c8508863854b90f7bfd4e7312f593ff54337df117f388e03677722b1237b7883

Analysis

user interaction
yes
max time kernel
1048s
max time network
463s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gemini-code-1790366020925.vbs
Size 1KB
Sample260925-ymgf5avhpf
SHA256 c8508863854b90f7bfd4e7312f593ff54337df117f388e03677722b1237b7883
MD5 ec419388fbd23b66d88d08bb193aedca
SHA1 056589328ae0175e295f2c524bd1dff1e72935d7
SHA512 5e7ffcaec9a5dd16d4457f59021a55d82381c4c7776e4cc546445c25aa085aa743d8a7dcce31f08572b26c99fbc93965333063d9bd3b6bea3ab385fa57c5acae
TLSH
T19E31CCAA79D19DD32D8BC07158BEB58172B555D30640CC327526BCFE52103F46BEF682
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
244	4040	mshta.exe
246	4040	mshta.exe
248	4040	mshta.exe
250	4040	mshta.exe
252	4040	mshta.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3984	WScript.exe
1648	wscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1504	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mshta.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mshta.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5724	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe
Token: SeShutdownPrivilege	2380	chrome.exe
Token: SeCreatePagefilePrivilege	2380	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
1908	mshta.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe
2380	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1804	2380	chrome.exe	116
PID 2380 wrote to memory of 3280	2380	chrome.exe	117
PID 2380 wrote to memory of 3280	2380	chrome.exe	117
PID 2380 wrote to memory of 5724	2380	chrome.exe	118
PID 2380 wrote to memory of 3836	2380	chrome.exe	119
PID 2380 wrote to memory of 3836	2380	chrome.exe	119
PID 2380 wrote to memory of 5364	2380	chrome.exe	121
PID 2380 wrote to memory of 5504	2380	chrome.exe	122
PID 2380 wrote to memory of 5364	2380	chrome.exe	121
PID 2380 wrote to memory of 5504	2380	chrome.exe	122
PID 2380 wrote to memory of 1188	2380	chrome.exe	123
PID 2380 wrote to memory of 1188	2380	chrome.exe	123
PID 2380 wrote to memory of 5412	2380	chrome.exe	125
PID 2380 wrote to memory of 5412	2380	chrome.exe	125
PID 2380 wrote to memory of 3240	2380	chrome.exe	126
PID 2380 wrote to memory of 3872	2380	chrome.exe	135
PID 2380 wrote to memory of 3016	2380	chrome.exe	136
PID 2380 wrote to memory of 1208	2380	chrome.exe	137
PID 2380 wrote to memory of 3156	2380	chrome.exe	139
PID 2380 wrote to memory of 3156	2380	chrome.exe	139
PID 2380 wrote to memory of 5148	2380	chrome.exe	140
PID 2380 wrote to memory of 5148	2380	chrome.exe	140
PID 2380 wrote to memory of 6124	2380	chrome.exe	141
PID 2380 wrote to memory of 6124	2380	chrome.exe	141
PID 2380 wrote to memory of 2768	2380	chrome.exe	142
PID 2380 wrote to memory of 2768	2380	chrome.exe	142
PID 2380 wrote to memory of 1520	2380	chrome.exe	143
PID 2380 wrote to memory of 1520	2380	chrome.exe	143
PID 2380 wrote to memory of 5672	2380	chrome.exe	144
PID 2380 wrote to memory of 5672	2380	chrome.exe	144
PID 2380 wrote to memory of 2448	2380	chrome.exe	145
PID 2380 wrote to memory of 4964	2380	chrome.exe	146
PID 2380 wrote to memory of 4964	2380	chrome.exe	146
PID 2380 wrote to memory of 6120	2380	chrome.exe	147
PID 2380 wrote to memory of 6120	2380	chrome.exe	147
PID 2380 wrote to memory of 2676	2380	chrome.exe	148
PID 2380 wrote to memory of 2676	2380	chrome.exe	148
PID 2380 wrote to memory of 5040	2380	chrome.exe	149
PID 2380 wrote to memory of 5040	2380	chrome.exe	149
PID 2380 wrote to memory of 1052	2380	chrome.exe	150
PID 2380 wrote to memory of 1052	2380	chrome.exe	150
PID 2380 wrote to memory of 5736	2380	chrome.exe	151
PID 2380 wrote to memory of 5736	2380	chrome.exe	151
PID 1504 wrote to memory of 1648	1504	cmd.exe	157
PID 1504 wrote to memory of 4040	1504	cmd.exe	158
PID 4040 wrote to memory of 1776	4040	mshta.exe	160
PID 4040 wrote to memory of 5892	4040	mshta.exe	161
PID 1776 wrote to memory of 468	1776	mshta.exe	162
PID 1776 wrote to memory of 3052	1776	mshta.exe	163
PID 3052 wrote to memory of 4640	3052	mshta.exe	164
PID 3052 wrote to memory of 5668	3052	mshta.exe	165
PID 5668 wrote to memory of 1912	5668	mshta.exe	166
PID 5668 wrote to memory of 3292	5668	mshta.exe	167
PID 4640 wrote to memory of 4720	4640	mshta.exe	168
PID 4640 wrote to memory of 2924	4640	mshta.exe	169
PID 3292 wrote to memory of 4320	3292	mshta.exe	170
PID 3292 wrote to memory of 1972	3292	mshta.exe	171
PID 1912 wrote to memory of 4692	1912	mshta.exe	172
PID 1912 wrote to memory of 6044	1912	mshta.exe	173
PID 4720 wrote to memory of 3056	4720	mshta.exe	174
PID 4720 wrote to memory of 2576	4720	mshta.exe	175
PID 4692 wrote to memory of 1908	4692	mshta.exe	176
PID 4692 wrote to memory of 2860	4692	mshta.exe	177
PID 1908 wrote to memory of 4484	1908	mshta.exe	185

