e9713c428415a3646a3bc88110c3cbe99e5ca77fe705ef5e6b07e366b7778d61

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload.jar
Size 19.3MB
Sample260905-dwp5easxat
SHA256 e9713c428415a3646a3bc88110c3cbe99e5ca77fe705ef5e6b07e366b7778d61
MD5 e4ae6b97f9a0f9550ba001d0643c39c4
SHA1 e4f0a4f1fdc326ffa636372b51848ba8832bcfc7
SHA512 8b83fc362da5d1f44c494f8206cb652000f256b74ae7985d3ddf41b017d6740db880ffcfb0e77b98be4c8eafa349815451aa16ee8441fcd811a1fe341bb54631
SSDEEP 393216:+LCJ9UYsXAZ60iuAsYrOQDWBMfB4crwoDNpDkq4WmJ/7uEIl8T7BiT83gduTAr:+LAUoHi6cDsM54crwox9kq4Wm1xIl87O
TLSH
T17317338F04C64D90FD5B270A186B97867A867D080BF5370C3DACB9B8FBB5A816D509C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 2 IoCs

pid	Process
3824	MsiExec.exe
5600	MsiExec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
135	5804	msiexec.exe
145	5804	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File created	C:\Program Files\PyManager\py.ico	msiexec.exe
File created	C:\Program Files\PyManager\pymanager.json	msiexec.exe
File created	C:\Program Files\PyManager\python3.exe	msiexec.exe
File created	C:\Program Files\PyManager\pythonw.exe	msiexec.exe
File created	C:\Program Files\PyManager\runtime\manage.cp314-win_amd64.pyd	msiexec.exe
File created	C:\Program Files\PyManager\runtime\python314._pth	msiexec.exe
File created	C:\Program Files\PyManager\templates\launcher-arm64.exe	msiexec.exe
File created	C:\Program Files\PyManager\pyc.ico	msiexec.exe
File created	C:\Program Files\PyManager\pymanager.exe	msiexec.exe
File created	C:\Program Files\PyManager\pyw.exe	msiexec.exe
File created	C:\Program Files\PyManager\version.txt	msiexec.exe
File created	C:\Program Files\PyManager\runtime\_native.cp314-win_amd64.pyd	msiexec.exe
File created	C:\Program Files\PyManager\runtime\python314.zip	msiexec.exe
File created	C:\Program Files\PyManager\templates\launcher-32.exe	msiexec.exe
File created	C:\Program Files\PyManager\templates\launcherw-32.exe	msiexec.exe
File created	C:\Program Files\PyManager\pyd.ico	msiexec.exe
File created	C:\Program Files\PyManager\pywmanager.exe	msiexec.exe
File created	C:\Program Files\PyManager\vcruntime140_1.dll	msiexec.exe
File created	C:\Program Files\PyManager\runtime\python314.dll	msiexec.exe
File created	C:\Program Files\PyManager\templates\launcher-64.exe	msiexec.exe
File created	C:\Program Files\PyManager\templates\launcherw-64.exe	msiexec.exe
File created	C:\Program Files\PyManager\pyshellext-64.dll	msiexec.exe
File created	C:\Program Files\PyManager\python.exe	msiexec.exe
File created	C:\Program Files\PyManager\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\PyManager\templates\launcherw-arm64.exe	msiexec.exe
File created	C:\Program Files\PyManager\py.exe	msiexec.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5a2730.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{ED42BC08-6BE8-4CB2-A804-46B810C75087}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2898.tmp	msiexec.exe
File created	C:\Windows\Installer\{ED42BC08-6BE8-4CB2-A804-46B810C75087}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3059.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a2730.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5a2732.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{ED42BC08-6BE8-4CB2-A804-46B810C75087}\ARPIcon	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4816	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee0681d78f5363a20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee0681d70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ee0681d7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aee0681d7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dee0681d7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330521573650738"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\DefaultIcon\ = "\"C:\\Program Files\\PyManager\\pythonw.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\SourceList\PackageName = "python-manager-26.3.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open\command\ = "\"C:\\Program Files\\PyManager\\python.exe\" \"%1\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\DefaultIcon\ = "\"C:\\Program Files\\PyManager\\pyc.ico\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EAF5E48F-F54A-4A03-824B-CA880772EE20}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.Extension\ = "Python Extension Module"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyz\ = "Python.ArchiveFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open\command\ = "\"C:\\Program Files\\PyManager\\pythonw.exe\" \"%1\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.File\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.Extension\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\ = "Python Application (Windowed)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\ProductName = "Python Install Manager"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\DefaultIcon\ = "\"C:\\Program Files\\PyManager\\py.ico\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\ = "Python Script (Windowed)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyc\Content Type = "application/x-python-code"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E81C0B8EDF5336D4DBFEECB8E923F25E\80CB24DE8EB62BC48A40648B017C0578	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.py\Content Type = "text/x-python"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EAF5E48F-F54A-4A03-824B-CA880772EE20}\InprocServer32\ = "C:\\Program Files\\PyManager\\pyshellext-64.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\EditWithIDLE\ExplorerCommandHandler = "{C7E29CB0-9691-4DE8-B72B-6719DDC0B4A1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyz	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyzw	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{C7E29CB0-9691-4DE8-B72B-6719DDC0B4A1}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shellex\DropHandler\ = "{EAF5E48F-F54A-4A03-824B-CA880772EE20}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C7E29CB0-9691-4DE8-B72B-6719DDC0B4A1}\InprocServer32\ = "C:\\Program Files\\PyManager\\pyshellext-64.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E81C0B8EDF5336D4DBFEECB8E923F25E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open\command\ = "\"C:\\Program Files\\PyManager\\python.exe\" \"%1\" %*"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.ArchiveFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\PackageCode = "0B096AF959AC86F4B95815FA5F0CB4C9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\ = "Python Script"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\open\command\ = "\"C:\\Program Files\\PyManager\\pythonw.exe\" \"%1\" %*"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyw	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\Version = "436404464"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80CB24DE8EB62BC48A40648B017C0578\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyzw\Content Type = "application/x-python-zipapp"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
6004	msiexec.exe
6004	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
5804	msiexec.exe
5804	msiexec.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4588	OpenWith.exe
5224	OpenWith.exe
5480	javaw.exe
5480	javaw.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2140	2928	chrome.exe	107
PID 2928 wrote to memory of 4816	2928	chrome.exe	108
PID 2928 wrote to memory of 764	2928	chrome.exe	109
PID 2928 wrote to memory of 764	2928	chrome.exe	109
PID 2928 wrote to memory of 4408	2928	chrome.exe	110
PID 2928 wrote to memory of 4408	2928	chrome.exe	110
PID 2928 wrote to memory of 4112	2928	chrome.exe	111
PID 2928 wrote to memory of 1584	2928	chrome.exe	112
PID 2928 wrote to memory of 4112	2928	chrome.exe	111
PID 2928 wrote to memory of 1584	2928	chrome.exe	112
PID 2928 wrote to memory of 2316	2928	chrome.exe	114
PID 2928 wrote to memory of 2316	2928	chrome.exe	114
PID 2928 wrote to memory of 3880	2928	chrome.exe	116
PID 2928 wrote to memory of 3880	2928	chrome.exe	116
PID 2928 wrote to memory of 520	2928	chrome.exe	117
PID 2928 wrote to memory of 520	2928	chrome.exe	117
PID 2928 wrote to memory of 5060	2928	chrome.exe	118
PID 2928 wrote to memory of 5432	2928	chrome.exe	120
PID 2928 wrote to memory of 5432	2928	chrome.exe	120
PID 2928 wrote to memory of 6048	2928	chrome.exe	121
PID 2928 wrote to memory of 6056	2928	chrome.exe	122
PID 2928 wrote to memory of 6064	2928	chrome.exe	123
PID 2928 wrote to memory of 5204	2928	chrome.exe	124
PID 2928 wrote to memory of 5672	2928	chrome.exe	128
PID 2928 wrote to memory of 5804	2928	chrome.exe	129
PID 6004 wrote to memory of 3824	6004	msiexec.exe	132
PID 6004 wrote to memory of 5352	6004	msiexec.exe	137
PID 6004 wrote to memory of 5600	6004	msiexec.exe	140
PID 2928 wrote to memory of 3456	2928	chrome.exe	141
PID 2928 wrote to memory of 3456	2928	chrome.exe	141
PID 2928 wrote to memory of 2664	2928	chrome.exe	142
PID 2928 wrote to memory of 2664	2928	chrome.exe	142
PID 2928 wrote to memory of 2480	2928	chrome.exe	143
PID 2928 wrote to memory of 2480	2928	chrome.exe	143
PID 2928 wrote to memory of 5232	2928	chrome.exe	144
PID 2928 wrote to memory of 5232	2928	chrome.exe	144
PID 2928 wrote to memory of 5944	2928	chrome.exe	145
PID 2928 wrote to memory of 5480	2928	chrome.exe	146

