73a668f89d727015962a727cf2d3edc5a446b9da10718cba4dfec6525ed6bc20

Resubmissions

24/09/2026, 16:49

260924-vb2fdayzdx7

24/09/2026, 16:27

260924-tx2slaysfs10

Analysis

user interaction
yes
max time kernel
128s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
AP Biology - Macromolecules.pptx
Size 4.0MB
Sample260924-vb2fdayzdx
SHA256 73a668f89d727015962a727cf2d3edc5a446b9da10718cba4dfec6525ed6bc20
MD5 23d801a803599a3b3a0174158ca0ad68
SHA1 d7077da034c60e91e6349e4e4b69b42db3715a23
SHA512 63b45aa234d211d424489faddb65af5d4cfd954e4b2c8e6a8edc70746009ecce8c90b7591f78db6229b2b77cf32b170a0ec046af092a7955e2db650f37eeff32
SSDEEP 98304:lku3YMCUqv64jzZILKC3o0NEjBoz2K8bmpLPJ6GjvL:lku3RhqS+ILb3o0NE9knPJtvL
TLSH
T19E163349BCCED97DCEB6E1B85C04CE2B3CC052160E5B846A1BDCD8CA016DD9E1297BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4312	GameBarPresenceWriter.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
182	raw.githubusercontent.com
183	raw.githubusercontent.com
210	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoldenEye.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3448	chrome.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347422118460244"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3888	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3888	POWERPNT.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3888	POWERPNT.EXE
3888	POWERPNT.EXE
3888	POWERPNT.EXE
3888	POWERPNT.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4916	5004	chrome.exe	102
PID 5004 wrote to memory of 3448	5004	chrome.exe	103
PID 5004 wrote to memory of 3320	5004	chrome.exe	104
PID 5004 wrote to memory of 3320	5004	chrome.exe	104
PID 5004 wrote to memory of 1492	5004	chrome.exe	105
PID 5004 wrote to memory of 1492	5004	chrome.exe	105
PID 5004 wrote to memory of 2432	5004	chrome.exe	106
PID 5004 wrote to memory of 4064	5004	chrome.exe	107
PID 5004 wrote to memory of 2432	5004	chrome.exe	106
PID 5004 wrote to memory of 4064	5004	chrome.exe	107
PID 5004 wrote to memory of 1960	5004	chrome.exe	109
PID 5004 wrote to memory of 1960	5004	chrome.exe	109
PID 5004 wrote to memory of 2676	5004	chrome.exe	111
PID 5004 wrote to memory of 2676	5004	chrome.exe	111
PID 5004 wrote to memory of 1000	5004	chrome.exe	112
PID 5004 wrote to memory of 5536	5004	chrome.exe	115
PID 5004 wrote to memory of 5536	5004	chrome.exe	115
PID 5004 wrote to memory of 5284	5004	chrome.exe	119
PID 5004 wrote to memory of 5344	5004	chrome.exe	120
PID 5004 wrote to memory of 5504	5004	chrome.exe	121
PID 5004 wrote to memory of 5524	5004	chrome.exe	122
PID 5004 wrote to memory of 5524	5004	chrome.exe	122
PID 5004 wrote to memory of 5528	5004	chrome.exe	123
PID 5004 wrote to memory of 5528	5004	chrome.exe	123
PID 5004 wrote to memory of 5676	5004	chrome.exe	126
PID 5648 wrote to memory of 4312	5648	GoldenEye.exe	130