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\gemini-code-1790366020925.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:3984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffea77c728,0x7fffea77c734,0x7fffea77c740
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,4623679673817964781,10706010377562245029,262144 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,9294886898138424917,17872942007570862444,524288 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,2893210347193017501,4345075622047616556,524288 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,13341753774733020226,1523100026075220484,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3448,i,18387963162297886006,12673581706582382082,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4520,i,14386554886941415670,17307338861265373791,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3936 /prefetch:2
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,9776363231886273017,5528401646283169213,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,6558423818166301874,9426893123377065723,524288 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,14490070445357343343,2365185894823933919,524288 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,3133034237394894899,18256600562794703623,524288 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,10975260882876797903,4379986815879939725,524288 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5836,i,11463452155579076920,942342822511043357,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4768,i,5368426540020442290,2015115954353685040,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,16273004852546418274,15234219921820926323,524288 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6048,i,14472378504885515107,6033564129734050457,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4752,i,14579905240557580226,9590421412642883614,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4860,i,7695136636736757234,2943147497153874955,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,17402560044560001491,4343326163421311768,524288 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6304,i,2289217907936927482,5530081415463140597,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6432,i,15469425301903680924,14133916896634859993,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6444,i,1790559246892623096,6334878822826765772,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6780,i,6365005892897357803,2051060757032550693,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6896,i,8367700970642435828,11728664673381420926,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7052,i,3484944203152300208,4607985499477890947,2097152 --field-trial-handle=1880,i,9618277987769570113,5359515063673115327,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:5736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5692

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\gemini-code-1790366020925.txt
1⤵
PID:3516

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\gemini-code-1790366020925.txt
1⤵
PID:980

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\gemini-code-1790366020925.txt
1⤵
PID:2792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\gemini-code-1790366020925.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\wscript.exe
  wscript "C:\Users\Admin\AppData\Local\Temp\edu_warn.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1648
- C:\Windows\system32\mshta.exe
  mshta.exe "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
  2⤵
  - Badlisted process makes network request
  - Checks computer location settings
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
      4⤵
      PID:468
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4640
      - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        6⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        7⤵
        
        PID:3056
        
        C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        7⤵
        
        PID:2576
      - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        6⤵
        
        PID:2924
    - - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:5668
      - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        6⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        7⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        8⤵
        Checks computer location settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        9⤵
        
        PID:4484
        
        C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        9⤵
        
        PID:5920
        
        C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        8⤵
        
        PID:2860
        
        C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        7⤵
        
        PID:6044
      - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        6⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        7⤵
        