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\payload.jar
1⤵
PID:904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff44a2c728,0x7fff44a2c734,0x7fff44a2c740
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,1226483090936283902,11197699226029608058,524288 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,2592593284132022382,7534153577147556085,262144 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,579278974392568985,5113420392519517234,524288 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,425899582209718331,8088657818487192119,2097152 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,909750409720174598,9775454781644576989,2097152 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4328,i,6102572502763629196,14802282984128267058,2097152 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,10253513602346725549,7184882156159631540,2097152 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5200,i,16108695169191701469,11044555745102125852,2097152 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,3922687619893763216,12313946339829013343,524288 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3448,i,6503206651814000405,9981935572692538447,2097152 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,11861331462163787539,7065951994233447354,524288 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3500,i,6283107550423507336,2563986168993199900,524288 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,9174400247053277814,9003856206072074617,524288 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4356,i,11569019058331844433,14224786207033476629,524288 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4452,i,10262785367186326582,15148203094941333972,524288 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:5672
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\python-manager-26.3.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5744,i,4484577694390110734,4708209632908563948,2097152 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6296,i,8572610732475640902,15700866817075898615,2097152 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6444,i,7973185341951339785,11127649232199463736,2097152 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5764,i,13098734050659632199,12688551737107773060,2097152 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6700,i,158405472416252200,2273383168263521167,524288 --field-trial-handle=2080,i,4216970832104410185,10733579379021229035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\recaf-gui-0.8.8.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5224

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F60A9DBE4E51E7D7E8FB8EBD53873B99 C
  2⤵
  - Loads dropped DLL
  PID:3824
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5352
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 65083EBB5E79AD1766459B3976EE3F87
  2⤵
  - Loads dropped DLL
  PID:5600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a2731.rbs

Path C:\Config.Msi\e5a2731.rbs
Size 14KB
SHA256 ca2b1123027440abca810a2cbb25b96aad493f34d00a430760e771ea581261be
MD5 26d5e04ea47c1157a6b264728ab8646a
SHA1 8f2fadd8a133ff92c52fce2298a4bf91a97f827b
SHA512 cb0f9236a5606b5086550d250716fbd96e01c7c5372f3d3a4551acfd41aa41bef1b9cb9ae4fe4a1d7857a88d4a189239954500f5cc1ffbc05746c5a1136a3216
SSDEEP 192:ONSFaXWSpy4+j8XmkPdx7EMQeVvjgzIhjgzxBEOxw2EbORGpIBN:ONSFaXWSpyKWqv7BjgEjgFeAabOnj
TLSH
T180524342BF84C1C2F1D62A7AC35B2B5437A2C7AD8B44035742CCC275AE43B566F7B989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

117308CCCD9C93758827D7CC85BB135E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E
Size 913B
SHA256 017fa963c60af3bcea25bcf003cb63c4b99c8d0142b66dd40c6cea272305c79c
MD5 0fe24f1771eac785e3f3781e9f5a47b1
SHA1 90b0d241d2ce083df24e943b5cb073b98e7973c8
SHA512 3b9d7053b34ae3efd6ca10ca3f527bee7dfc53e01785987360611a4053bfd1273a563739ef96073a6f0ff69417926608836b19bb9fe196fc16d6696fc36de56a
TLSH
T1B611B7C2B028661798C56AD9CAD74C5B7AF42B6116802E6A10E9128D1B9BFF5D30541E
MD5 SHA1 SHA512 TLSH

Submit Download

5A6896595A9B5FF7A8254147F2B2367B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5A6896595A9B5FF7A8254147F2B2367B
Size 13KB
SHA256 64b5a50c1e07dd74bbb7bfedeceabea5f9e86af6bc8ef6b93bd2f1796142e96a
MD5 f087873d7b31d264d07cb6b0a33316a8
SHA1 09da8dab7bae89393d4c7b74d31a91fe3b550df0
SHA512 7f557933e23c01476e85b4d7cc97a818925b06ea516dda9423708a489e231e3d4df29b40ccb54af54e4043585fa575780f92ff34d749dcbc57127174f28a42de
SSDEEP 192:9uqOR7w2AaeqsVN3L7zgdIIk7R7V8RZlq3AiLntD0YFDy5:9u9BeJjnivkt72FypDptm
TLSH
T1CB521DBCA91C6A9780D1AA75CACB8FE7D8F541A137C1E11F01756F880424EC7CE97782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 9e153cc9331fb887cacd6f08cfa3dc5aac7b9b26b4b9cfa75d2ac57288e9142a
MD5 13c624bbd9ad9ff627a68b5ced19b228
SHA1 ff158247f5c6bf41d5fed9f3d756b82f735a24f6
SHA512 62251f6fd12706cc3b90b738523a3a32c34b104ed967b0f42da80596fe0a3b03a27dbbbab144afff619c4a910558b2f8f6f6f223f4cc65bb288f7516bfdb7068
TLSH
T14A017561A8BCF3844DA11BD603F4ADA559B407F6294CB2672437A1560562B53EF28129
MD5 SHA1 SHA512 TLSH

