hxxps://nsvault[.]me/

Resubmissions

05/09/2026, 18:40

260905-xbhpdagp4t7

05/09/2026, 18:28

260905-w4hdmsfd727

Analysis

user interaction
yes
max time kernel
202s
max time network
190s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nsvault.me/
Sample260905-w4hdmsfd72

Score

7^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
5444	forfiles.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1488	powershell.exe
1132	powershell.exe
2836	powershell.exe
5760	powershell.exe
3392	powershell.exe

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1940	cmd.exe
1276	cmd.exe
6056	cmd.exe
1208	cmd.exe
3424	cmd.exe
5948	cmd.exe
3052	cmd.exe
2852	cmd.exe
1640	cmd.exe
3536	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
528	chrome.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331065240480808"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	chrome.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\NuGetFrameworks.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\Compile.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\NuGetFrameworks.Shared.props:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\0wthYgrUL.rvl:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\NuGetFrameworks.csproj:Zone.Identifier	Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
3556	chrome.exe
3556	chrome.exe
1488	powershell.exe
1488	powershell.exe
1488	powershell.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
3448	taskmgr.exe
3448	taskmgr.exe
2836	powershell.exe
2836	powershell.exe
2836	powershell.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
5760	powershell.exe
5760	powershell.exe
5760	powershell.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3392	powershell.exe
3392	powershell.exe
3392	powershell.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe
3448	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3448	taskmgr.exe
4408	Setup.exe
4408	Setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2144	1824	chrome.exe	88
PID 1824 wrote to memory of 4100	1824	chrome.exe	90
PID 1824 wrote to memory of 528	1824	chrome.exe	92
PID 1824 wrote to memory of 4100	1824	chrome.exe	90
PID 1824 wrote to memory of 5212	1824	chrome.exe	93
PID 1824 wrote to memory of 5212	1824	chrome.exe	93
PID 1824 wrote to memory of 1552	1824	chrome.exe	94
PID 1824 wrote to memory of 1552	1824	chrome.exe	94
PID 1824 wrote to memory of 5152	1824	chrome.exe	95
PID 1824 wrote to memory of 5152	1824	chrome.exe	95
PID 1824 wrote to memory of 4612	1824	chrome.exe	96
PID 1824 wrote to memory of 1500	1824	chrome.exe	98
PID 1824 wrote to memory of 1500	1824	chrome.exe	98
PID 1824 wrote to memory of 4736	1824	chrome.exe	99
PID 1824 wrote to memory of 4736	1824	chrome.exe	99
PID 1824 wrote to memory of 2472	1824	chrome.exe	100
PID 1824 wrote to memory of 2472	1824	chrome.exe	100
PID 1824 wrote to memory of 2920	1824	chrome.exe	101
PID 1824 wrote to memory of 2920	1824	chrome.exe	101
PID 1824 wrote to memory of 4848	1824	chrome.exe	102
PID 1824 wrote to memory of 4848	1824	chrome.exe	102
PID 1824 wrote to memory of 6128	1824	chrome.exe	104
PID 1824 wrote to memory of 6128	1824	chrome.exe	104
PID 1824 wrote to memory of 1284	1824	chrome.exe	105
PID 1824 wrote to memory of 1284	1824	chrome.exe	105
PID 1824 wrote to memory of 5876	1824	chrome.exe	107
PID 1824 wrote to memory of 5876	1824	chrome.exe	107
PID 1824 wrote to memory of 3672	1824	chrome.exe	108
PID 1824 wrote to memory of 3672	1824	chrome.exe	108
PID 1824 wrote to memory of 2572	1824	chrome.exe	109
PID 1824 wrote to memory of 2572	1824	chrome.exe	109
PID 1824 wrote to memory of 420	1824	chrome.exe	111
PID 1824 wrote to memory of 3596	1824	chrome.exe	112
PID 1824 wrote to memory of 5296	1824	chrome.exe	113
PID 1824 wrote to memory of 1888	1824	chrome.exe	114
PID 1824 wrote to memory of 1888	1824	chrome.exe	114
PID 1824 wrote to memory of 4072	1824	chrome.exe	115
PID 1824 wrote to memory of 4072	1824	chrome.exe	115
PID 1824 wrote to memory of 5440	1824	chrome.exe	116
PID 1824 wrote to memory of 5440	1824	chrome.exe	116
PID 1824 wrote to memory of 2584	1824	chrome.exe	117
PID 1824 wrote to memory of 2584	1824	chrome.exe	117
PID 1824 wrote to memory of 988	1824	chrome.exe	118
PID 1824 wrote to memory of 3556	1824	chrome.exe	120
PID 4408 wrote to memory of 3424	4408	Setup.exe	124
PID 4408 wrote to memory of 2852	4408	Setup.exe	126
PID 4408 wrote to memory of 1640	4408	Setup.exe	128
PID 4408 wrote to memory of 3536	4408	Setup.exe	130
PID 3536 wrote to memory of 1488	3536	cmd.exe	132
PID 4408 wrote to memory of 1940	4408	Setup.exe	135
PID 1940 wrote to memory of 1132	1940	cmd.exe	137
PID 4408 wrote to memory of 1276	4408	Setup.exe	138
PID 1276 wrote to memory of 2836	1276	cmd.exe	140
PID 4408 wrote to memory of 6056	4408	Setup.exe	141
PID 6056 wrote to memory of 5760	6056	cmd.exe	143
PID 4408 wrote to memory of 5948	4408	Setup.exe	144
PID 5948 wrote to memory of 3392	5948	cmd.exe	146
PID 4408 wrote to memory of 5444	4408	Setup.exe	148
PID 5444 wrote to memory of 2440	5444	forfiles.exe	149
PID 2440 wrote to memory of 2456	2440	cmd.exe	151
PID 2440 wrote to memory of 4708	2440	cmd.exe	152
PID 2440 wrote to memory of 1208	2440	cmd.exe	153
PID 1208 wrote to memory of 3872	1208	cmd.exe	154
PID 1208 wrote to memory of 4828	1208	cmd.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nsvault.me/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc4cc2c728,0x7ffc4cc2c734,0x7ffc4cc2c740
  2⤵
  PID:2144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,12165954982655037198,6481088151908330659,262144 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,14252110003679102532,8923302605522348620,524288 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,11516388530435336908,15777456873449011106,524288 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,7365685292964964344,9041771793615634098,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,10500672971730574838,8280999058834021841,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,16673075218361380432,3792091705387532643,524288 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5372,i,17176429255975399501,9558482911098013691,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5400,i,8284704933165335027,14980509055263173322,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,11951107061897307779,4813118515093512185,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5784,i,3860729162234928024,9046612436664947454,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5672,i,6980670197264057244,13430717772986334428,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6380,i,13909989968623335826,18365219184360353296,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6064,i,11561289670469307748,6663484694832214832,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6660,i,9242399535967026501,6048789665187116057,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5464,i,12376923688317328418,16422579442338166550,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3272,i,509701001006829474,13263940322798393257,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,17319882578350981208,9423396218293844192,524288 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,3857874790170000909,5172870352452975533,524288 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,1432952311893157525,3550757320381066567,524288 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6688,i,15134933160297549805,12111495647280438842,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6380,i,12953978727524320227,13104487583439487885,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6640,i,3491462244015827643,13943037505106656948,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6416,i,6404797991894506344,15257015738056919381,2097152 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6444,i,224952433555753087,17760296926471044848,524288 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3780,i,8978657884407258410,13229423028463073933,262144 --field-trial-handle=1916,i,6899166602353601811,4603477912833693977,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1660