        PID:4320
        
        C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
        7⤵
        
        PID:1972
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\hydra_image.hta"
    3⤵
    PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 0ecf3efd6c15486635e2342d59f0721fd5ac3257e3c79b41c8d144cc1036e0c8
MD5 997382a69770bbf2f0cc6a5c0e7a5c24
SHA1 1f35362eaf7a4fff03efadb6784c8da22b31987d
SHA512 a260d64c025fdb31ce7e7fa4bdf7612cbfcd2d5d6feb93046aba3d2d2f042f176484b477998cd9b6ff014069f3fbe41b68b6301fb36da325e12a05ab6205e3f9
TLSH
T108F0F4B9C921FC7B18FD5B2D20544B87EB5513673681845F3A3D820D8FB8A3B868A81C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 3a2fbcfac1a3b527cd22913350011cd3636c5b820859f284bfa0f6043d332246
MD5 de9ec8265a0f741af79c866d41acdebd
SHA1 73b20c5fd1a0b82709262c0d9cea9f91d22f6fd8
SHA512 b5ff8bcea2130d89295bce4dd04f25f932b0a689f071a05b69e966dbab97cc1618e75d041d0ae5d52b5065fdf2da74a51e810e4831ca041e939ec8ebad587363
TLSH
T1F941C88220F6985BFBC03AB94AC36310397B014E4C576F4EB09B3974E997790411CCDC
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 8cbda76e176987a2f8b5479b21858222494175528807b5b61108c229d0cdbbbc
MD5 26b3ee32d7ff0792514cc355ef7443c0
SHA1 620f206d7da0947d521bc9b80490aa4b2a4bfd82
SHA512 81d8d29168be7faf0b9f3656d400e48d604d0319b9444a7e3d497a39b0e680f0c3358cbb15d3712f7ab1f32129667449a7d0acca3e194190f06c7e64a277e784
SSDEEP 384:DsE2LhNYp+CNcBrSPnMPasE8YvLdnVRtT0Q5jkB3nrakuodJlSpDLgkBR2oBMtuP:zWW7
TLSH
T19F526CB787F49A6DCD2251F0AA162F5ECE6D0925531C7C26C9E4AF1B93E1471E300B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b4b00725d44b429534cb7578dda9311fead5e53879af92a01af30b720a009576
MD5 a040caf552ae5ea303ce2d3c9d576ef1
SHA1 d3697551c6e0d96e2faeba19a20f5c60983197b0
SHA512 9c2e0645e8afd45d7bb8764efac6e7591d28f8c1bc2b56f1e062cb33f8bc4f96229894d04d4b99396395109d38135840306c6ec146061a61120844568d7265b6
TLSH
T1FD619BB7C3D8866DC81156F59B217E2FCE290A18522C3C16C8D8EF4B53E28B2D31034E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 95e6ca2104f014014ccb4dd71819909df571e7daee9aec2153ca7da7a94e9855
MD5 85b733c8b297875c87baa0f1bafa2a98
SHA1 d8ec19fec767795817d736b671a2fa1b3d6cdf46
SHA512 1ec8e871e64647ca1fabc6977afd863e2121e99e3c0069d29af336826d182b7fe6b3646ec24881f7aadafa51512bde71ebfd8f5180bee4186677b5ad20323faf
SSDEEP 96:4UDUmUBUcAU2cU9UZieUYWnUmbdUHNUJUPcgUIUxUvUPSUZjUZUSkKUVU0UeUeUk:4UDUmUBUcAUnU9UnUYWnUKdUHNUJUBUn
TLSH
T19CA1AC97927EFC7B103F48AB1E697C0929F9A43D416278F8FE57826D60C14B3461347A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 43e2bc4a90d3aefacbae0dad8c3d1484ebe3467e8fd79f957047eb5159adc939
MD5 0f3d41d41a90e3a02c1c76907d054375
SHA1 1ffed42f5d28de511dd79448b2305d08c5ec01df
SHA512 824be7df7828c400648cdadc1dc1fb47afa0bf5b9ac27fcd00c4370e0577cc87c0d818c321ddbb20a8695ffef50044d39e115ef4eba0814d895f23af21be8c76
SSDEEP 192:ORNwNMKHEFv7GpAPRp2C96Hsb+WNnVK0raG2keI1VyIsnAUgraJ:ORNwNY1CUXtswM0t2Ge
TLSH
T1EE42952DBD10793B5CDBD329EA217BA7D7F5102621943E84EAF8893C15E76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5b4f53ea11d2d436aaaa70cf5c0ae2d2842c36fd645071398e0f06c9970c1f86
MD5 7a2c47cc8a1374fa77b5cfc57a495986
SHA1 16c49f309e13a46114fd023776484dde2cceedfe
SHA512 7c4dac7738406fb2be27c216394d0b6189f47b0dfa0b389347cc39c3913aadcf2fe6ea16f40971efea4c67f0c3b8d2d9faa8071138d44ac212b69c0d4b6a08be
SSDEEP 192:ORNwNMKH6Lv7GpePRpoC96Hsb+WNnVK0IaG2keIbVyIsnAUgraJ:ORNwNWzCaXPswM0M2Se
TLSH
T1DE42942DBD10793B5CDBD329E9217BA7D7F5202621942E84EAFC893C15E76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 599b34835f3a8c083c2fa58b0adb7c60aa9a4b499c1eb60f9dd74ac6e3fec46c