Submit Download

117308CCCD9C93758827D7CC85BB135E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\117308CCCD9C93758827D7CC85BB135E
Size 348B
SHA256 56d328802b1ea13f07998bcc3fbe102654c271dec38342fb5e056591f6e2e5ef
MD5 701c7e36937af247f6b9220c04ed0363
SHA1 9c45df48664c3654ddcf626ba247dfbeb1da7d69
SHA512 9c008d7a7c8f3e98c762a90570a60a1a4dcf04953d7ed065a8ee51343247e8b9ee398039d1e9ea38e57dafde2bad372dab97a4296e6d0e89b3d9be6789a3f9b7
TLSH
T14CE0EC0DE7FD0A12F8D6C67A44F82917A9767D55B104C6990BF2830C7168D45B870713
MD5 SHA1 SHA512 TLSH

Submit Download

5A6896595A9B5FF7A8254147F2B2367B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5A6896595A9B5FF7A8254147F2B2367B
Size 290B
SHA256 743f301201863f239364234ab9f228d41a8f84c6f1196e7e5a53be54577d4a1b
MD5 bfb2f201b8752597a2566be78f9fe986
SHA1 a92564889cab255782ab934eb718ac53f8e24405
SHA512 aea5c8dc549f44a8d81cd93db5bece9b25e4eeee31f80d90789a42cdfa574ca24bcdfa6671a12b0322aa2cbe959cc074bb36108e88203f10974b32cf8ee164b4
TLSH
T1BED05E2CD3F50A16F046C87E9AE11853BA757929C50583540BF0D3157068D46B8B2313
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 0353eb2f989f3380e656f343466ee182d43968173a7de828fe803e17ebce8240
MD5 002ae6383b46cd731d2925a7506f4a59
SHA1 887924fe0565c8a257f50037952187e702165f50
SHA512 e48bc08d97fa6eb7ee7bc36c7e3e525d685cbbd96a043b3f711d3a0346f4fc15289c6fb32ef89004f64175950af31bb1da33c16df026a96cc91a49178bfad059
TLSH
T123E0170CA3F90627F4A1C93D25E024137A35AE558A04C3490FF08B09787C982B920713
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 25a4dc3273ef198ffe24edffecb7ed10ce19d4927321de8ed3f30a8a25d153fa
MD5 6fb7399b396961001ce90ad377995e6f
SHA1 7c272dce591c0f51615f79ea0c8a802fe3fe2422
SHA512 000a859991a5981bd03ddb43ca78818817c3b958c55c8b5453e1d3d6387ba99c45046da1e85f3f5c7833fd439198ce4b3dd3f0ab69c54ab4901e172f0b71e33a
TLSH
T1B7E02BB9CC31EC2B9CFD475D60544A4AEB50135717A0895F373C8108CFB16670686C9C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 32KB
SHA256 04c7f19e1ae294cc641f6c497653b5c13c41b258559f5f05b790032ccca16c82
MD5 b582b2eca79a750948dbb3777aeaaadb
SHA1 bf0ea1c8a7b4a55779cbb3df1f1d75cc19910e9f
SHA512 35cfd88afe4e4e8091d3a5c53f0f3e2dcd92aa58b7544b94d4d9d7cdf508d429c5292aa97b813c9c8ad18e4d121d4e6595c49f5ddafbeab7b39f3a7c9d0b58dd
SSDEEP 768:S5rsd4sFCihE6OYoEs/5pn7A8o690DW1d3zt0OG:+4d4CbdOjEQp7ho6x1djPG
TLSH
T143E2E2F9A6319A3CC9E9F3C983459F40F75EA449A50C11CA70A8FCE465824CD5F7AA0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 66KB
SHA256 274befc7b39609fed270e69335bc92b3d8251545594636eb408d5d93e0ae1a4f
MD5 33411bb179575dfc40cc62c61899664f
SHA1 d03c06d5893d632e1a7f826a6ffd9768ba885e11
SHA512 dc830766c928ac84df16d094fc92586b9c2c25f819123dc9b5ec259220b4b1c45e2af28c89a710f047c00c9dcf7df8dd859a9a7a2d2228703f616df13caef2c7
SSDEEP 1536:DQFVtT8CbB1R8u7uT2yW7tLkpVmWYK9XoTEPnq0K+XeooPpcmgK:6gI1kT2PiiuXoBSuoohKK
TLSH
T1706301B43270DBF4E089C49924E62B1CD4D3606FEABF94E4B146DEDD922BC773198848
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004b
Size 892KB
SHA256 db1ca645e5644e45027f16b1f28c54e0e6e4a10d3d79b387bff7bffe4969b04e
MD5 60aaaf99ef8dbe11ce4f718bd2672f5a
SHA1 6069cf049b727d6fb355af9b02719987de064446
SHA512 1ed4aef8e1dc88024700800573db4a4babba87d72bd98d8ec4651295bea60ae01b444e39917e23504ea0d2580e811fed6b0142b871631bab6a277e3613c75a79
SSDEEP 1536:XlRJwI2oE7hxAGkYVY1JKeFwlKif5R8qoABhT7inICE0Yy/Qq1XRCfIMRX7LjYEU:zJwGE7PAgGFA59WIC7Yy/OwYkEu9
TLSH
T1FD15098C73D77C0FD820AB3075D103983B7AD8848BAF438B864617DE6D557A838AD6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 912B
SHA256 967fb367bde83e326ccc9232c5037c453aced9cddf4eef770b42996a0ebb353f
MD5 309230944d91ad881b673294e2d69a25
SHA1 e1868b927803267f072e80f9adfa66007562f57c
SHA512 a8470f069020ead782e354227889ba0100db4949f5cea1911baf9dfa01f65f135961809835b5ebe157843ade83b23d0ccabada027d6284da330852a50eaa2d4a
TLSH
T1FF119E931A53A4A3DBF0677254C206FAF9290658561F4F4C5340E4B568C1BBE6E052C9
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 fe96646a1aa023321fb55714da51ccc102ac3bcac941639205cf0fc83a0d5d1c
MD5 561e070dba1b8a3b4daacce4ddc4682c
SHA1 16f73240c26998cf82d5c3dd4e33c986314e68c9
SHA512 7540b71efe96b77d2f9a68b0dcbcb8c415b09c28cbb03e719d9b97682e1332251913b421763df1d0ca84bd042f9e8b92e82f0c6b847d92c43a6fe2ed7abb7fb5
SSDEEP 192:DtOSDp0kaIvDC8C+26otPDsNP0N2E0HdIzx:DtOSDp0kaIvDC8C+26otPDsNcN2E0Hdk
TLSH
T10FD18DF7C3E8856EC91156F49B166F1FCE6A0918431C3C6AC8D4AE1BA3E3871E25474E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d4fd627605884b393fd6758d3d26987acf0c5352e8c8673d980680692e7f223e
MD5 06978ed3881aa4d37e9582e6d54b876b
SHA1 473b9c702e6b632e51d99d05799bad63f566023d
SHA512 9f8c1bbcf1552ba37e4e259fec882d3ce18f5d1f3c439421b667f40a78893747090a80b398e073be92baad0ba9d37ed84596550ca4d5bb69f248c151ff5e347b
SSDEEP 192:GRTcBzdhaVo86kGv7AhAPRp2GvZT9qHsb+WNKPNS44mx4AmB42UC2QWkwbJVyIsB:GRTmzdUVjyk8Xlkwv4P4f42v2QWLe
TLSH
T1CB52B73EF9106D3B9CDAD219F9627B27E7F5203521942E84EAFC892C19E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a762c6903c6c206998d1340d0731ff5069b40f025002e53ede3666c756db0ce3
MD5 9caaa15616b9e8f963ab2b450c1234e7
SHA1 58a932214e82daa5d4d630e4b4b3d45b4ce002ec
SHA512 2f85c2fc62b3b98efc3a6c499ff71dda9b7a1181a6887b9c470338576f176d5fd7b05f51dc48e1447b0db5cd0b581ef755768482088f209f00090de2e4f84f46
SSDEEP 192:GRTcBzohaVo86klv7AhAPRp2GvZT9qHsb+WNKPNS44mx42YC2QWkwbJVyIsnAUge:GRTmzoUVjVk8Xlkwv4P42T2QWLe
TLSH
T1B652B73EF9106D3BACDAD219F9527B27E7F5203521942E84EAFC892C19E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 622bd3df533fdc21b89519672576d78128daa9d09eabf4e4869928c5283f0028
MD5 b09b959ce109b7f732787159dc338e18
SHA1 49444bc0c50d6f88910c1088b37a6dcfa58bebb0
SHA512 e82292c74f7e9802b4f7b04bd527326dfe021d76dccbbdaac5f65488f274cfca30f5a05cc40caae0d702ffe3531489c374de0fb302b463ecd6f6991e34b3721a