C:\Users\Admin\Downloads\Pokémon_Legends_Z-A_NSP_—_Download_Archive_win64_8246\Setup.exe
"C:\Users\Admin\Downloads\Pokémon_Legends_Z-A_NSP_—_Download_Archive_win64_8246\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:3424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:2852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:1640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3392
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1 /m 0wthYgrUL.rvl /c "cmd /c ren @file 0wthYgrUL.bat && call 0wthYgrUL.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "0wthYgrUL.rvl" 0wthYgrUL.bat && call 0wthYgrUL.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2456
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:4708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber 2>nul | find "CurrentBuildNumber"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1208
    - - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
        5⤵
        
        PID:3872
    - - C:\Windows\system32\find.exe
        
        find "CurrentBuildNumber"
        5⤵
        
        PID:4828
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\0wthYgrUL.bat" /launched
      4⤵
      PID:3328
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\0wthYgrUL.bat /launched
        5⤵
        Executes a command shell one-liner
        
        PID:3052
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1748
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\NuGetFrameworks.csproj" /nologo /v:q /nodereuse:false /noconlog
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3232

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

69aaa1ea-4b1d-41aa-97ae-9a40cc19ed13.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\69aaa1ea-4b1d-41aa-97ae-9a40cc19ed13.tmp
Size 5KB
SHA256 2c5307e65d28a601eb476c909057a2968d9bd09dc8cc7900b246da010729bae0
MD5 c13dd225513bdc1361d77d15a7d867ad
SHA1 2ecdfd786374cae7618dbce56d777b913975df24
SHA512 f5c1d9b217a2b4f9a599f1f57fc28ed06d6c51fb0988cb47af3aa9bbfb89320f3918b44de77a9570912ac87534133ec2ae657f868b97f6ef43ef2d23240acc55
SSDEEP 96:ybJ0d+CVgOeTnnGBfYZSl3/QSl8h4otop5p5D3B6MGtvhyYm8f+caSJRNC39ISyy:yt0JeGnmiU2Xxw5tWcaSJuCyWk
TLSH
T12AC13BB1E05EACA74DF6B98AB1032D43C8A921AB9A257E18FDD94F0C01E70DD5383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 00e3f8de68d9a9dd6f36fce3aef67f9b8d6c19682fcb411a964e8f2029c87138
MD5 63195462bf49d8c3e501f8cc8fbb6425
SHA1 f119d665e7378bb8ef8227a1e688e44b679514c3
SHA512 83cd4a9ba5ab228bec0415d748ce15446938b27b212fcdf620c5d0a2d0cfd243e64b8bf72d989f058a8034120083248bddd45f5665b7d5614e417f3798f8a2c2
TLSH
T192D0229032D003D7CF4346F0B8C1202B3138765882330B338852C5DDB563BFC90A3001
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 36892d86f8d881f7c1a36d20fc30a59629380276f6ca70dfae8aa6419651188b
MD5 4e97d289f06e68cd0f3aeb682ce68f88
SHA1 d6406280ed690d1bb0e2b649f0b1524f8e192364