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\AP Biology - Macromolecules.pptx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff911d6c728,0x7ff911d6c734,0x7ff911d6c740
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1832,i,3075590989349064216,11200799138454000239,524288 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,6128537701409388904,3336717014145586659,262144 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,11873270645063272091,5259228493830444110,524288 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,14401132993538272301,15933846073576343057,2097152 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,2525004566450087238,9018435769890291061,2097152 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,11029503654554273979,6064304866316599136,2097152 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,5478690325240703894,12397284949181580723,2097152 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,14646174572670247075,15845128181701711792,524288 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5540,i,3079612224835452803,16386791203319597627,2097152 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3420,i,17226138182563705544,9090724940395973250,524288 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,17369685921183368741,2511646743701923265,524288 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,7613070576548815452,55378310321793630,524288 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3512,i,9404567293313568187,5181815576839963581,2097152 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3424,i,5763188478104605117,18025543355972583491,2097152 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,17808759959775818599,2113804530269093018,524288 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3412,i,1268767141832262383,15408182700460013127,262144 --field-trial-handle=2020,i,8581799145563071241,10403228212546754876,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:3628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3720

C:\Users\Admin\Downloads\goldeneye\GoldenEye.exe
"C:\Users\Admin\Downloads\goldeneye\GoldenEye.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Users\Admin\AppData\Roaming\{c738acf7-5e24-4d2a-849b-39b689c84d43}\GameBarPresenceWriter.exe
  "C:\Users\Admin\AppData\Roaming\{c738acf7-5e24-4d2a-849b-39b689c84d43}\GameBarPresenceWriter.exe"
  2⤵
  - Executes dropped EXE
  PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5615f2e4-411a-40ea-81cd-4fd35b6ca342.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5615f2e4-411a-40ea-81cd-4fd35b6ca342.tmp
Size 649B
SHA256 038450925a8a73c7e7e98ce5f226c28d79af6588bb3d0259c69cbd4ca87e4f2d
MD5 532fd920d1032021f759d07152444de8
SHA1 559204e4126777832fb872480da0cddc4e3237d6
SHA512 33633e245ac2f2d5f10e32286fa2cef753820f4985895c7dbaad7e6655befb0c5ef4228bb2fa5fc17fcd69ebf0ace8339518d172cfebc089c4aefe3378fd5598
TLSH
T1DFF0F4B5CD21EC3719FD172924955B8BEB5023272B80944F3B3D820D8FB163B468681C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2425da2cfcb40715f251da3877d9d09b193432eb0af8b65f681210aaba4beebf
MD5 32c42c489979bf257e4d0bf63a486f28
SHA1 900cfeb3c5aaabcda34d6ade116987a6a276601d
SHA512 fbcf87f9e0a12ee256ac38a57022aee9703d04e8f200d274545bd3fef5470500cd162abe82f3dab01d7a91ad44112fabb8b7944ee6f84d7d57a7ba7b989585a6