MD5 0907af921d5f9f2b7a9213218fe0769c
SHA1 6c75db0ce00ab3fe237988b94759e999b6c57b31
SHA512 c237e25f723fe019a87d9e06c7ec30c649931d2137ce2e096d230016e57518d95196cd6733413b834058c43ec31b2df588772a4487f2f84f77fdccb099c35777
SSDEEP 192:ORNwNMKHkLv7GpePRpoC96Hsb+WNnVK0IaG2keIbVyIsnAUgraJ:ORNwNYzCaXPswM0M2Se
TLSH
T19152852DBD10693B5CDBD329E9217BA7D7F5102621942E84EAFC893C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 101466e2acc1d2e2b1c20b95d8f2882bbb9bf87b995e5d0ce227f1cb586c3462
MD5 05c2d522be5a8b0087365804fd60a7d0
SHA1 d3b6dd51f1974b4727414fc5569681e20cf2c9cd
SHA512 a93c00ce9bdc5fd921d68a48cf6d67166523cf433f7d746a8dec1d75a16626010d0c533012e5e0c6b8d60a0787e5f5b28dcadaaf14b2db937985d1b737ac0f9b
SSDEEP 192:ORNwNMKHEgv7GpAPRp2C96Hsb+WNnVK0AaG2keItVyIsnAUgtaJ:ORNwNY8CUXtswM0E2i8
TLSH
T14942A52DBE10793B5CDBC329EA217BA7D7F5102621943E84EAF8893C15E75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 16a72cf49b91c279225651b63b9d94a579062846182f6ac7d17af93dc5bd73cd
MD5 61312d91ee0b02dfc0fc78c2452dc012
SHA1 be8adc82b3c82d7933794c2b284540b6c122fd03
SHA512 32bfbf344947109dfc7a30eac77002f42f000874add683873c9f5f18ffc20d1531008ab7be3fff2d982255081c1c34e05f4b66014fd4465d10fdf3b08364ba13
SSDEEP 192:ORNwNMKHjnv7GpePRpoz396Hsb+WNnVKUDI2uaG2keIbVyIsnAUgraJ:ORNwN/vCaXEswMH2S2Se
TLSH
T1D152942DBD10693B5CDBD329F9217BA7D3F5102621942E84EAFC8A3C15E76CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 01117086c93181f773f2603efc6585ce01af452ea265d554d0a2c129cee100a4
MD5 606549932ff169af389373b51a41ecc1
SHA1 c4a107a108878a3ef1ea7ed237db91c891104fb2
SHA512 451de365b45dce110c493d08fdea879ed89a97921d609d60acf2eaf5978a259c0dc0ac43d4705f40e996553fdd624a2213596484beee3f0da927720eb550a482
SSDEEP 192:ORN/9MKHjzv7GpePRpoz396Hsb+WNctVKUDI2naG2keIurPyIsnAUgraJ:ORN/9/LCaXEswbH2J2dfe
TLSH
T1E452A52EBD10697B5CDBD329F9517BA7D3F9102621902E84EAFC8A3C15E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b241b575133b4b5828d3ffbe8299765b9c8fa4ab8eeb7ff301fe7abee0d0c729
MD5 05e59065a4c2628195cc1c78ef105223
SHA1 fd54968c9706c4293dde48ba97f2204633141964
SHA512 5e38daeebf3632fa98865986c458090fc565a2aa7432a6fa4c598ad2e8e5321ad9256f974add71aaedd8bcdfe5020c5e589acfa8c0329e8fe89c6826ad3e15ee
TLSH
T1F1B0120594516305C0020370116090643A608F78D21213A551E00D07D835171812B119
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 40260f532148dd060e93be1ccd6d0bcbf36f050cfc15cd991512ea553d3d023b
MD5 1949f6c7850ad1f18cda4d92d4c01d36
SHA1 637fc9b14c43bb958d463c4aa3f4e04d8f513a4e
SHA512 df10507c0d96e7b5176718f29b0f30a5c5f28fa99902b66d547c7aa0a075b3cc7b43019a70a9173ae5fd10435391b5708c3023a3e78c8b08777d71461bc0c71a
TLSH
T1A7C01205C202A620F4110371163194EC73716FFCE651139CA6F01D5BBC37230C01B219
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5adbac.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5adbac.TMP
Size 96B
SHA256 491bb30efab8b1cf06153fc04aacb1909cb73c5a432400c63963d26e506f46a3
MD5 1a125c4711e4edee983402a6a6db1d96
SHA1 80278b506ded46b0ddde2877ba8ef3e9d95256b4
SHA512 b2f93b430616b517174f1dd0c240fea74311e2a923d52c51e1091ae9dbae84fa589fd0f15f17a0d2402c0809c42ec6334391b86a5be2271591b94cc3fa95b585
TLSH
T1F1B02208C022E302C00303B02A828AE83020EF38C2030202C2E00E22EC20BB0832B220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 b48e46ea287c7c93aa34dac6c229365a73caddbc29f12d40051eee189e419784
MD5 77f9e7db4b6854085500e33d3b10342e
SHA1 4a9b75719fc9f1b81d8c295ef96cde3c3079d5e5
