512 8046c2a4df46545b31c5d9f4d67862004a8e18c2872cc485c7b832f87ce77897f250c40382e1137f4fa2ebc6cc3a4014d6e3f5fb957a99e10f84e8f8948be173
SSDEEP 192:ZRJdT+LviAfNfmv7+pdPRpJ16yZuB9wHsb+WNwi2nH3PvWF6zzNjg6WFR2EzodIA:ZRJFiqIfS6LX4Owo/UW66+2u4eP8PAe
TLSH
T16A62F72BA9546A3B9CDBC629FA11B757E3F1202225951E84EAFCCD2C14D37CD3227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
TLSH
T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 a36f05ca4dbc6f15d2668af1799be8bde8218b1793b8e8fd0ce1545acc7bc0f6
MD5 3910896ab2846e9a7596b811b2261799
SHA1 cd17a8e9c88e19e673d09f4c5411408af26c3371
SHA512 065f5b0292cf912b7e451ed0b06bb03d6b92041a6603952eed789e995b3a1ef5fe2f8186c31b310983bb3ae8cca4497896de3840aa31e67d10dad5b5c6bdbdae
TLSH
T1A2B0120080415101C05206B0124218C871747F109B4E2B0283E4BD26C8251618014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b10b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b10b.TMP
Size 96B
SHA256 a54dcf02bf84e2ea9f05cb0b990713dfb0783ed6b37e1294c75541772b43c7ea
MD5 f0e6cd0acae0e715c769edfa14f38969
SHA1 2604fa5c33e89c9c901f9fcc87d96276a9e6f33b
SHA512 4b0a4c368612202c03095acb3c807a7beab7cb1ae144e1745f91b672414b390666faf16e6380d5677b0b725e0c7513cd4f923cc50acebabd1c335a677be6465c
TLSH
T133B0025AC3526632C54207F0369696E87160DF35CF43126296F06E66DC276724539175
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 e414f56f235ce48a02f4037db678e681dd2202de141db95e08c6bb25c421738f
MD5 e6cb9c4ec6e32becf818ca37ef58a1db
SHA1 fef1b1973a982ef2364934de52f3d8331f3b6377
SHA512 6c6b7de4200a6588bef66843917fda31a46737655afea3111748e1a77bea2e38ee5dc88f9b57b329f39b9b4dc4747763b5a678c17cefa23de4a99e473b5039eb
SSDEEP 6144:am1MqKAM7YMrAukqqwEKTYeVIWDfxA3OnjrYQ9EU0/hEB:aGVKAMFrAubqsTYeVJDfxjjs+CW
TLSH
T15B3412956E38BA270DF6DF15650E2E959FAD7CC98147CCD623CB1D0A51BA7C8023AE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 8aaae15ceb4d1e1019a624400b478995a5ccb58bbd3a50fc3432365314e07669
MD5 094dba098d411d065e22fa4d7683b6bd
SHA1 8e0792a6d10cc0dac9bdc19c6c55aa2325405c2e
SHA512 5b98a087cf7822f52bf285a2bb6b9740e55f95e8a31cef70a8737176c39d5788dfc63dde67f07b074701b224afbee06aff3697cfb674ac008e1085ee970a1e07
SSDEEP 6144:rm1MqKAM7YMrAukqqwEKTYeVIWDfxA3OnjrYQ9EU0/hEB:rGVKAMFrAubqsTYeVJDfxjjs+CW
TLSH
T1793412956E38BA2709F6DF15650E2E959FAD7CC98147CCD623CB1D0A51BA7C8023AE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 ff027e647a2694d85d5574b23dcd76f86b80555ed18bb5f011a0480fa3787d8c
MD5 f9038e027a8a095b4ee0b1caac52cdd4
SHA1 469d7688b56e038ed8c7c9713696e5dd96a107c6
SHA512 d15c2dbe999f98079db5170bde0cc430a107d69d06d7399ce2a5fe8bc73b13153c3b351b48ab2aea93161caaac2becf96b5a0d883e3d47dc8f288998328e857e
SSDEEP 6144:Fa1MqKAM7YMrAukqqwEKTYeVIWDfxA3OnjrYQ9EU0/hEB:YVKAMFrAubqsTYeVJDfxjjs+CW
TLSH
T1A63412A56D387A230DF6DF19650D3E919FE9BDCD8107CCD6628A1D0A51AF7D8022BD30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 92c05f7b80ca6a53477534ab0d3d254d8ed1ece57dd656b9609c769a8e41dbb7
MD5 cb78940cfdfda25d40af2cfc396f3d86
SHA1 7eb0af078675dcc43ab4598b8411531dfa1c8e9e
SHA512 8ef76f9468ecf80bf04a2b757139f48a0e977b7bd9b83ac4934569bee6162923caf4294f834928452aee10a7992aefd5adb8ff9099cbf1fcade95dc2c30978a5
SSDEEP 6144:1a1MqKAM7YMrAukqqwEKTYeVIWDfxA3OnjrYQ9EU0/hEB:IVKAMFrAubqsTYeVJDfxjjs+CW
TLSH
T1343412A56D38BA230DF6DF19650D3E919FE9BDCD8107CCD6668A1D0A51AF3D8022BD30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 9e348892d7ed773ca4cfdd272c6aa701d68b686c57d9e74318d25effb46391ba
MD5 471d26855fce2caff9c7b7cce5fb2290
SHA1 ac03c927435a51a571219d6921befd4389d6b2cd
SHA512 2db37156cd700a8ba5f3ab13a6e240a39bd73958feafa7a74c2c1a170171722ee5bdb8e6744051912426cca1af76e505455b7b7050f4654e6261d2e2874a51db
SSDEEP 3072:kzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:aWDfxA3OnjrYQ9EU0/hEg
TLSH
T162C302A15C39BD660CB8EE99B44C3F60FFF4AD9A91879DC361E91B0C24FA5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 b48eb9b8637997d1ce301af35ea735e9ec4a5de53ee7e05ce8e6ae495db55803
MD5 440cb5ad5a9459f933dc5043c2ac6521
SHA1 0a7c46086a5089f6e5e7947a0eab5c5593d06d44
SHA512 6ba55fa604c78c7b12255626d264dd03afa8e66ab57f6fea6703a2a7d3b9b9693771124ccea826ad3c31fae4a9508b967fd4229e4744c3264105bff63698d3cd
SSDEEP 1536:LflJd+h4iUxUYyYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMy:LflJd+qiUUYyYkzvHgfKQaUpeE711kDa
TLSH
T153537392E9204E75E2A65F3EF15622627D30394690F8113212DC25EFA987D930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES140C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES140C.tmp
Size 1KB
SHA256 8196a4457642e62cf41a5284a622cd007a7785f41df52a8c3556540e48aa6118
MD5 446c7e2ad1daf85d9243e95d10eb9759
SHA1 16f75f4ff91cc6e132cb2acba7dc9cca109fbe3e
SHA512 b1ae997ae65178e5f004df0dee8031ced4fe7c6abd52459998457105e51a66b77c8aaaecf3a2a593ab900036075a99e32de4ba3ed14e93fbd7eb9c38a1de53c0
TLSH
T1EE218C0553E94B0FF0B74732B9F9176F9264FE55DF62935F954042282C41104DEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cplsxveb.ubc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cplsxveb.ubc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fejker.ps1

Path C:\Users\Admin\AppData\Local\Temp\fejker.ps1
Size 1KB
SHA256 b9096a518aa0d28a4e6f5a1224d4a5f66178febe845ef82cd48f55f503323073
MD5 c1c6ea01ba3499c27b7b099d579b690c
SHA1 11294ed42e92f297ca27c8e6ae5e029ec1ae07f0
SHA512 41f1193a36b2e997657331d73e921b116cef71af9282ba5aa04acf736d45c1dc185d27a34b3972d6da1fe90239f3a7dcedbef188abc14ad1829e0215df8acbc3
TLSH
T19C31F901A668E35419CB5C1EDEDBC5BDFA43803115BF1D2069BCC2622C1725A837A3AB
MD5 SHA1 SHA512 TLSH

Submit Download

i4htxeqn.dll

Path C:\Users\Admin\AppData\Local\Temp\i4htxeqn\i4htxeqn.dll
Size 3KB
SHA256 d37980b697a82254e3596cfe31c6a9a7f7b597403b5d0f16da61148873d2860b
MD5 32d4284c0baee5a9d0c23c26eb6ea70d
SHA1 be9d8957969f83e0fb9f73af1200d16494823249
SHA512 9a518d9527acb38bd51e164f5352e8055f591d026f05a159f91cf40d3d8beb7362f4307545d72fdb0e8ee7f741425ba203fca77d65cc980aeaa33978b1260a98
TLSH
T11471F00B9BD88627E0B60B31EEB3072767B4F9909B73972E19C503196C622245D35FB1
MD5 SHA1 SHA512 TLSH