TLSH
T162614F61D5809D1BEF2B783922D115287472D5CD4E032F06189BDFF507BE7E2C48A448
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 03fa693c58e3eab2d39e6e0d956bf93817557aa81742dc01d5f0001af5df89c3
MD5 a20c0b8466f8a6aaefaba0bfc10059fb
SHA1 46a01283cdd1b1cb5f7df4458240aea29344a5f2
SHA512 974b11f2bacbe50051b517f769d80cfb01f14129b80840b1b9adbc0d802cb0d9000c6f69ea7beb0b551b11e89ce597471527d0fedf2cf38b560e702490550214
SSDEEP 192:DagfR4GCWGtmn/9YM+VF5WTwnfnuNPhyRaP6fP9vaNmammmXmDmtmgme:DagfR4GCWGtmn/9YM+VF5WTwnfnuNp63
TLSH
T118028EF7C3E8862DC91156F4A715AF1ECE290A28432C3C66C8D8AF5B93E2871D25574F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2a84cd4248ff55aa29ce0e04bc53ef4706f3853bce3a547bdc444849e9c2efa7
MD5 321180c687bdc50bea61b720dda7c1f5
SHA1 6efb99627cffff6a6b9c9b059bcc5bf60beb322a
SHA512 711f049462c3a6f7c0732aabd0a5e18cbe6c81108af21a28e27f062c32616b5ab4b5eb4dba22104d4120a08eb02d642ca9fa09c7174cf85ca4a964713de56a9b
SSDEEP 192:DRFcBzuZewyWQv7TpuPRpnKdzS+9WHsb+WNpJ7ITvErevc2OZx0IMIEkwnVyIsnB:DRFmzunMviXgUwAUJ2lvIEhe
TLSH
T1FE52B52EED107A7B4CDBD22AFA56BB17E3F5102160942E84E6FC8A3D15D79CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f41cdd396e3adf44e1566570bc1be16834a6ac4786f236a0644447472d3f9e1b
MD5 69f121e60369089f1a833878406fef9b
SHA1 f1ae9079ed1247efc78cd5ec22d9f3ae4269932b
SHA512 5c9cf4b12bf73b4870cbfa1a8f0326517495ff285dbe4c05a703091caade097e8c282f2caaf1e7a6478f72ded5d9468b1c3276bcf65f9df7e2664a9800566fdc
SSDEEP 192:DRZGZewyPQv7TpAPRp2V9WHsb+WNn7IT0kqZx0IMIEkwvVyIsnAUgtaJ:DRZGCMvUX6Uwg0QvIEp8
TLSH
T14742A43DEE14753B5CDBD22AEA66BB53E3F5102170A42E84EAF8893C15D79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5727e2d646a1e9689a32779f93490d4e346994b1a2be27c781f2f425b5925c91
MD5 1f4d3d379560e045eb990c1663735bc5
SHA1 13e4dde7abdf78163b65e6a6eb72f3a14412ba44
SHA512 c28003897b3597ee4018d4fb12d2485270e72bb121faf51257c90780502f6b9b98336fe003f3126cb8379465ca4fe554b319f96f5a3a475b1225bcb726121236
SSDEEP 192:DRFcBzGZewyWQv7TpAPRp2KdzS+9WHsb+WNpJ7IT4vc2rZx0IMIEkwDVyIsnAUge:DRFmzGnMvUXJUwAr2YvIEFe
TLSH
T1DE52C52EED10793B5CDBD22AFA52BB17E3F5102160942E84EAFC8A3D15D79CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b545fab5142b578715c981c8ab842a8e6a1c030ece2904bb0b498a3488b6b982
MD5 c42c135fa913c0eb2d304ddb4658a5dd
SHA1 fe0bf3eb8ba38b73c820a303d53038a6efed945c
SHA512 5e36e8bef9eaa95b7cbeaca3bd91aef0767ce8abefa716a5996222e34f0ed0de107d09ab210b8188d1acf47407dfa2a632dc0dd4cff9fa296bade28196bff1eb
SSDEEP 192:DRZGZewyWQv7TpAPRp2WiN9WHsb+WNn7IT4vc2OZx0IMIEkwvVyIsnAUgtaJ:DRZGnMvUXOUwgr2lvIEp8
TLSH
T1B042B43EEE14B53B5CDBD22AEA56BB17E3F5002560A42E84EAFC893D14D79CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 523761bc1813672aed3255e4becb28be826b1abc952b1618d2bcfadebfe5e21c
MD5 472d61bcf21443a047dac261aad552e8
SHA1 608e068876727f4f676b88d75ee81c5361cbab00
SHA512 c732c8cc57effcc49d70faf34528b26e9138b9a4c90bc7197c1b7efc3bd7d6aa9914d2b1dd802f59451918a42148b21a62cf31325f4ca0e95e28d8b96bbf35b5
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5S7pLuLceSZkXOD/q+ErU3v7HGISxpQ8:TN/O7KxkXqKf/pUZNCgVLH2HfgsvS7pC
TLSH
T11472F867BC489A3B0F94C6CCD8167B4FEDB9024B65E9886446FB983503D4ADF11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 714491fa87d1c21b3446d8160d1dafccbf28bffc0e21a730308ed54bad2fb10d