SHA512 220d3c4242f54f1169b91241d83681d10eee5dea760ceab733b4dfbbb107853a03ad61a4fc8051b410479a62c332b4b0e13b595c8f235e71222952ea9f6c303f
SSDEEP 6144:lrtEVjEfT5CCL9A7taB1o3wxluaQpp310nST+hFD+7t56OD9ZfSApprc:cNEVLBARaBWeOh+STyFSXD9ZfS4G
TLSH
T1F5442272FD41FCA748BC15417147AA158EB6E8F984DE354D8852AECBE1BBD840B33836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 8f49a954128379e4dd73c1e280470dc095a56366ab89c90c3ab51100c2af8ab2
MD5 c22f98e1ce3bb62da10942088d5e0aab
SHA1 57a55b035f15f9d740dcf06aa51a763fb7ea154d
SHA512 6eba4edc71ba961a12cdbc689ef925c02c7c6e568d5e4ae81860261b8646d9c81a04c7e4ae33fbce05aa933eccdeff2172e789cd08ff20f5f4539d3c96950b97
SSDEEP 6144:lZtEVjEfT5CCL9A7taB1o3wxluaQpp310nST+hFD+7t56OD9ZfSApprc:aNEVLBARaBWeOh+STyFSXD9ZfS4G
TLSH
T1A2442262ED40FCA788BC14417147AA158EA6E8FC45DF354A4452AECBE5FBD850B3383B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 32d5398854f710aeb4f112b791611bbdc55128cb6201ec71a3291816408d2798
MD5 51a10e2c6215badb4772de633aa22422
SHA1 2f6f913282e6ff0e1df17449b04254c01c31c7ec
SHA512 1262776558ac2076ad26b5f7919657ea4ce4eb308ce19e7ed234f84e5dd58d174b533032c74f3c5374388375d814510a2298f1041af3b85563d26211be7574a5
SSDEEP 3072:UH+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UH+hFD+7t56OD9ZfSApprB
TLSH
T125D31232AA91D8BBC9BC6541B157A300CD76ACED45DE3A09444A5F8EE09FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 288KB
SHA256 71aece07b23363ecd9fa6c1a6a9e4dd7a0ffb65e31b57f09b13f759bc83c1972
MD5 c0239222bbb6fc8ef9b4fcef67d7cc75
SHA1 071ff639b014364fc874436e98fdd6d862b7398d
SHA512 6b2b56cfec3d22b478829ec6eeb37c754ffd8417ae5ed9c67e7a8c88b37aa9ac143578c054e6610e4859b55dfacadca62f9a34ef1c5288d83666c42d12030dd9
SSDEEP 6144:lSnf8VtEVjEfT5CCL9A7taB1o3wxluaQpp310nST+hFD+7t56OD9ZfSApprc:Qnf88NEVLBARaBWeOh+STyFSXD9ZfS4G
TLSH
T1EA542332ED51FC6788FD20407547A6148EF7E8B984CE384949525ECAE5AFE890F37836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 ac35220a737cd789131bf9094cc0b05d4fbca88eb9567c50422d5ab3e9409c8c
MD5 36383ec7a1c051dbc60961a126838fbf
SHA1 0c5977b0f776cab17304a550b8a5f484b67c0179
SHA512 27948eeef0dd8189c6964296b401e2507ff952d49d73a825eaba9a069270dc11f5c924a4159b37a4103112a2342ee3dbaa41840e9d2a86de5912fd046e422152
SSDEEP 6144:wZtEVjEfT5CCL9A7taB1o3wxluaQpp310nST+hFD+7t56OD9ZfSApprc:fNEVLBARaBWeOh+STyFSXD9ZfS4G
TLSH
T1F7442262ED40FCA788BC14417147AA158EA6E8F845DF354A4452AECBE5FBD850B3383B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b38c436877652d464993cb5dff4ee1b91edbe64c3ed94fea36081370dc43cd04
MD5 f16f7ca65bc5be6beba51454dade5ca9
SHA1 5df2b19f872b1bf58ea460007691a86783d7f96d
SHA512 c19265d52f517f14c80f85f8009701537e5b1c68a528bc6e24b54bf2eb0f0f8feb9016e7e0821fff62ea18ca62e887d94359f15fa030df0e3537fc150f147dd2
SSDEEP 3:MsEllllkEthXllkl2zE7KX:/M/xT02zAK
TLSH
T16D440444FFD0CC05CDC13030C011C3544371D4140511D747345104175CC7DC41C40010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Screenshot-2026-09-25-at-10-50-58-PM[1].png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FB6DDX4X\Screenshot-2026-09-25-at-10-50-58-PM[1].png
Size 465KB
SHA256 6402a5359ad2997d18a7236a0cf413c3fb2df129163ea8f4b2b2680b5394c082
MD5 736f1650a6af6ddbc20c15843dd18109
SHA1 5d1f34dd0845d8706b434ca73e224aa9966ee5e6
SHA512 df0494544f5ce7c850148c4822b236800fb9e1a292ef723170f25f150e8a2dbdf5bb46e0a1cbbb892bd8913d7de73ecddbe733eca8e8a7f9f8e1d0d7dbd3fa3f
SSDEEP 12288:FwQTRsLmN+brDfXqohS4+TgJiL2YDWl4Nhra0y:SQ0TrfHSfjDWl0ra0y
TLSH
T12CA423DA7F1C25F6C6C7A59F5F0A990268EC1C2D678AD0FA3796CE292C50128C863334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edu_warn.vbs

Path C:\Users\Admin\AppData\Local\Temp\edu_warn.vbs
Size 236B
SHA256 4dad63c0fd486a570d10afb19e8b6978fe16f628ff11458bd03cd48a717758f6
MD5 0782aedc9e2499e291243ea4d449eae6
SHA1 134d1f8b073fe324c27a32477ddb1ed80bd8b824
SHA512 1d1d8819b8d1a9d22d1658bd940a738be759aa84a65a8d3a8d3983e2ee5903ed232d63a5cf846742cffd2cd642d4955ba65e130af822ebb82de36acf245506ab
TLSH
T1E3D097CADFC2F6002E8B00C304A86D0406EC8B267B9208320420FC48170BA2C9EE3FA3
MD5 SHA1 SHA512 TLSH

Submit Download

hydra_image.hta

Path C:\Users\Admin\AppData\Local\Temp\hydra_image.hta
Size 766B
SHA256 3450f0490afff9918e77aeaa6858070be30be5cceaa9112b298e496331bbb8a4
MD5 4c108b82435ac3779916ce3d6ac37b22
SHA1 646cd9cd629b749463ef6a1e6bc76ccbd9db3315
SHA512 1cfbd94d7a4bc915edaf470b22b073824d0f473416daf4af2fcd22201f5203987e5790d0931355e5b427ce9cd6b34b166b313d728d53abbdd69455797083c420
TLSH
T13E01206310FBCE0EB923A052A4F7C68CD8F127130640AF1077289C5DAAE0416DB832C7
MD5 SHA1 SHA512 TLSH

Submit Download

gemini-code-1790366020925.txt

Path C:\Users\Admin\Downloads\gemini-code-1790366020925.txt
Size 1KB
SHA256 c8508863854b90f7bfd4e7312f593ff54337df117f388e03677722b1237b7883
MD5 ec419388fbd23b66d88d08bb193aedca
SHA1 056589328ae0175e295f2c524bd1dff1e72935d7
SHA512 5e7ffcaec9a5dd16d4457f59021a55d82381c4c7776e4cc546445c25aa085aa743d8a7dcce31f08572b26c99fbc93965333063d9bd3b6bea3ab385fa57c5acae
TLSH
T19E31CCAA79D19DD32D8BC07158BEB58172B555D30640CC327526BCFE52103F46BEF682
MD5 SHA1 SHA512 TLSH

Submit Download