Submit Download

ransom.dll

Path C:\Users\Admin\AppData\Local\Temp\ransom.dll
Size 916KB
SHA256 f022de5a12b3dacf728c3405d52794c60a9d300c793c594812f47f7e4a639993
MD5 9f6c64822dc5d9c08fc6b4ee23a8c01f
SHA1 e937b61b9dfa6e799b7acb9bbd4d2ce328143ad5
SHA512 a1185b89987a21745ef4fa2f021fc7aae103fc60be1825370b088ec778867391f6fbbf70b59dc0aa105b11bd250967dad3edcd871bbad14e245a5e83a12298c3
SSDEEP 12288:RdOLzZn+vTAWt+312umnsbXIoryUtkwvwysG5CSHb6fSnspsAJ7VmjJw:AZnuTA/rIAyTysG5isAJ7VmjJw
TLSH
T13E15E88226DB0CA9DDE36B7811DBA33AA735FD708A7A8F2BD100C1311D136D16D6EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC9E9D34E5139A49319E75A9B2D86E85D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\i4htxeqn\CSC9E9D34E5139A49319E75A9B2D86E85D.TMP
Size 652B
SHA256 c7f80a69f7a81980eef44ed0c24135a24fba96423169e4d2eb7c65a6d2bde98b
MD5 163ba815ade48355ffa50e54e6150d17
SHA1 a86a5f827581dd0caa6edf4fb2ca83296496467f
SHA512 8dc79a44b995bec41c2471664613656bad41e3046235ff74fc0d9dc90b34bce0d9c3d520e12d58a061628c4d38511d435ab1e831a1a7163a6dd4a5bc08409ad8
TLSH
T1C1F05E0967F8420EF0F34B31FDF643A392A8BD65DE7293ED2440032D28645108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

i4htxeqn.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\i4htxeqn\i4htxeqn.0.cs
Size 844B
SHA256 186ad28fc3c8dedc4c6544fd56356cd804fdd368d9d67dcdc5e55abca43c69a0
MD5 f23c8d235d3177e7a6b3f34aedad5dcd
SHA1 e3308bbd0018ade331c3d64998cdf53985cc6321
SHA512 213fbcbab738fbdfb23bffd418763af6410d7136fb65c85811cb020c1ecc9e3eaf030b99cdd34d61eeb9e98ef78a61047e8e7f4bd9e00c860a546ea45fcf7812
TLSH
T1A801A1245A54F72124DB1C1DCECBC5FEF253907162BB5D244ABC87115D0709A837A76A
MD5 SHA1 SHA512 TLSH

Submit Download

i4htxeqn.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\i4htxeqn\i4htxeqn.cmdline
Size 369B
SHA256 c9b7c78f489710aed4de328ce2e11fddb78cb656836efedf198c17e136c309fe
MD5 faa926bb9d03a9dbe9994bebdf023242
SHA1 f2dd7bd731f735bb5656c2f09b6e5a6e9f87ec58
SHA512 b0ae6d9a102d51500dd5d02f84379ee4b382430c8b1613d3f9486c4f6447f59af5147648c02b401aef981007be5354de11a024c89709e924a284c2196d89bc9f
TLSH
T11CE0682BB646CA7F15F910072269E4ACC6724A5329423F8B6080442ED01700067F1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/764-647-0x00007FFE0F9F0000-0x00007FFE0FA6F000-memory.dmp

Download

memory/764-649-0x00007FFE0F9F0000-0x00007FFE0FA6F000-memory.dmp

Download

memory/764-655-0x00007FF7A5720000-0x00007FF7A573B000-memory.dmp

Download

memory/764-656-0x00007FFE0F9F0000-0x00007FFE0FA6F000-memory.dmp

Download

memory/764-653-0x00007FFE0F9F0000-0x00007FFE0FA6F000-memory.dmp

Download

memory/764-651-0x00007FFE0F9F0000-0x00007FFE0FA6F000-memory.dmp

Download

memory/764-47-0x00007FF7A5720000-0x00007FF7A573B000-memory.dmp

Download

memory/764-642-0x00007FFE0F9F0000-0x00007FFE0FA6F000-memory.dmp

Download

memory/764-644-0x00007FFE0F9F0000-0x00007FFE0FA6F000-memory.dmp

Download

memory/3840-602-0x00000298F6A40000-0x00000298F6A48000-memory.dmp

Download

memory/3992-543-0x0000016E300F0000-0x0000016E30100000-memory.dmp

Download

memory/3992-532-0x0000016E306A0000-0x0000016E306E6000-memory.dmp

Download

memory/3992-544-0x0000016E300F0000-0x0000016E30100000-memory.dmp

Download

memory/3992-530-0x0000016E300F0000-0x0000016E30100000-memory.dmp

Download

memory/3992-531-0x0000016E300F0000-0x0000016E30100000-memory.dmp

Download

memory/3992-529-0x0000016E30170000-0x0000016E30192000-memory.dmp

Download