MD5 7a8707e5bfd866c046c1fd4206bdc51e
SHA1 93167a8f62e9e83a099ad4f3c8b1ff4a3f5e8b7c
SHA512 d274099aca9c4ea92f498cec5a4a9b298d7040a26fd90cadd88374c27d18a04aff65f2b2247fed75bde829c409b1fd279c3fc9411138ebff90e3da487e89d279
TLSH
T195B0128480415702C40202F42291749879E5EF15BE05234142F00D518835150901B058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594750.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594750.TMP
Size 96B
SHA256 daa0d369a41a9e07c1740085db320047e4c19bfb036cf93a57367e3020de2068
MD5 f933b9ecd25efad842d7616b6bf9ba0d
SHA1 c0696150a044781efaf3aa74a816fbcfa1ac1ca2
SHA512 e5dd167d83ea4308069361df770a9ad621305531bfcd070eabefa1cfb6018fcc5798387281e3c405030c50227288d86e41e23b3b8e28754de414df8df2bc6003
TLSH
T1FCB00255C1026313C4C203B069D5A5D87161EF29C603125A92E41AB6DC2AA64467DD64
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 ad370bd1c2c51e09f9ed80a3c5b0b2ef51bdc1a4daeb98c9d8533843c1d0d12d
MD5 81b679d5f36aa77261d2027c9ad1ee5b
SHA1 23ede90d7da743814eba0ba687af3a01a137bc7c
SHA512 f9ec46ecc82c1d2e473da9defba41dfe389d5ba81c12c4fd41e9a2f5e4efa1e119c2a50f3688395488c360e7f0f1b55a0a5cabb6a7cdfcfca17defa56ca5a3ce
TLSH
T19EA002D1C7C05201C4101271DBD22DD1B3127B6403A30FCA40E440C5A990953D101240
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 380KB
SHA256 8623778dd1d7cae5a2a5aebee66a4fc8e7ada79189f0f1f175bc1419b9dad648
MD5 450d6ff6ee86efae2e2e00079a28dce6
SHA1 5b9132c72567d0b4152b6cd4dbc5563239b224e0
SHA512 2a885a3b72262e8061b2698848165d83d1a7d3bd48c5229871b3934da5070f72fd5098aeb505184cfa00e0dcb4a214681d4ea67e7b7dc8082a79f1147a9fbd77
SSDEEP 6144:7Tf/CMU//9W1f7ZjYnnlAU+CpgqM6uD2ar+hFD+7t56OD9ZfSAppr2:7sFW1tjYnlSmM6u1yFSXD9ZfS4c
TLSH
T1B28423AA6E007CF74CFDA212E2469B105EB56EDA418C1E8955DFD98E901F9CC0F72B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 bdcfc94e5f5834480050d56dda602e151f3bd4274a2756c067d4ec8eff1b95e9
MD5 57e036d4e492712d07adcbe29b10b62c
SHA1 2f63ae245047a77fc3e633f8cac17bca22cd3c7a
SHA512 f3f05576ba93d74ae053c43b3b8dcdd1a83ed1e7769baf7e181e9f16ad9dae5263b11ffed6ddbf9163bd0e07eec3707498289d4b1b7508a7326304bf2ac52cc5
SSDEEP 6144:rnlAU+CpgqM6uD2ar+hFD+7t56OD9ZfSAppr2:LlSmM6u1yFSXD9ZfS4c
TLSH
T19C4422565E416CAB4CBD7202B256EB405EB69CEC82ED2A44408EDD9FD15FDCC0B73A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 a6b6d87a8c04d40ff1d146dfedd95c711bbeb8f641a9336e357e7df9feeb5d51
MD5 21a5ad3f3f92f286078fa9e09233d0f3
SHA1 5523579f97407628232a50e5ce0cadfe1b87359f
SHA512 bfb8195b4aa6dad4ccc981303ae0177e9af91d6ce0b9ebbb5683cf0d3346fab34d44d4da4e07ea4f4da961674622d744e22d25d8401ad685e13b9f7e3e79da69
SSDEEP 3072:D+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:D+hFD+7t56OD9ZfSApprU
TLSH
T173D31232AA91D8BBC9FD5541B257A300DD666CED41DE3A09444A5F8EE09FC4D07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 263KB
SHA256 14dc89872a2ad927ee66c0c28a94eb26a6e3eacaf3ceae33a32f89853c5bae13
MD5 1b5b8b538b4045a42143a6399bd010e4
SHA1 0c53364af238946938abed8aa091b4a079de0e2d
SHA512 8e7a8d489a360f79cf00f05c861aa9993070e0d75c14f6323246f88b1496edf0feddec050e19e1e632462d81ef11f94b47e760e861b7322ec0ec3c89ab8ae7ba
SSDEEP 6144:qnlAU+CpgqM6uD2ar+hFD+7t56OD9ZfSAppr2:qlSmM6u1yFSXD9ZfS4c
TLSH
T12F4422565E416CAB4CBD7202B256EB405EB69CEC82ED2A44408EDD9FD15FDCC0B73A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameBarPresenceWriter.exe