SHA512 f66199ff02e5289273b95644e4da609f1019d348f0944573c4066288ecfdec985f9012cc14d70c49121f23dd18479a36cc912ef8ff5b54320cfaacade4bfa3cb
TLSH
T183E05E5066A003E6EF6309B07CD1256B3528764AA2331B339540D5EDB063BBD10C7045
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b9f9cb4068a6e3a9dff620fc6b41a5080cd5d287ee3e9d11557f8e794c8caccd
MD5 0ab4089cb870b674f11e23b4687ccc53
SHA1 338af9bd749aed0370ddcf6f5374422a91e97da9
SHA512 ade4e1eb645012fe263116bdb3bd25011a089e88ba7069e3f5c59d5cfa62552f5a15d54efb519a21c86265504f6645e16fed5140320422914e2fb27ba4a6247b
SSDEEP 3:MsEllllkEthXllkl2zExll8w+:/M/xT02zz
TLSH
T11E44041CFFC44C05C50014315413C3D40370D4105F51D743345144137CC55450C00300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 d2aaea21d5783239ea44b51eeb38f2539ff9e0a5ed4e63312a2f9832d50af846
MD5 63956d58af238f1bc3698bc1a0a63ca1
SHA1 25326d4d0050511dec87de8ed228662fdc379a1a
SHA512 3d3053ad056fca65f393bc7e3ad939aab62de1ea114b2bc72a197bdf6a70f93702987496d5a3a89a6275d9bbc6584ec1542d0419484e0f30d8cf1d724fb7f253
SSDEEP 192:DPywUwxhiiaIaEdvPgeqpoeBwuw7wLmwywmw8wZb2zWVJw8MqU7/Z:DPyDihiiaIaEdvPgeqpVBDwvZPD8b2zP
TLSH
T17DF19FF7C7E8862DC92112F4AB142E2FCE19091457283D2ACDE4DE5BA7E2472E18074F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 72141e25f1ed6db1c2428a5a294191c8a020975670a6d26c314edfa9e583b8a8
MD5 77036d8c0feb3322ec265abc54c355f9
SHA1 9e667a380010f49175d599082d7e130c33d051fb
SHA512 d6e908ce925362e018eb8df1f7a72f9c62c60a3e73946bb806e25bd5935a9b610fa6a7cea1f70801526b163e2763425d2c122b2689f802f54d2fc151db41f78d
TLSH
T148415DF7C3D4997D8A0196F4A7152F1BCD6E0964521D3C27C8D4AE1F53E2972D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 45f6804feaf716c2af9d145cf9167f9a144b3cdd69ad474cb3aeb2b6f15399a2
MD5 33091a574aef06149b53f3997c001845
SHA1 b41aca1f1375a4bf22c4b89d5c27e96a619589f0
SHA512 9c79c1c977f8b5cf8ec8913f8eb3e93b6298bd9368e1ae2efc6cc381ad8612d59ff4644514a478ba8637d4831511517620101d17d24d807b89d6edbc2df1175f
SSDEEP 192:DPywUwxhi62uaIaEdvPg/poeNwLmwbwZb2zWVaqU7/w5EL2HCvwSwmwQw8Mwz:DPyDihi62uaIaEdvPg/pVNv48b2zWVaF
TLSH
T12D129CF7C6E8866EC92112F4AB142E2FCE1D091457283D2ACDE5DE4BA7E2472E14174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5cc5abb6d3534cbb4e68eb5469a65159ca9087c9cdc6f53374097f26cea6bc7b
MD5 25ef74d11debb3fe42ea7d0803e5c4ec
SHA1 2c766be99e8117b90453e250f154d4fecf5d18d7
SHA512 3ce879a02a7a7c08b0bb892a210596e83c9a37bab90752977353dcd6e18e1688d0e643ee26f8dbb3eba2d4462ea9b46d0cc00b4b7a0dc47456ab765fe63b1f3c
TLSH
T1A9415BF7C3D8997D8A0196F8AB152F1FCD6E0A68521D3C27C8D4AE1F53E2972D20064E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 192fee5c24b2d1a46f203d06d6f46fa475f45ebdcecc886e9c4c26db68a7c581
MD5 7c422e438fff7e8090cea3485548ac91
SHA1 d9bfbdb7b59adc75936f38ca0576b08ce47b69a1
SHA512 aef5fa4c9d2bfd4290410712a36ad1c15e722ebae1f3eb513f6c1c491956be55aaff3069bc2d4ec26e5276accc84460568071228100431d8e42c317ff122a909
TLSH
T13D21CEEBE17FF0AB103D48AB2E44BC061977B8310AD268F4CE56826DE0C54E31B16826
