98f88ee9aa313b0807d996a69c961b5086718f15b111e5d7c566b242201cf000

Analysis

user interaction
yes
max time kernel
899s
max time network
899s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/09/2026, 19:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a18tzg.ps1
Size 174B
Sample260919-x66ppaxset
SHA256 98f88ee9aa313b0807d996a69c961b5086718f15b111e5d7c566b242201cf000
MD5 2812293d9c5da38769853e57ecdb3d70
SHA1 5079c47c4bad6c9154306fb04be73d3d7ee6eab1
SHA512 1a6e56b47faad077864255e326a79ab41c2b847341eecaa0bad4564d3ac1605c7922855d45b86898052f726ec277160c4cde8edd61c3dd81e0a2fa25e14a28f4
TLSH
T15CC08015035B5110D4D6B6A7383141438C6AD45C0E0D14F465546C1565537B59FD51D4
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4524	PowerShell.exe
3	4524	PowerShell.exe
3	4524	PowerShell.exe
21	3656	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3656	powershell.exe
4524	PowerShell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4288	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134343198848882391"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4524	PowerShell.exe
4524	PowerShell.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
3656	powershell.exe
3656	powershell.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	PowerShell.exe
Token: SeDebugPrivilege	2528	taskmgr.exe
Token: SeSystemProfilePrivilege	2528	taskmgr.exe
Token: SeCreateGlobalPrivilege	2528	taskmgr.exe
Token: 33	2528	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2528	taskmgr.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe
Token: SeCreatePagefilePrivilege	1352	chrome.exe
Token: SeShutdownPrivilege	1352	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe

Suspicious use of SendNotifyMessage 63 IoCs

pid	Process
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
2528	taskmgr.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe
1352	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2692	OpenWith.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 4336	1352	chrome.exe	91
PID 1352 wrote to memory of 2616	1352	chrome.exe	92
PID 1352 wrote to memory of 2616	1352	chrome.exe	92
PID 1352 wrote to memory of 4288	1352	chrome.exe	93
PID 1352 wrote to memory of 3428	1352	chrome.exe	94
PID 1352 wrote to memory of 3428	1352	chrome.exe	94
PID 1352 wrote to memory of 4524	1352	chrome.exe	96
PID 1352 wrote to memory of 3848	1352	chrome.exe	97
PID 1352 wrote to memory of 4524	1352	chrome.exe	96
PID 1352 wrote to memory of 3848	1352	chrome.exe	97
PID 1352 wrote to memory of 4900	1352	chrome.exe	98
PID 1352 wrote to memory of 4900	1352	chrome.exe	98
PID 1352 wrote to memory of 3772	1352	chrome.exe	100
PID 1352 wrote to memory of 3772	1352	chrome.exe	100
PID 1352 wrote to memory of 4308	1352	chrome.exe	101
PID 1352 wrote to memory of 3912	1352	chrome.exe	104
PID 1352 wrote to memory of 3912	1352	chrome.exe	104
PID 1352 wrote to memory of 656	1352	chrome.exe	105
PID 1352 wrote to memory of 5020	1352	chrome.exe	106
PID 1352 wrote to memory of 3724	1352	chrome.exe	107
PID 1352 wrote to memory of 2472	1352	chrome.exe	108
PID 1352 wrote to memory of 2472	1352	chrome.exe	108
PID 1352 wrote to memory of 936	1352	chrome.exe	109
PID 1352 wrote to memory of 936	1352	chrome.exe	109
PID 1352 wrote to memory of 1072	1352	chrome.exe	110
PID 1352 wrote to memory of 1072	1352	chrome.exe	110
PID 1352 wrote to memory of 4180	1352	chrome.exe	111
PID 1352 wrote to memory of 4180	1352	chrome.exe	111
PID 1352 wrote to memory of 3112	1352	chrome.exe	112
PID 1352 wrote to memory of 3112	1352	chrome.exe	112
PID 1352 wrote to memory of 3144	1352	chrome.exe	113
PID 1352 wrote to memory of 3144	1352	chrome.exe	113
PID 1352 wrote to memory of 4284	1352	chrome.exe	114
PID 1352 wrote to memory of 4284	1352	chrome.exe	114
PID 1352 wrote to memory of 1852	1352	chrome.exe	115
PID 1352 wrote to memory of 4604	1352	chrome.exe	116
PID 1352 wrote to memory of 4604	1352	chrome.exe	116
PID 1352 wrote to memory of 584	1352	chrome.exe	117
PID 1352 wrote to memory of 584	1352	chrome.exe	117
PID 1352 wrote to memory of 4248	1352	chrome.exe	120
PID 1352 wrote to memory of 4248	1352	chrome.exe	120

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a18tzg.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2528

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:432

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:4876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Desktop\a18tzg.ps1'"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9409fc728,0x7ff9409fc734,0x7ff9409fc740
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,1250264424258395435,16016295012568374858,262144 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,17410423984916407097,6395412773642455755,524288 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2296 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,338247306091187775,12531438172477930037,524288 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,2405129787953154349,5647493370457368420,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,12436473569377822439,15576832634541273060,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,5406941967575851322,8017308991429233066,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4308 /prefetch:9
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,2778523533917135500,2753468325388520618,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,15154484799110871277,2577831783106516453,524288 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5812,i,16165754619755301889,2121243841635934909,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,224680250294774630,4986559543693947125,524288 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5932 /prefetch:14
  2⤵
  PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,15486553618709994622,18052905977754342178,524288 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,14271026934573256861,6013215741885060047,524288 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4772,i,6455202330927025131,10802033172843470953,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3260,i,2543868132166635785,14305660152713778587,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5932,i,13560338608522595689,14123740000112217205,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3224,i,52235307760917767,4673969935006596837,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3372,i,14531367712743452714,13497629306546740231,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3508,i,6387224508923547296,596706457649464446,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5896,i,11294496707322803827,16171481017093016586,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3276,i,4596411463877390090,14791996229781244592,262144 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3372 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,16815736958558703102,9952474447440665941,524288 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4664 /prefetch:14
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3348,i,98423557946081102,11425293315057369599,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1528 /prefetch:1
  2⤵
  PID:584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6024,i,401307917190632726,14811782748111440916,2097152 --field-trial-handle=1960,i,15579625890354747920,14471565500246491185,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 07b5c351ae6000564b7c1669302752395f53e37f9b6c2c601596849414b0f8a2
MD5 ebfb3affc6e09613a36d7cdb030d51c8
SHA1 e4b68a6d9c3f9d0b71e22a49441cb4c59efff3aa