Path C:\Users\Admin\AppData\Roaming\{c738acf7-5e24-4d2a-849b-39b689c84d43}\GameBarPresenceWriter.exe
Size 254KB
SHA256 389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97
MD5 e3b7d39be5e821b59636d0fe7c2944cc
SHA1 00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88
SHA512 8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5
SSDEEP 3072:iTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3I4YgTl:i6nrD0ZMcPBAL7c0fTHs+2sYXg
TLSH
T122448B0D7990E92EC4B222719A38E7D2FD3B79314F24919FB7C4695DACE08C19938B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goldeneye.zip

Path C:\Users\Admin\Downloads\goldeneye.zip
Size 323KB
SHA256 24e74afd2f0d567fb433a84af7065770ba4f75825bf071dc5862eee78009bdd1
MD5 fc9a825f9d890c48a1680ba6edb404b6
SHA1 187ad9c4164e57674f770b05a22d62a12eb86c6f
SHA512 2b7f1b102ebc42eb5524a1e689254ed31540c53f2e268e8506315aacf1ec103eecd36d7c3462011bd424ce664f348f2ae1c52345d071942c68bfa8cd62f7ab79
SSDEEP 6144:w7Tu21ldM1vm+M64qM0gcjcTY3BmzRlHvVI82njmRgAZR6hFd:wfc4qDgdTJnvVIjmRgAEX
TLSH
T1086423DF1C8D777BC4530970267B908225EA25629FA962AE0CE45FB0C8473FAD234B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3888-9-0x00007FF93E310000-0x00007FF93E505000-memory.dmp

Download

memory/3888-6-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp

Download

memory/3888-10-0x00007FF93E310000-0x00007FF93E505000-memory.dmp

Download

memory/3888-8-0x00007FF93E310000-0x00007FF93E505000-memory.dmp

Download

memory/3888-0-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp

Download

memory/3888-1-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp

Download

memory/3888-11-0x00007FF8FC060000-0x00007FF8FC070000-memory.dmp

Download

memory/3888-13-0x00007FF93E310000-0x00007FF93E505000-memory.dmp

Download

memory/3888-7-0x00007FF93E310000-0x00007FF93E505000-memory.dmp

Download

memory/3888-4-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp

Download

memory/3888-5-0x00007FF93E310000-0x00007FF93E505000-memory.dmp

Download

memory/3888-28-0x00007FF93E310000-0x00007FF93E505000-memory.dmp

Download

memory/3888-2-0x00007FF8FE390000-0x00007FF8FE3A0000-memory.dmp

Download

memory/3888-14-0x00007FF8FC060000-0x00007FF8FC070000-memory.dmp

Download

memory/3888-3-0x00007FF93E3AD000-0x00007FF93E3AE000-memory.dmp

Download

memory/3888-12-0x00007FF93E310000-0x00007FF93E505000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads