6da94c2511b7a1b434ff973e27ff85c0079b3e639b9f8d0d706e8c5a68ef8dc3

Analysis

user interaction
yes
max time kernel
337s
max time network
339s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
№ 7093 від 22 вересня 2026 р.zip
Size 2KB
Sample260930-m5vwpade72
SHA256 6da94c2511b7a1b434ff973e27ff85c0079b3e639b9f8d0d706e8c5a68ef8dc3
MD5 07250a365e9721364ef45bcc44438292
SHA1 8612e0ccbe3170987a9b4154f12514fbd4b925ff
SHA512 5916b8bbc88c84ddaaf02cf0f5abac0a97678d0ef422a1524ada72de728e32ef8db52311dd68a109454d6691cecb6d381a82497518d3518337714761a2177b9a
TLSH
T182514D893246AF29D417FB72533963C7ECE6384D40DAF7869946BD118CF92481F01CA9
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 64 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
55	508	powershell.exe
63	508	powershell.exe
64	508	powershell.exe
65	508	powershell.exe
68	508	powershell.exe
69	508	powershell.exe
70	508	powershell.exe
71	508	powershell.exe
72	508	powershell.exe
73	508	powershell.exe
74	508	powershell.exe
75	508	powershell.exe
76	508	powershell.exe
77	3532	powershell.exe
78	508	powershell.exe
79	3532	powershell.exe
80	508	powershell.exe
81	508	powershell.exe
82	3532	powershell.exe
83	3532	powershell.exe
84	508	powershell.exe
85	3532	powershell.exe
86	508	powershell.exe
87	508	powershell.exe
88	3532	powershell.exe
89	3532	powershell.exe
90	508	powershell.exe
91	3532	powershell.exe
92	508	powershell.exe
93	508	powershell.exe
94	3532	powershell.exe
95	3532	powershell.exe
96	508	powershell.exe
97	3532	powershell.exe
98	508	powershell.exe
99	508	powershell.exe
100	3532	powershell.exe
101	3532	powershell.exe
102	508	powershell.exe
103	3532	powershell.exe
104	508	powershell.exe
105	508	powershell.exe
106	3532	powershell.exe
107	3532	powershell.exe
108	508	powershell.exe
109	3532	powershell.exe
110	508	powershell.exe
111	3532	powershell.exe
112	508	powershell.exe
113	3532	powershell.exe
114	508	powershell.exe
115	3532	powershell.exe
116	508	powershell.exe
117	3532	powershell.exe
118	508	powershell.exe
119	3532	powershell.exe
120	508	powershell.exe
121	3532	powershell.exe
131	508	powershell.exe
147	508	powershell.exe
148	3532	powershell.exe
151	3532	powershell.exe
160	508	powershell.exe
161	3532	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
508	powershell.exe
3532	powershell.exe
1664	powershell.exe
1964	powershell.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2888	cmd.exe
3092	cmd.exe
2140	cmd.exe
5112	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2892	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zG.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{1B0923F6-ED6C-493F-975D-F541521F1404}	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe
508	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5068	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	508	powershell.exe
Token: SeBackupPrivilege	1308	svchost.exe
Token: SeRestorePrivilege	1308	svchost.exe
Token: SeSecurityPrivilege	1308	svchost.exe
Token: SeTakeOwnershipPrivilege	1308	svchost.exe
Token: 35	1308	svchost.exe
Token: SeRestorePrivilege	5068	7zFM.exe
Token: 35	5068	7zFM.exe
Token: SeSecurityPrivilege	5068	7zFM.exe
Token: SeSecurityPrivilege	5068	7zFM.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeRestorePrivilege	1076	7zG.exe
Token: 35	1076	7zG.exe
Token: SeSecurityPrivilege	1076	7zG.exe
Token: SeSecurityPrivilege	1076	7zG.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
5068	7zFM.exe
5068	7zFM.exe
5068	7zFM.exe
1076	7zG.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 4116	2888	cmd.exe	110
PID 2888 wrote to memory of 508	2888	cmd.exe	111
PID 5068 wrote to memory of 3092	5068	7zFM.exe	117
PID 3092 wrote to memory of 1792	3092	cmd.exe	119
PID 3092 wrote to memory of 3532	3092	cmd.exe	120
PID 460 wrote to memory of 956	460	chrome.exe	127
PID 460 wrote to memory of 2892	460	chrome.exe	128
PID 460 wrote to memory of 3924	460	chrome.exe	129
PID 460 wrote to memory of 3924	460	chrome.exe	129
PID 460 wrote to memory of 4828	460	chrome.exe	130
PID 460 wrote to memory of 4828	460	chrome.exe	130
PID 460 wrote to memory of 4796	460	chrome.exe	131
PID 460 wrote to memory of 2556	460	chrome.exe	132
PID 460 wrote to memory of 4796	460	chrome.exe	131
PID 460 wrote to memory of 2556	460	chrome.exe	132
PID 460 wrote to memory of 1480	460	chrome.exe	135
PID 460 wrote to memory of 1480	460	chrome.exe	135
PID 460 wrote to memory of 5108	460	chrome.exe	136
PID 460 wrote to memory of 3660	460	chrome.exe	139
PID 460 wrote to memory of 3660	460	chrome.exe	139
PID 460 wrote to memory of 2416	460	chrome.exe	140
PID 460 wrote to memory of 2416	460	chrome.exe	140
PID 460 wrote to memory of 2432	460	chrome.exe	142
PID 460 wrote to memory of 1420	460	chrome.exe	141
PID 460 wrote to memory of 2432	460	chrome.exe	142
PID 460 wrote to memory of 536	460	chrome.exe	143
PID 460 wrote to memory of 2136	460	chrome.exe	144
PID 460 wrote to memory of 5004	460	chrome.exe	145
PID 2140 wrote to memory of 2824	2140	cmd.exe	148
PID 2140 wrote to memory of 1664	2140	cmd.exe	149
PID 460 wrote to memory of 1728	460	chrome.exe	151
PID 5112 wrote to memory of 4888	5112	cmd.exe	154
PID 5112 wrote to memory of 1964	5112	cmd.exe	155

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\№ 7093 від 22 вересня 2026 р.zip"
1⤵
PID:4008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_№ 7093 від 22 вересня 2026 р.zip\№ 7093 від 22 вересня 2026 р..bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo %Integrate% "
  2⤵
  PID:4116
- C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\№ 7093 від 22 вересня 2026 р.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zOCC38640A\№ 7093 від 22 вересня 2026 р..bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo %Integrate% "
    3⤵
    PID:1792
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3532

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\№ 7093 від 22 вересня 2026 р\" -ad -an -ai#7zMap13472:136:7zEvent32710
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1076

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\№ 7093 від 22 вересня 2026 р\№ 7093 від 22 вересня 2026 р..bat
1⤵
PID:4076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd40adc728,0x7ffd40adc734,0x7ffd40adc740
  2⤵
  PID:956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,380870449487196886,3423725148009307357,524288 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1828 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,11925967028130838101,16898257126044171564,262144 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,6973684399681042066,18026310746625942323,524288 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,16269703474936849515,14411672232981962607,2097152 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,16655893808423609407,11465032947169584726,2097152 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4544,i,8948982376292260587,11129292758121181198,2097152 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,1145434058307440794,11763406987445295168,524288 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5608,i,6048672711942295879,17528122083064222611,2097152 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4672,i,15007996378278474319,17654820819175858020,2097152 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,14858410259656327626,150323452116609049,524288 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,17239925293006883174,11596420306001093547,524288 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,2902063191112573000,11127201608444941784,524288 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3436,i,7803992008442023828,7793351396221275779,524288 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=2664,i,1231580343997524053,10980321603110310909,524288 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3420,i,5300027206130786226,3942387551259569615,262144 --field-trial-handle=2004,i,9708960675477328840,11660132499921700894,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:1728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\№ 7093 від 22 вересня 2026 р\№ 7093 від 22 вересня 2026 р..bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo %Integrate% "
  2⤵
  PID:2824
- C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:1664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\№ 7093 від 22 вересня 2026 р\№ 7093 від 22 вересня 2026 р..bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo %Integrate% "
  2⤵
  PID:4888
- C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 589bbca432b7fc653c4c3a0c6ecf4c2b32dc5c06ca3441f34fbe912ee5840432
MD5 ca469bed71d9676f453b49a66feb2873
SHA1 94e8a808e1513c5a5d99cd298393e9756d4e097b
SHA512 1fbda1445c96cfcaade1f67aa7142c8dd75f9d612e458b335f0572455d9f95083699a0002530f2a4b3ade43f85dcf8739930926188335702aa1c315bfa53cc7a
TLSH
T12BF028A5C925EC7718FD0B9920A84B47F75113673781884F3A3C820C8FB153BC69991C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 b7583034b112ce25ccc0841ba82e9158de4693311231793a0e38b465ab75887e
MD5 6074e9764586b91194c4df244b56de59
SHA1 5d88f467c41cd16c2f73ccc77924da86ac6d6235
SHA512 8bac6efa0677e40c9bc13108189ffb7989f6de3acd214b94a5ba06fc32458e67feece4299831561718dae6de8908433425eb43f6963ca5ea8bd1038699db7d0b
TLSH
T1C241E2D47A880004DBF58E3008E0FE55F6B93CDFA8D3760AC4BC65647E9E7795210CA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b5a68d3f4dbdd119518e69ca42c6307c1655c660f3f7afb20af04709af7c800b
MD5 cdce997785aa6a8ddd20e0c2aa654cb3
SHA1 ab5032f26b67181ab3d79fd328ab8f48be1e81a3
SHA512 ca71e17dad3e3dbe0c85676cabd9ccda13124b0755555efad67c1e7fe4be10c61ace046b5f2d839b87821335713ee3cb83d9f72cd3141c520175eab250e1b96d
TLSH
T12E41C0D976480000DBF59E7008E0AF55F6B53CCF6883760AC4BC75647E9E7796110CAE
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 740d3a9475b21914fa453f75d4e071727a67dfad6a061117347a927f9277f0b6
MD5 40a5d623b5743f619960bdf0e8e4f71b
SHA1 3abf2043dcd672c12eff75cb8d9b128962371f09
SHA512 93cac2a2da1a82a13f793b6569bf9269cf392e8c581e1ecb97f4278b788b1c9d2fc38009daf62ae3b4c8c6244a7126393d04a0db314ee7b1dc50fe3a21a18ece
SSDEEP 192:DDaJvBFeGL1rRWL/XBjbZi4VJ0NPPaPphlAsSwVHNMwjcQdwPd0ZK1nG:DDaJvBFeGL1rRWL/XBjbZi4VJ0N3aBh9
TLSH
T14922EDFBC3D9C22DC80556F89725AF1ECE6D0A18432C3D66C8D8AE5B93E2871D25534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 2adec3ef4cb80a4b6fdc12b21c6f794762178be98669ca509680eab329e36d09
MD5 a9462ca16a019062aba8dd5c1a578322
SHA1 c2b8278797472900a8c0dd476afdc11981448da7
SHA512 d8c992a779bca2414f78f0d89efa9f317926037adac6dded3b573f01e7740892357980b8e0888462e08dc06e54cae81bf9ef26e8a1c1a1fcf64407b7e7257570
SSDEEP 192:DDaJvBFeGL1rRWL/XctNjbZi4VJ0NPPaPphlANwVHNM3dwk0ZK1hJixAE+qb9:DDaJvBFeGL1rRWL/XctNjbZi4VJ0N3aN
TLSH
T11732D0F7C3D9862DC80156F89B25AF1ECE6D0A28432C3D26C8D8AE5B93E2471D25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b030926044cc0b684659122567d53b05b15bc5ca86178ed86922dfa6c15913e8
MD5 3bb4a6eee486631d83e6a66febdfd31b
SHA1 75adbd8843ecf4423f4bdc4f1ceaa29b12abf56f
SHA512 07d8b622510f1c9183c200c592b3876de564015df71d56e9bd0583e77b8198c41fce6e5aca6adc6adc81057e0bed24dab26acc41d0abc091c7f3dc7faae56ab5
SSDEEP 192:gR4KbWTxv73pAPRp23EO9vHsb+WNnW14Dw2mZ2NkkwwVyIsnAUgtaJ:gR4K+hbUXGhw8b2i26U8
TLSH
T16442942AAD2075BB5CDBD22AFA227B53D3F5102275942E84EAFC887C14E75CC6227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9a5b1070bbeeebf662469eedc9c67000f086afb031ec1f7ac19df7f9f64f40ed
MD5 34c5b565652c112985a1e7d46bc5db2e