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a56b88c7e51b12b276c7d103b05563a5f699ad5868ca870a2d4e3cd01fe56a23
MD5 0a91fcdd1154abbc8d988fa0da4151b9
SHA1 84fde1ba7190dc4268e3e6583bc3abbe8a216f92
SHA512 92e454b8e421f0cee55c22ea2966761cf065b3fb8627c134ea31b1f945d28387e671311cfa2a97835a77d100f6375cee2fa266f85e6a559b6f22f8efcf6218ec
SSDEEP 192:bR5lomxv7xbvAPRp2T9GHsb+WNn6sPi8U+DaMldVyIsnAUge:bR5lxhN6XMgw5PLU+aure
TLSH
T1B532B62EAE20783B6CDBC319FA667753D7F9106171942E84DAFC892C15D76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e7770357de8d99c902a719499397b463506a260eda98f158bd87c76a133c1d29
MD5 57d1d0896f585ac9662d5ab40ccd0405
SHA1 7a79aa582f00b6124f050f0927ab7f8bb2b53c5b
SHA512 6fe6ec419840a5ac132b9db5319067e981c476c3c8c4f6c9aca7d82804ba4cd46e841047bd1def0505414965a59723be0683e624f68cdfddbabd2887c0804990
SSDEEP 192:bR5lojEv7xbvGPRp8PZQU9GHsb+WN0Rk6sNtLeP8U+DaMtdVyIsnAUgE:bR5lMgNwXugwrjekU+aerE
TLSH
T1D852A72ABD20797B6CDBC229F925BB53D7F9206161D02E84DBFC892C11E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8c4ae0c18049b88569d128e336e316da42cdb4d365685f6c784799774d0a7dad
MD5 2178fe5522fba21bbcde6d641b3bc2dd
SHA1 1092c0fa061ee17d5cd088ab2381ae1599ffdfc6
SHA512 03b087cb7ac25691a9fcd9b31b2db904bb44b7344812332a0707b588a43bc876b1b4c6c54005f36ae88773418189051a4815305ac52e9e1f3fffe964b32965d9
SSDEEP 192:bR5lojZv7xbvGPRp8lZQC9GHsb+WNOQ2rnW7aL6sNtLeP8U+DaMbdVyIsnAUgE:bR5lM5NwXagwNg99jekU+aSrE
TLSH
T10352C82AA920297B5CEBC369F925BB57D7F9206161D02E84EBFC891C10E77CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ec8154b86ec750ba74deb462b35b49a4d7557db26763ef54d9cbfd334f3b8112
MD5 25e72a891f17f91db3a266f8e29ef108
SHA1 eaed1f3e274f147a034d31062a16dfdee7d6481c
SHA512 3e85445f4daeb2da6b84ee25e984d66068e834788414be8cccc69d72e64c0c99613664fdb3dfa214ee2fb615a522edd47af13126d12839eec49b1d4231c67fa4
SSDEEP 192:bR51ojyv7xbvGPRp8laQC9GHsb+WNOQ2rnW7az+L6skJaOtLek8U+DaMbdVyIsnv:bR51MeNwXlgwNg9K9TgeZU+aSrE
TLSH
T1F862B86BA920297B5CEBC369F925BB57D7F9206165D02E84EBFC8A1C10E77CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 816a6dba07cd04807f0ea166fcff9070ca46e783f4697b65c38dc640dcd51115
MD5 1a7de3674af7eefef65a36eb2fc01d0b
SHA1 71b27f9abf2ba62c0efd801f654d7ebf9eea7482
SHA512 0821e88142a144c4a1945e54f573dce3d67dda7847f202d4d1bc5e2584a77342d696864ad6e12a245d0f7d25b2ec6b0256eb42994ac28b10e725241753312228
SSDEEP 192:bR5lojGv7xbvGPRp8laQC9GHsb+WNOQ2rnW7az+L6skJaOtLek8U+DaMbdVyIsnv:bR5lMyNwXlgwNg9K9TgeZU+aSrE
TLSH
T13862B82AA920297B5CEBC369F925BB57D7F9206161D02E84EBFC891C10D77CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 14fb891f3370300c89cc9ea04c4554ceb9f1d33acd47c23601a961570975637f
MD5 77f3ea2d3e6bbaa07b8637d34763d4e2
SHA1 5f87ce4e139f8cb42062e37a74bfac4db6789c40
SHA512 ea25d29bd2489250a831f12edc966ba48b19acaf9443b1c9e9903979f6846de2680103964676c49649f189637bdeec9c3f99965ecd6bc9c9b86817e336c8185f
SSDEEP 192:bR5lomLv7xbvAPRp2eY9GHsb+WNn6sNbx2N8U+DaMtdVyIsnAUgE:bR5lxzN6XOgw5T2OU+aerE
TLSH