SHA512 094590ae1569287d95412824f1e53c46b7cfa2d899a776b4026277f8f9fcd763f219f51030dd4ee511d6c48a6d8acb084283fee5d35b52152aee50f7bd6cebf3
TLSH
T180F0F4AAD831AC3718FD1B2820944B86FB50136B2690898F7A3C920C8FB463B8685C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a2029a1e9fa27ab517f501941714c54c7b6db6be7e65defd13475bfbea7cb5eb
MD5 93cb8471f7583ab353aea3fe2419c37b
SHA1 ac3c8e952168a3e1c58ecb99d1183cbbb1d3a06e
SHA512 ef82d1f90146f76dc1737712a900642a303093f502c2ee479ec595eb82f9a7ef895a729fbde963b2c19b7bf29a580d44c3cd60f7e7d298e3d0b2b5af65f0645d
TLSH
T1FC618DF793E4866D851196F4DA256E2FDD390A24132C3CA6C8D4AE5F53E2472D20078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7c3f2a35517594da545f8a667e7dfa8d6a93d9689c6b409d9c5294cc2ba54dac
MD5 f9cd9a3483a9601b3a755e466e3445bd
SHA1 138055956d136632ad283df4a5ef888364a8f2e2
SHA512 86c9d066d9c1f0197e6a3b48f6ffa13e57a28c75f90588d6f226c0d42e476021fa9c2b9daba4aca0cc7848e17d6c201052254baa1bfb8807346d2773c9b62c72
TLSH
T193718BB3C7D8866DC91156F49B257E1ECD2D0A28522C3C56C8D9AE5F53E28B2E20174E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a3ec99281c1fa1863f545f42ee113757e0a2f20278a0b48c8f77f7406e92ac99
MD5 91f444000e734f9c349daaf1ca0cf5c8
SHA1 effab821fa955efabb55a52a5898811477d06a9d
SHA512 b7641df00b509b73474016e0e344c36f75892daac1ae5c38adf19f16ee42819ff00b9e34e818ab97f40a272175ce6ded7bfa1fd61a006c3a5b93375e4e2fa1ca
TLSH
T1C061AFF793E4866DC50196F4D7256E1FDD390A24132C3CA6C8D4AE5F53E2472D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c74e8d628a49142be66da218d9332ac72cb46a426f947774f7806bb847cc6400
MD5 9f6b1c39cd4154920e64569cce126991
SHA1 0c508e34ba3916b3d57742b8548485e38f33620d
SHA512 d85140515d371747822747d901a3eeab023ba18d9874ee0419ba1e00409594cdd3e729afeda8e1f29a09ab5020aaa9c24a3346bfeae477458ce0a0142bc2fa7a
TLSH
T1F4618AB3C7D8966DC51153F49A257E1FCD2E0A18122C3C56C8D9AE5F53E28B2E21075E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8ca021d861a3f0111558e91a5e99aeeb1472589780bbacb00fc22e3e2e769ec0
MD5 862ff3570b5515d357f994119edbf7a9
SHA1 750979e94f6c550dc05127821fa562a253e0a7c5
SHA512 59a52a18a29d1ac00ebf834f9edf17db6a6baaf4237c7925a0ad8d05cb5c9e4a1984f3dde3bf711ea747caea9a3eb21d9b81c25405b7f76c5e45274e4d69811d
TLSH
T14B719BB3C3D8866E851156F49B257E2ECD2E0A18122C3C56C8D9AE5F53E28B2E20074E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 98e34a9010205829711ba9f9370586e2994cac1deccee76afca36f581eaa5404
MD5 80b2980d1eb5e2b07da5d9384754fe36
SHA1 694a8e33f10ed76ca3aa44da4e959c41ffb1bd51
SHA512 774af945e7b3069c0977439dca5d04716f5e678d9fa8d2e3b781d03d195ab085a88bb83c2df61715b85044d8cecbea54a4c7b21d1af2dc8166e32b28b20e1295
TLSH
T1B1F059B7F67975A750BD45A61E0ABC096576E83442616CF0DF5A822DD0C05F38B02443
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 75dfeaeb0b54fa2f410ed473eeb7b702964d936a6bf63421268f7531c722aef8
MD5 5d453f618341b21c6f2816f7fa0a22eb
SHA1 aafba56f268887a33a015ad3a3cf9a10c94027f1
SHA512 59d5a936eb705cb33479ed825b1c15967a9f7844a8f2bbb10e981d1484d5d0caf32ed0242b1ca74bb28fd2cfbe283d65df2eafe37262fcc8f949e60a16681cfa
SSDEEP 192:vRpgyGV0NLtv7ZYepAPRp2o9zHsb+WNnR20CCkUZkwqVyIsnAUgtaJ:vRpgxYNdhUXDZw80MSK8
TLSH
T15C42D62DBD64753B4CDBD22AE9557B47D3F5102560882E88EAFC8D3C24E75CC222B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 20e847669be168e985f996ecf31cc5ed9d606d73317e27444f8e6ef31292498c
MD5 f6fb7fcb767ef3b9294c09bcaf3dd6a7
SHA1 d8cec657a126c65c100fec42ed70af00cd1d5b7d
SHA512 cc0def43db59e4207ea2d5cd6d7faf18b89a95a05c9e4dd5bee0280d69f3ce75ca08cbbd49f48b1dc2496ba4f1b0b60de9ba66e5bf972503a86796d95161a7fb
SSDEEP 192:vRpgyGV0Nmuv7ZYepAPRp2o9zHFNb+WNnR20WCkUZkwHVyIsnAUgraJ:vRpgxVKdhUXDZx80gSBe
TLSH
T13442E62DBD64753B5CDBD22AE9557B17D3F5202560842E84EAFC8D3C24E75CC222B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 655257baf551241552af6f29364d3734c4b29ef60ffedba4bedf6bdb3c02b6ec
MD5 97011b615591c04200a6ed4e38f437f2
SHA1 ceb92fe007fd620159ccee6ff9e9e1bff28701dc
SHA512 9bc3f49ff03cf607eec8745c8b3d537a4ef2d0b665e0075eac52d60b9b5b124999487c43197e830f14d34eb0c0613730541a477bc68179264daac05d1f3e7ff8
SSDEEP 192:vRpgyGV0Nm2v7ZYepAPRp2o9zHFNb+WNnR20CCkUZkwqVyIsnAUgtaJ:vRpgxVCdhUXDZx80MSK8
TLSH
T18542C62DBD64B53B4CDBD22AE9557B57D3F5102560882E84EAFC8D3C24E75CC222B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f61adbf3445e87aca1610a870b519267fee40b960ca9bd713e58bb62dfc987c8
MD5 c319340c09c22c341355f6d4c0e718c7
SHA1 dbc9f56881b993fadb17fe04ca6921d19d937d6d
SHA512 6927073d1a770045990bee3ad8049de00e159e804bf497460c5f587442fd67aa16a47c817c65a2d8ed2ab0f18be550f2e714d6fbc8502c7ff94162e52bdc667c
SSDEEP 192:vRpgDGV0Nmjv7ZYeppPRpNNt9zHFmb+WNnR20iCkUZkwTVyIsnAUgraJ:vRpgGVbdhXXpZA80sSVe
TLSH
T1F152C42DBC64753B5CDBD22AE9557B57D3F5202560842E88EAFC8D3C24E75CC222B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fedcf9a75ba464a86e0a40bcfd239d0e2921ab052b03543af819ad86d5c8b3e8
MD5 dbd90ad6705b43149b4f7de3fd233fb6
SHA1 678eeb81320b1d143cd12e4748999cea8229a84c
SHA512 9c3439c5c77f6c4b6c9cc8341dd61741d4fe0d66118cc7a28eab0821d8e2bbb062b218caa2f05898cc4a4c4177b69a823367a4bb9d7f47766cbd83d12cdffad8
SSDEEP 192:vRpgyGV0Nmjv7ZYepAPRp2NX9zHFRb+WNnR20WCkUZkwHVyIsnAUgraJ:vRpgxVbdhUXOZN80gSBe
TLSH
T10942D62DBD64753B5CDBD22AE9557B17D3F5202560882E84EAFC8D3C24E75CC222B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4bfbe324691a23a534db53a22993451495e8f99857a002d285586cc0fc8ed7a5
MD5 d057b7c85bf32212a239f24a704aff82
SHA1 a42e5b02a5f2368064007d69b1a51f5d692b8da4
SHA512 6b8dffc50b71f5d7d42a1590b183c8bb0c01f98f894f6bbaef1ee3fc69d01aadef3e79c5706326ebda020c1bec9e5d800afb5f994457546546cfc2f47ed220be
SSDEEP 384:71j3W7KxkXqKf/pUZNCgVLH2HfgslsF7pLuLceSRcXOD3y+ErU339HG+X2tt7I:7l3W7KxkXqKf/pUZNCgVLH2HfgsGF7pN
TLSH
T17072F9677C48993B0FD4CACCDC267E4F9CB5014B65E9886493FA5C2903D5BCE114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 f6c6fbe181367e2f23cbfaecb084974bda4e3a69070d7e576c658093a3b71984
MD5 69d0fc3efd7dbd36026e959b883b78e1
SHA1 ae0d79e87b8ef6ad0875b99acf1e6d826cc74e0f
SHA512 ee5192513d8df6a1cf30873b1824047f48a5ee582bd0464ae72fd3dce7d5b9fc83f2adbbbcbccf5f41f933b427063f2a39c19067b59d4ebb62ffa3dc1c15979d
TLSH
T1B6B0120580413711C48103722250D0A432608F3CD212138551E00E118839260411B14C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ad979.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ad979.TMP
Size 96B
SHA256 ca001045f7a770a978b03c5f5bfa587591a655c12fbcf1d7b16c566bff8d08cd
MD5 8267aa5cea6626865bbe41e097dcbdd0
SHA1 c212d1b8e3df922eaf25e65477d75d78ba3f8507
SHA512 2e667348d5069d27466f0f32f7c6cf95470252244b6e856ee62bf2f2cc278165117a0fe6f4391fce5b08d1dce90eee92194f6d9eb490c24add1c03afe3425513
TLSH
T1C4B02200C0823B23C08203B02880F0CC30A0CF3ECA03222283E02B2AEE283F00020020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 6fe913782a8ac30628c7c4903a94be82e105d7c65bc02973be10dd12db429703
MD5 214efc21b0a235519c1b5021a40efc4b
SHA1 143730a8310c1f5238a953f88ba8ee68746d5ecd
SHA512 8aba765c7e57719c040b20b76afab6c631c6cae0264d795ea1b04fbb3440cf27342ec818eeda37ba59f359346e1c69b0dc8704dacc0d8e982578091e2462bb90
SSDEEP 6144:cvEhyHuhD8tzc4UlrThDxWhaj5mjie/JYFobM:B2GD8tQ4Ulvh/NmT/JYOQ
TLSH
T1EE4422737DBE65B3067CC48C404E7B8248F884B75744EBAB5608BF4B14DAAD8935B386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 18004f0e34896c3010a985e4af48a0087c55f1f46ffef28904ec2fc290c0e3c8
MD5 90ecf6a9fb9d27ca538803f1cbb3efab
SHA1 2bfb6e43fee676b66d74ee7b6b190b41c1fd3ea3
SHA512 7bd1f7755ada4a7303a4a6844ded274e7f9b5105d07cd652811d79beff8977fadfd585632fff6d137d231cb9fec049bef040a1a3faee034dba380be5fc200885
SSDEEP 6144:JEhyHuhD8tzc4UlrThDxWhaj5mjie/JYFobM:W2GD8tQ4Ulvh/NmT/JYOQ
TLSH
T1154423537EBE6673067CC18C505E678284F884B76784DBA74208BF4B14D6BD4935F386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 262KB
SHA256 620392e16bec9b3a70800f73e25d2ffe9ffc87879cfb6acc5a7a7721198a92ee
MD5 7b771ac271a879d2c5b715538a838ca2
SHA1 9d7ba388480fbda86cc858494bf8ca712972175c
SHA512 38e655f076fff7179933b80618a157e2f2b12e6bca60b65efb424d3671de52f6c5d2c96ac8657016ae93a545170968dc0fc34974389609704ab6cab63e041646
SSDEEP 6144:0EhyHuhD8tzc4UlrThDxWhaj5mjie/JYFobM:F2GD8tQ4Ulvh/NmT/JYOQ
TLSH
T1CF4423537EBE6673067CC18C505E678284F884B76784DBA74208BF4B14DABD8935F386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 2f01b0420c5931865f882870bb4ff3c03b5f1d6847c48c77c4a64425e322c57d
MD5 91119fecbdb6abc59cffb963069c2344
SHA1 39a9d1c96e32396f00129c8912e1705cd5aeb35f
SHA512 fd8f3cbd8d34bc9cb5367867499d21cf43c51dc27bf1f76a627df1af7584bd08ecdefec56b927c4fd7c426cf3d6906f4a27c66711c1b9522cecb5a022920ed2e
SSDEEP 6144:kvEhyHuhD8tzc4UlrThDxWhaj5mjie/JYFobM:52GD8tQ4Ulvh/NmT/JYOQ
TLSH
T1E54422737DBE65B3067CC48C404E7B8248F884B75744EBAB5608BF4B14DAAD8935B386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 3e7021cfdbd1bdf2fca087fb2a650af58d03778418137cc0e7bc56b08970cd39
MD5 158717d75be4c8d814070b1c7201efca
SHA1 e487e489afcf993f8c056f32d814e13c7c376219
SHA512 adaac8393eb46f3db65126fdf3aff49f53e9f0f8e7f139269964f9c3fc008c2f2408d787ce5718d61605dff595fed867d79ca6c728dc3feacc080ba4b86cd256
SSDEEP 3072:CT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:RThDxWhaj5mjie/JYFobV
TLSH
T135D312239CFE01FB14BCC50840797F0086E989B3D640FFA39ADC6A4FA1D7EA49356596
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
MD5 22e796539d05c5390c21787da1fb4c2b
SHA1 55320ebdedd3069b2aaf1a258462600d9ef53a58
SHA512 d9cc0cb22df56db72a71504bb3ebc36697e0a7a1d2869e0e0ab61349bda603298fe6c667737b79bf2235314fb49b883ba4c5f137d002e273e79391038ecf9c09
TLSH
T15061DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
MD5 aaed13863ab38600c24e5ed7f18f0a28
SHA1 9ca5a8ead7bc29f4af3c7b52ae55df020443370b
SHA512 3d3cc08572a2db6e30dd0501ce19595f920ff1cfdd4611680665bceae3aac8e7c228b593ba067c0fd53986115d4ca80340bb434d3dc91bf7ad3e773580e1a2f1
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5L
TLSH
T1B9538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 deba60a6fa8f70526752ad31bfb4e7ac59d3b4fac8179ae8dbf85bddbd09a4cb
MD5 9e99e5abd698dc2f39e35e9eefb06cc3
SHA1 dd5aa3af187323b722df3049e5dd8aca831ba40a
SHA512 cd0a4afb38577ac002a71cf42514b205ae5c5fe8fb00503fbbd94a8758296493b7a41aaf3294b199cf2d2813cd41f72b148182722ab6d4fbff49af1832819ba9
TLSH
T1A0215633B3ACC135C8D9117A208DAD11B1B5C3C7449ECEDB7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gtf1aip2.sfi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gtf1aip2.sfi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2528-20-0x0000023B94100000-0x0000023B94101000-memory.dmp

Download

memory/2528-15-0x0000023B94100000-0x0000023B94101000-memory.dmp

Download

memory/2528-16-0x0000023B94100000-0x0000023B94101000-memory.dmp

Download

memory/2528-14-0x0000023B94100000-0x0000023B94101000-memory.dmp

Download

memory/2528-21-0x0000023B94100000-0x0000023B94101000-memory.dmp

Download

memory/2528-26-0x0000023B94100000-0x0000023B94101000-memory.dmp

Download

memory/2528-25-0x0000023B94100000-0x0000023B94101000-memory.dmp

Download

memory/2528-24-0x0000023B94100000-0x0000023B94101000-memory.dmp

Download

memory/2528-22-0x0000023B94100000-0x0000023B94101000-memory.dmp

Download

memory/2528-23-0x0000023B94100000-0x0000023B94101000-memory.dmp

Download

memory/3656-86-0x0000015980000000-0x0000015980AC2000-memory.dmp

Download

memory/3656-47-0x0000015999280000-0x0000015999333000-memory.dmp

Download

memory/3656-48-0x00000159FF3F0000-0x00000159FF3FA000-memory.dmp

Download

memory/3656-46-0x0000015999260000-0x000001599927C000-memory.dmp

Download

memory/3656-49-0x00000159FF430000-0x00000159FF44C000-memory.dmp

Download

memory/3656-89-0x0000015980000000-0x0000015980AC2000-memory.dmp

Download

memory/3656-50-0x0000015980000000-0x0000015980AC2000-memory.dmp

Download

memory/4524-0-0x0000014FEFA50000-0x0000014FEFA60000-memory.dmp

Download

memory/4524-12-0x0000014FEFA50000-0x0000014FEFA60000-memory.dmp

Download

memory/4524-11-0x0000014FEFA50000-0x0000014FEFA60000-memory.dmp

Download

memory/4524-10-0x0000014FEFA50000-0x0000014FEFA60000-memory.dmp

Download

memory/4524-9-0x0000014FEFA50000-0x0000014FEFA60000-memory.dmp

Download

memory/4524-8-0x0000014FF1B70000-0x0000014FF1B92000-memory.dmp

Download

memory/4524-1-0x0000014FEFA50000-0x0000014FEFA60000-memory.dmp

Download