SSDEEP 192:GRTcBzchaVo86k1Uv7AhAPRp2GvZW9qHsb+WNKPNS44mx42KC2QWkwb5VyIsnAU/:GRTmzcUVj1Qk8XQkwv4P42Z2QWL8
TLSH
T14652B73EF950693B9CDAC229F9617B27D7F5203521942EC4EAFC892C19E75CC221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 637e3b8b1cb9f9d0c941142709d825866faf49776b5207d0aa2a0e5d58f9f168
MD5 efc971d864264fe62e4491df4edf1dbe
SHA1 206694f577d061a0024afcba34e1350fee802154
SHA512 e0d93557dcb0c3f16e1186e60ba970e886a22e00a6d03b38c76aaffab8f4ce69caf7787b7fb6008c12afad42df6a3620ed348c1004796bd6d899a610666ab698
SSDEEP 192:GRTcBzdhaVo86Wav7AhwPRpmGTwL1T9qHsb+WNqy4HPNS44LogmB422C2QWkwb1M:GRTmzdUVJ2kMXTgkwD4L/4212QWve
TLSH
T16462B63EE9606D7BACDAD229F911BB27E3F5203551C02EC4AAFC892C19D75CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 7be3a5cb61864baf9a796ed4c53aa57f26c4525fdb86cd08a85b1ef4dcdeafab
MD5 6a46236e621729a39f7cbb245a05217b
SHA1 1726ab8e1d26cdcdf6ef34b48f724dd4b95e6313
SHA512 774765d15d72a4ba00a5bacfe67be98544276b9071600753b6e3f360a35418b795d12bf6595235d586882f22974d81c56a5477eea97e3756c1b3870d427c1da2
SSDEEP 192:GRTcBzGhaVo86Wav7AhwPRpmaMTwTB1T9qHsb+WN4lVby4HPNS44LogmB422C2Qr:GRTmzGUVJ2kMXgykw4js4L/4212QWve
TLSH
T19D62A67AF9606D7BACDAD229F911BB27E3F5203550C01EC4AAFC892C19D76CD2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3275a78f50b3ff24c71411127f1a579029b88a8a696881bcf63a1ea991c5b6a6
MD5 a9fac0bad65e7693e075ea7c13a151ed
SHA1 9b18c0ec2e2af99179cb8798dbb4a3795e9b5e13
SHA512 9e12d40c2d4483a1dd27f38410de581fde847faf57af56dbfa52f6b56261b63ee7cc9f09327071d722af301b5c790aad3266a8a1153fd93b07b91e306b6337a4
TLSH
T1B5B0120180055102C4A303B01242188871149F20DA0F270183F0E922D8665618025050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5937c0.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5937c0.TMP
Size 96B
SHA256 86684d7a69fbc0cdfc86ec6bb49b69ef1a7a8465fd435bb86eb4e858f25a8c44
MD5 1d9fbcf5c8ac53346a90d21f9333e706
SHA1 8eaa71c0afce2b52b5682b6447f241bebdba219f
SHA512 d8c5b96f778550fa02dd88934c560e8c91662cae8bfc02cb58c26721e8db34d7b5a08e31a966c831876e9800dc16ddb9d1059f0debbd8241f1d47af9924fe8e4
TLSH
T1CBB022A0C002B20BC00303B030C0A0E8B0E0EF20C203220283E0ABB2EC202308020222
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 caa544cb9a144f79554f8d89a074362cbd9582ef0e6772a8870dad59133fa048
MD5 c53a46ad7eab0535d14b4f0efcab4deb
SHA1 4df0abe1d14706cc2d24fdcbe4867fa141017837
SHA512 481d2cadee31b9340c79083ee4b8d70e8cbdffa33c448f75eb8c7b1fdb6b3499a2afb16aa8c0ec9b79e82fa6b09612992f75a51a4858d484219953a69c460397
TLSH
T1DFA002B289820242C8814BB0D3D716C06315AF5713135B5586D180858DD474B4202254
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 13ffddec0f0f56c48740b668a60c41ac422f1d68dbbeaa9e36d18aa1f4a7323f
MD5 20b6ffe62531240ccd64f41746bb8eee
SHA1 34eb6fbd3221a94e0f4ad5c6bdb1c7666b575004
SHA512 0e8d660d290f8d675c59746924869505a57e0065635f790a29046432ec9a2426f4e34be29c8e40de5007a3ae13510b3f9c23e64526ef69bcadded33371c712d1
SSDEEP 6144:f9ZuN7WZJol1mtc0kjkQJxWvG7gq99Cm7Rkm1tYpBeh2BAoK:lI9Wje1+k1u6gqB9oBGcAoK
TLSH
T1C23423A65DB84E376FBEF79761950B1E2AB19852842DEBD588F00E0423FD7DD0906C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7dd362f4c348b1f64183419e050dedf6bcdf770564d92ed841295bc15d3cf3f7
MD5 704c0e7572b08ee362ca13fc61c84ab4
SHA1 c66d9553b4bbe7a605c065524aa17f0dc0f39d2d
SHA512 aff32db123317f3a3d49d018006a06d5dd60ddcbae882da694a0817635d878c76633e1e754c8a08a426e5dbb418b4ed895b7ebe61c276697901f3642de14bfb1
SSDEEP 3072:A/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:tm7Rkm1tYpBeh2BAog
TLSH
T16AC3023B5E75E83B5CB5A74EB08E0F1E2EF149A6C920DE9288D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 b02e59d007fda9a996c76266b575802a611137ebf64073ae65b65ddfd26a6ce4
MD5 edf4e0fc2e9be3fe5eefdcbb50473f65
SHA1 3090046216246b58278270e686fdfdef134852d7
SHA512 860a7160fae9c7897f4b7d62598f366b6af9c7da4bf026ebf3a93e9cf1bc5db6be094c82677ff0de0bf63720ceeb5e19c1340a2c0dcfc816537ac771fa559ea3
SSDEEP 6144:49ZuN7WZJol1mtc0kjkQJxWvG7gq99Cm7Rkm1tYpBeh2BAoK:sI9Wje1+k1u6gqB9oBGcAoK
TLSH
T1993423A65DB84E376FBEF79761950B1E2AB19852842DEBD588F00E0423FD7DD0906C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 cac2359e6ac63b0de97910d58761e0231e1d3bb8528bd4e404887bc1b26af366
MD5 ee1a37b544eb7f7f0c2b5ec1062baa62
SHA1 1219f78553fd8ea027d2189ccfd219f7ed298852
SHA512 7bdf3ab30645cf981c1e8ff28605e4899409b815ac091b014713a978853926216e42b4a26a64dced0f5c13c9fb795a0befcb48aded9f4fe0d2c6ea36121c2374
SSDEEP 6144:Rw9ZuN7WZJol1mtc0kjkQJxWvG7gq99Cm7Rkm1tYpBeh2BAoK:KI9Wje1+k1u6gqB9oBGcAoK
TLSH
T1AF3412765CB44D37AFBAEB9B61851B1D1EF19952C42CEAC988E01E0463FE7D80D06834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE68E.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIE68E.tmp
Size 390KB
SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
MD5 e8dc682f2c486075c6aba658971a62cc
SHA1 7cd0a2b5047a4074aa06a6caa3bb69124851e95d
SHA512 a0a1f0f418bf2d4ffd079b840aeb0142c7faab7fa72b5e33b1841798569f55a25dfd305abf9c2ca89792f6499f695b69975882697dc53e99d5a975a9fa8c7d75
SSDEEP 6144:p2ET2+QBLh+MVy5DCRoRRvc181kaKN8MMLuG:p2ET2+cVXVyNhvcCkaKN8Me
TLSH
T10D846B29F7E408EDE4B78276C5A68530FF75748D3320D5AE47A8852D1F3AAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 264969.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 264969.crdownload
Size 9.4MB
SHA256 259af5272c8f798786c1109b7ad287da519c58d43d7250ead8ed20fa3277a511
MD5 c99b1705db384d0893449efc5fc4efc6
SHA1 d04648b1a2ccc945853210cbdf5fe95dcf7567c3
SHA512 726cad116663ef6127ba6ed48bbc638ea0a93fc44ea893cb28ad94cc8f41acabd4a70dcf3c6c26e067929a8b735a1afc8e21fd79071b53b048b50fffa00d10af
SSDEEP 196608:uqJZZRk7q2ccNtjmb2hum6ZxwRp9gEk5DE3Wt8szIvvFYmainFJgCQw14a/lZ:VZeqOtjHhdO+pa5D4fsz6vqSgCrpb
TLSH
T1FFA63315F7D448EAE877833696A68230FE76BC4C3310904E67E4BA292F3BA707176355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python-manager-26.3.msix

Path C:\Users\Admin\Downloads\python-manager-26.3.msix
Size 44.9MB
SHA256 bdd1a4e0b485f674748b275095cc8e7132beb37a1ae91db080abb2661e3badec
MD5 481108867e8640739f8202c83698cf3d
SHA1 c69fdf0ae2375c6ee091a9d3b356f726193ed2a2
SHA512 c4cae5cdb83185463a202144032490bd72d5e75023ce978060f69f49489ec2acac12d93ddef6f9aa844e63cfa9cb35ce14f74903f2c85efd9a8e3a056df29bb4
SSDEEP 786432:g8wSX9ok1R1mf6r95KmXI/IQn8t0YbdD73Fv6VT6awNrxOrp6IFoQ7Ef/c7lbPOP:1tD71mke/lng0kdgGawNsrp6IL1POP
TLSH
T156A73321FA0D1EF7E1537E3D51418F268F2D9093224EF48E2EB846E415536CDAB9A70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recaf-gui-0.8.8.jar

Path C:\Users\Admin\Downloads\recaf-gui-0.8.8.jar
Size 1.4MB
SHA256 7dadb6d0ee9f1f57549601a4a0018c62e14f380e8d21d4839f9b5da1e4b10db8
MD5 0b54d76e697c8399832a814ba9daf51b
SHA1 6e19f222fb41c041e4f2a819acef409a827c4dfa
SHA512 8eaed1b2b53f0bf67e3b5885e0d70881cc4f5efffca726bbfbd469363a68d26252e27ede76ba7c6fbe63086f251080df64c26d751c5f54b84df9078adb068cb3
SSDEEP 24576:E3sWh6xvvJvZ2o70c0EXAKJ4RxTJcpLbNPNvF8N3mok9EwV4GFljl:EZMHAoQc0+ALrcVb5NvFWIV4WFl
TLSH
T10965E119F6C81465DD2B62B9E76F83327E3E478CE05D50261CB021C6E876A4D8FD839E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 fca4e19ddf419d9e24ca8419832ee4408ce1a858930cd197aca79c7727fa7631
MD5 ef4ab31f300eb8708472fb3d2935ca0c
SHA1 4d31f8dea2e92f14e3b9c87969a5d8df3272b3d0
SHA512 f69350e20b5654b266a81a51b54800be1a28930c2e5b4f7f60a53484a5955eb2258ffc64fe4e57ab1af3d2aea5c4edb63a4d8135f64216799a88a0eb5159dca9
SSDEEP 24576:Qu8m+1zTdoO/vvTLbWhuEGalg4kzZ1hSdnGdT+AVpUqwu2YMo/F4ZHaRk:Y
TLSH
T15547D32437F92200E7F79F3DACF06A23493A7D5B9C159E8D45411B4E0921BB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2ba1c11b-e3d9-4300-8a94-6ff9542431e4}_OnDiskSnapshotProp

Path \??\Volume{d78106ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2ba1c11b-e3d9-4300-8a94-6ff9542431e4}_OnDiskSnapshotProp
Size 6KB
SHA256 a93812e082de230fc303967a7258fa193aad2664102b59a7ee227c74df2285f2
MD5 b5b4ed794695c0edaf53eac3b02c7106
SHA1 7b70a1286dc43767030acebd1228dd57ffcee7e3
SHA512 536aca0dc38b02e13a6b9e937b6ac67b13c1fca968f9d9d193a563952dc10f8a7388f8f8227dc98131d2cfde331516f9a72cfbaf7d949eb64d6b07e9ceabe96a
SSDEEP 96:FdKHU7VQyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:vKdIb++ZVm
TLSH
T1FAD19A185AF54311E2B3AB7228F14557A477B911EF33CB8E0298238E2630A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5480-707-0x0000024DAB440000-0x0000024DAB441000-memory.dmp

Download

memory/5480-716-0x0000024DAB440000-0x0000024DAB441000-memory.dmp

Download

memory/5480-726-0x0000024DAB440000-0x0000024DAB441000-memory.dmp

Download

memory/5480-742-0x0000024DAB440000-0x0000024DAB441000-memory.dmp

Download

memory/5480-747-0x0000024DAB440000-0x0000024DAB441000-memory.dmp

Download

memory/5480-752-0x0000024DAB440000-0x0000024DAB441000-memory.dmp

Download