T1CE42A52EAD24793B6CDBC219FA267753D7F9106171902E84DBFC892C15E76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 813fdcf36e6a589398899d0120e6a5a8c49593c974394c398ab3b3c001cd9763
MD5 faa920e355b62c85f52f9a235ecb42d5
SHA1 a3bfc6e8d1f8dd900c0058622b3eb84b269a7195
SHA512 3db0845b5142132b4c40aa2a8486f431b162db89c8809ac45b105f1e293eb496efc21bae0393ff37e5bc5eea8ff4052e2db311c6061e12cfbd3d2759ad28acf9
SSDEEP 192:ezs4K6hN7KxkXqK4I40pUZNCgVLHrKHfFKslEGbFXzKD/CN+ErUkKN9QgJiMna1q:2sjaN7KxkXqKf/pUZNCgVLH2HfgslHFe
TLSH
T1FC32D867A48D9A3F0FE8D50DDC16AB8BACB4025672780C2457FB9D0803A57CE115E5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\a7fa4e0a-cd2f-49a6-b483-007997e1d534\17
Size 10.0MB
SHA256 e5b844cc57f57094ea4585e235f36c78c1cd222262bb89d53c94dcb4d6b3e55d
MD5 f1c9645dbc14efddc7d8a322685f26eb
SHA1 8c206a1a87599f532ce68675536f0b1546900d7a
SHA512 868d3a190f2723758d1a64498a4ac1f14b0297e16e731a0eec3a446b775c65cb8428ab33140cee13ef51e7bb3764b5ff1900cfb342a3dbf3fcc41dd6cdd9fcea
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 400e824e8e5ecfc80f1403bd47b02275e834083ed70461f6ed36e293ad44e02f
MD5 9f743924bad2414621b9dc2a921cbe0e
SHA1 2b8e94bc71133754e16e6af0c7a3ac0ed514dd27
SHA512 bd80933f04e4836da04418e801a7878fea393361933557e2695663b2512f18ceaa02ec2c6b5f473f01db286123907560b4cea6b7e16ff3c5f795ba59d3520b66
SSDEEP 96:yC0d+CVgOeTnnGBfYZSl3/QSl8h4otop5piD3B6BGyvhyYMUGsakO0AGXrf+iaSQ:yC0JeGnmiU2+xNaMUGsLWiaSFUV
TLSH
T1D2C12D71B4ADB8B35DF7AA99F5022A43CDE421A7DA529E50EED80F0C01DB0EC1343527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c8e959ae957a5658a4e943626c7bd8801de7f8788c06d5fa65a02d713f075b9a
MD5 73099581617c5c60ee7c31bb3e4ecea1
SHA1 ba5fb40ff43aec8889b7f65ea49331409844b2c0
SHA512 b01c553d1b9c3cd0cd33ed4d701e6d9c46365cd3107d16a082ad6aaecf58581c1d5f4b830848d957e6bc078a571efb744d56f426fc763b26abba8092dda902a6
SSDEEP 96:ybJ0d+CVgOeTnnGBfYZSl3/QSl8h4otok5plD3B6MGtvhyYm8f+zaSJRNC39ISM5:yt0JeGnmiUDnxw5tWzaSJu8xzue
TLSH
T1C5C10AB1E46EACA74CF6B989B1022D43C8E911AB9A217E58FDD98F0C01E70DD5383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 35029227aa62e9703a08bc90640f2bf87cfa5d476ac6dd120fa6fec748301b73
MD5 bb7b45994aef16fe3ab74d62ef701e88
SHA1 f9571663be1c001b55502777e8cc62857412959a
SHA512 1087fa81785cef4586248ceb7fb12da32f571066aa529b836d4a696efff3ba89bc0a6a5e4bcf5ec8527f8357742991e2e57fff09b7d77399331d2dc5ae63b54e
SSDEEP 96:ybJ0d+CVgOeTnnGBfYZSl3/QSl8h4otop5piD3B6BGyvhyYMUGsakO0AGXrf+iap:yt0JeGnmiU2+xNaMUGsLWiaSFUV
TLSH
T177C13D71B4ADB8B35DF7AA99F5022A43CDE421ABDA529E50EEE84F0C01DB4DC1342527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3e768cd3f83e9a01d8c596e79b60cfe402f6e527cc25c49e8984958446cfe328
MD5 4be20f1f47ff5affd72261b4a4690590
SHA1 8227ca85e6d7f9acc54ada6a4020af955f3de6fd
SHA512 da06329ceb82f221ace796cdc19e84dc2f6d06c4dcbf7b9cb9a8ef026392554e2f81cf3c109b961aed7c55abe0cc5af228ffe19f16ad2403c3840366644eced7
SSDEEP 96:ybJ0d+CVgOeTnnGBfYZSl3/QSl8h4otop5p3D3B6MGtvhyYm8f+caSJRNC39ISyy:yt0JeGnmiU2dxw5tWcaSJuCyWk
TLSH
T16AC12AB1E05EACA74DF6B98AB1032D43C8A921AB9A257E58FDD94F0C01E70DD5383537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 48ad9bc38102218ba5ed5e2166d5953446a03e4269431270916c84d5f5539149
MD5 9e55c286aa18d0216676b11594b7b95b
SHA1 3710a2aef984dbfc65593a564daaa095f424f0d0
SHA512 c8f38c4664e3c88d3058be03253f1ca9a43555c37d311208ae63d87dc0a2daffd0152ab9f2316a22b8945d1268f9583a52d9efc24ea78fca46015d54eb9686d7
SSDEEP 96:SC0d+CVgOeTnnGBfYZSK3/jKRDotok5pcD3B6gGyvhyLfOLSEbZP9v4a:SC0JeGnpDUDsxE1mLSEbj
TLSH
T1BAA11C71B06D99B344B69989F9526B43CDA521ABDA31AE44EDCD5F0C02FB0EC0342537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 30a9b0070c16fc250feeea123a26a4aa415789067fa5ed3055ba0834ba4c7b64
MD5 d9dbcf7ea903d4f751fd7eb42897e9f0
SHA1 c9c70f7c9b10485d78c8544717a65a4e977d4324
SHA512 ce19066c37997d540694c6447033e19faf572352b97e015f1d2759739e67fdbb64d0d4918de33060af7756e6ae8975794a3545358be0f0df1d15248f1e2ffc33
SSDEEP 96:ybJ0d+CVgOeTnnGBfYZSl3/QSl8h4otop5pAD3B6LGovhyYMUGsakO0AGXrf+baK:yt0JeGnmiU2sx70MUGsLWbaSJuCyWZ
TLSH
T1D7D13971A46EACA74CF6B989B1032D43CCA421ABAA12BE54FDE84F0C01EB4DD5343537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7146eeaee2e91dd3ae28eff0c41f61490283d27160d71727a7ad9bd429dc8075
MD5 a4cfc8ca54f480089980a9a924e2dd9d
SHA1 62d1c1812c3a170367461574454915a920c3cfd2
SHA512 8260d3d31c28f5278a5388c8b2998078b624e3235a965eb9ef2963d253cb930943c8fc3a2f5cf45735822aad64969a9bc4575409b11074f4de8218548fe1286b
TLSH
T1CC317437F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B80E255A92F699DE60550
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 25927fd4f0f1d5b5692e2fbc9ab2fc42c50ba6736622e291f23a443bd9c06b83
MD5 9184431ffb75673d86fa685690ef1fa1
SHA1 c06ad587915a5e86c5da30b25642fa3993650827
SHA512 48f5b0210302751f4ad383ffb95c560a241a93e7c15efe34a776e9c5f15109dfa3d43f3e7276bad349808fec3ba96a1ec0238c7e15cf61071ebdae9d81f73811
TLSH
T1AB219833F3DC8614CC99403A10DDAC1036B6C7CB40DECF9B6B85E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ec614a7c5ac7ec1982022267339782fc997db0fd9d1bac671aebdd9cf31da260
MD5 50303ad6a922c8b90d880184eae365dc
SHA1 508c4c1512283b476f9b261bea8ef1ebe3757dbc
SHA512 ffe213c1041b6591da5e32916145c7a950a8086c5aba31003d05ea12c7190edd3c595a84fb3a9e3b4bdfb445b4e13fc4316c2d61672c640b345c19e82926279b
TLSH
T197219833F3DC8224DC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 616a5f0ae7f26ba24b505902798ba7993f9f5543c8f3dfb81be80ecbcaef4ec6
MD5 9c8151f48eda1b86ce03be72915b3a75
SHA1 b6a7b7d3eb3e63cc1116d848e1985e7337afa996
SHA512 42d9d5d8752032e6064561529e01c73cab1ade4d5ad6f86b6deee9fefae55a734f741437b75920a270033828f2d68850180af88379f246e3c4d0caaf1a28e7c4
TLSH
T1BF219833F3DC8624CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F299DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_owzkhzxy.uy4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_owzkhzxy.uy4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0wthYgrUL.rvl

Path C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\0wthYgrUL.rvl
Size 1KB
SHA256 0127adc9d09070f46e5a368ce75aa4cd5675a0fa79b3d1e3d416e600a34d52be
MD5 8953b8192c985616ef4e8c916fbc5a2e
SHA1 4f7cab338a05172741c1d2cb52d4b869bf1d7c23
SHA512 ce592de399b2eaa5b719bdd91f1c84ade7f13725cabe7c721240f3a064f30e9fbebc4e0cfa560481ecc9c7d8cd1ae798982078d7cb339fd27c76795fb0d4d430
TLSH
T19C31DB8771110849C0E1B2BB67B08333175DA2C33884F4BC71C8DDAC749F16FA6952E8
MD5 SHA1 SHA512 TLSH

Submit Download

Compile.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\Compile.targets
Size 163KB
SHA256 16b1d439165bb65ba1f355789ec79b25befc6af66b0581faa26d32f0127fd727
MD5 529fde83792d48b6e7cbdf91e4f5482a
SHA1 4eb0b1f98baec76aadbcd6f41bc21cbde1159bdc
SHA512 87e0f4a05708c548c01744b78f4793912070c307197c12db371a43d50b2f9af336ca378cd81f5369e8e12155a7103bb5c4c953230ff078dca5d95201c68b9a3c
SSDEEP 1536:VNHlm+gf0d/6x7ng+TqCrhCpzvnJabbCxJJ7wO6WcAZK/Wvfpm1JY07njETGfvJw:7l7dpCtUhvNcq
TLSH
T1D2F341B8968B94F8F6AFC52162ECBD55017232C7CBC36D98939CE4008BE5B963F4644D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NuGetFrameworks.Shared.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\NuGetFrameworks.Shared.props
Size 8KB
SHA256 a13ee51177501ff5db0d4a6138c6982aba14c84739481d4670c32130af91ac97
MD5 d161e57ae95aa09a3a1d175c4acd1f3a
SHA1 d7d5a36e6cd7c28e367a457530c505c57051eee4
SHA512 33bb36b64baff03c5fe0d4e1391be7bf97a4fdb8b2ee76e5e4ade9d1b5bbd48aad1e36ecddbb2af230b87ad525911b9976293e42fd645f538554a6c5663258d1
SSDEEP 192:ohJ4BExtFL7bHCfdi85PWLaa7MxU78D8X4hg1NmoYFV21L86W:Q4BERLFRZ7yU7fV1rq6W
TLSH
T14B02FFE094AF34A4F15B99C067ECB96441767187DBCB308833EEE2164FBC7676A1540D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NuGetFrameworks.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\NuGetFrameworks.csproj
Size 19.3MB
SHA256 5a934e5c50e8a4ea652b0dbcbd74601fb859b5c2c30b1e5896fc3b7ffd41c7a6
MD5 5a3b5b62911a54410b9daf0e77ecc1e5
SHA1 1951a1acd8f0d93c2c4c60d920c5f9fe630ed11d
SHA512 c112a8f3914db950c12ca473fc53ce993950aee9dbab444b0612c3633979eec70a7d52afe0bc7c0e2527203ec548c1d23e92c4e56075b3802d8dc7414d365945
SSDEEP 12288:GGlidUjE8PgkBDHeCxYVoZawplWSEqzMAM/39qNzkEfYs/V/HLKtMas2Cet6VZzW:GGQUg85lKfS10bMDboXw1Cr
TLSH
T15F179C5203964BEDF2C80EC9C4AE101615F9A56A7D282688BFF37DE76C2FDC09074667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NuGetFrameworks.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\NuGetFrameworks.csproj.user
Size 109KB
SHA256 d2aa81a3cd5df8693149a447bc84c5101f340289a4e166d43f7a06443df5809d
MD5 46b8ff6000017311d4c6f566791500d6
SHA1 77a609026c2776d0f188688f671a30e583eaf8d4
SHA512 8afdda5553f34bafda7fd9887db5c9e4e28cd10b8b03abc13a887af383ec320be3c1479e86295075893962038bd4aa7d54b486a18c88115a871e0850e9a996f1
SSDEEP 1536:trXWCE9sm9Fy60lII3O9QDUtktjImMY7pLDcxtuofl/OzfCzXgoNW8AtJp:dIwcxts6RMJp
TLSH
T114B39EB098EE30B5E35B99415A98FE14067631C7DBCF382C63AFD1424FA9B672B1901D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NuGetFrameworks.csproj:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-32792-fJv5GBduQ4r1\NuGetFrameworks.csproj:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

persistent.1788633062.tmp

Path C:\Users\Admin\Downloads\Pokémon_Legends_Z-A_NSP_—_Download_Archive_win64_8246\data\saves\persistent.1788633062.tmp
Size 1KB
SHA256 58e3e2d3da284ed68002ec09cc847374f211cb8070dbde9b83aa6fc4cda69406
MD5 e2c0f7a13ed97c5b637ef4a0d35a8859
SHA1 34712d4d7706f9a4bb1b5e50d96f601bdba2be56
SHA512 150c0e8ff5bbc52d1b24a37d38317c6b0750d01700cba583d105fd2e270f679b901750a38384f162ec119513c432c7793d3c556572f424caba38eb80eb723eb1
TLSH
T1C1310ACAD23A1923D3318B6DCCA986AC541AC2C9641F30B91B25A8CDD00939EC5F239F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1488-874-0x0000028352ED0000-0x0000028352F82000-memory.dmp

Download

memory/1488-879-0x0000028352BF0000-0x0000028352BFA000-memory.dmp

Download

memory/1488-889-0x00000283530E0000-0x0000028353104000-memory.dmp

Download

memory/1488-888-0x00000283530E0000-0x000002835310A000-memory.dmp

Download

memory/1488-873-0x0000028352C70000-0x0000028352C8E000-memory.dmp

Download

memory/1488-868-0x0000028352C00000-0x0000028352C22000-memory.dmp

Download

memory/3232-953-0x0000000002A30000-0x0000000002A60000-memory.dmp

Download

memory/3232-951-0x0000000002950000-0x000000000296A000-memory.dmp

Download

memory/3232-973-0x0000000007B70000-0x0000000007B98000-memory.dmp

Download

memory/3232-952-0x0000000005110000-0x000000000526A000-memory.dmp

Download

memory/3232-950-0x0000000000430000-0x0000000000470000-memory.dmp

Download

memory/3448-884-0x0000026918810000-0x0000026918811000-memory.dmp

Download

memory/3448-883-0x0000026918810000-0x0000026918811000-memory.dmp

Download

memory/3448-938-0x00000269101B0000-0x0000026910249000-memory.dmp

Download

memory/3448-887-0x0000026918810000-0x0000026918811000-memory.dmp

Download

memory/3448-885-0x0000026918810000-0x0000026918811000-memory.dmp

Download

memory/3448-886-0x0000026918810000-0x0000026918811000-memory.dmp

Download

memory/3448-875-0x0000026918810000-0x0000026918811000-memory.dmp

Download

memory/3448-877-0x0000026918810000-0x0000026918811000-memory.dmp

Download

memory/3448-882-0x0000026918810000-0x0000026918811000-memory.dmp

Download

memory/3448-974-0x00000269101B0000-0x0000026910249000-memory.dmp

Download

memory/3448-975-0x00000269101B0000-0x0000026910249000-memory.dmp

Download