SHA1 618b3276e96caf4ec2fe2bbeea04f9d245743570
SHA512 58732285773d3cb47104ddd73763f28bc27bc5d6e1dc6aa9c1f005f9d9c7a894a0e785ea07f15cf6349837d8f378c81361a60f201e1a2c58bc4de17586f4c347
SSDEEP 192:gRQcBzKbWTxv7A/pAPRp2TNbP9vHsb+WN+AW14Dw2mZ2NkkwwVyIsnAUgtaJ:gRQmzK+hkUXChwkb2i26U8
TLSH
T11642932AAD6075BB5DDBD22AF922BB53D3F5202264942EC4EAFCC87C14E75CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 49b1bdd2e03800885458fce2ef17fb7267d60966754cbfa04c1615b4c3310200
MD5 b31c2ed2fdd0b94985f05cd028682bcd
SHA1 afb3fcd98d747b7cf501177faa7db7a06937edd5
SHA512 93fb68871dd0bb488f8472059c3fc057020c11c1b7c12a204d56a117f31d902e7c0d84543cdbab36d64bddba0e30032b95ca4b64828494e359e14b0d7a8dc440
SSDEEP 192:gRQcBzKbWTxv7A/p+PRpNTNbP9vHsb+WN+AW1qihMDw26Z2NkkwZ8yIsnAUgraJ:gRQmzK+hk6XHhwk9X2e26+e
TLSH
T1AC52B62AAC2465BB9DDBD22AF9217B52D3F5202274942EC4E6FCC97C14E75CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e69be424dc58e8ed5e5655d0625aea42188814ce77ec1e97e8323a369cf0410e
MD5 dbd2fa6671c1ba6bebd4892d2f42a2d6
SHA1 8ccd78cb530a5bcd0c61b6162b8564c4560adc33
SHA512 9a5fa81d497072d6acfb190b87d6a7016031ed1733e7df60d2fe56b68b3b41441fff9347d8d3c6a360811823d0567ae48ea4c4bddd5d4a5ad5528503bda2b2d8
SSDEEP 192:gR7cBzKbWTxv7A/p+PRpNTNbP9vHsb+WN+AW1qI2c/Dw2EZ2NkkwZ8yIsnAUgraJ:gR7mzK+hk6XHhwkkz2c26+e
TLSH
T17E52B66AAC2075BB9CDBD22AF9217B52E3F5202274D46E84EAFCC97C14E75CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
MD5 8607790a422ecb522e4c0dbd3b269b34
SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
TLSH
T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 be4c9a98835a00fcb2d07ee74e8c1e40f32566ff3f618e39091cc65e7cd43186
MD5 9724aa5a25a6360cdf8e57dbff94c4fa
SHA1 4d981a54a2ec151c1aeb1fba3939c8d03eb5d857
SHA512 c560ac35d7c9b96e1aa0188033d1ea8cd2fdac2902662b52a7f370337e36e04b7c2f3cf761343ca56c649fbe9ddedbae575f9f9b223333cdebc12704197810a4
TLSH
T1DFB011A80002AE0AC80022B280C3A880B232BAC023A20A02A2A200A8E8003028388008
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 567001d811aff013d6b607315199a7c8f02be44dce3e0da44b82b80d401dc3cd
MD5 cb425cb571c59ab7d9b0ebe8c9ef7025
SHA1 23f50ffd0720ff049866c26bbba4371cca240efe
SHA512 c2d52d9a03eebe709673c8154749a6782255dce4c2ba42ba316f370709fda65ee04b00194007967411452fd4434b484b9507f7efa24235c6b353106174087075
SSDEEP 3072:C+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:C+hFD+7t56OD9ZfSApprZ
TLSH
T1D0D31232AA91C8BBC9BC6541B197A300DE626CED45DE3A09444A5FCEE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 86cc164b6177ebcb24f8193b0af0a16888df50dcd86ec23899b76fc8e1b2b722
MD5 68229a82e08ed14a8f2d60ad4f14a64d
SHA1 a7c2a732c4d1a03dcbb60f1a2b62263e09c118ab
SHA512 ad721a3f51f549837432483901dab3e62b1c728f1dbd3c1c5440bb43b4f0246759d7794055039cf2a932eda115ffed8edbcf55fc3b4dc1bf5400d3e900736161
SSDEEP 6144:xCTN8F25vAVpl2Pw2DAWnP+hFD+7t56OD9ZfSAppra:xCTN8QoVpl2FnPyFSXD9ZfS4A
TLSH
T16E442322FF49DA7F08A8623470ABE308CEB1259594DD636940D75E4D515FAD81F33E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 35ecda741ac66c93f22b52a01eabcbe68ec1ae96cf73f7c2a48f93ec25de09ed
MD5 0944d63a29c85603b9e0720d35824861
SHA1 bc61f9ab64a6d079c62c9d157963fdecd7d61097
SHA512 a41f19b888a787064fc728615abc6f35ab9afd823bc32a080f5f0b9f6b4bf6f1b230af31b3873d32d03ce32f389593d057474046decb7e2ee402c8ec098bef18
SSDEEP 6144:yCTN8F25vAVpl2Pw2DAWnP+hFD+7t56OD9ZfSAppra:yCTN8QoVpl2FnPyFSXD9ZfS4A
TLSH
T18E442322FF49DA7F08A8623070ABE308CEB1259594DD676940D79E4E515FAD81F33E32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 8371aa9451b2259feceee0c46da0b0a58ebb5360989064e3718971e9e5d15368
MD5 996ea8ea0e827af90531b8a2ad174d23
SHA1 3e3db913fbda5d66730bd18821b2891d2c2c739c
SHA512 afce330481bb5a2e59dae64dc70dd23da131dd3b925f27c65b14e713d5617856539f74aebd3601e035d2e4f25068d454c8d819e0a9b745906834834c8dc2f1d3
SSDEEP 6144:jzTN8F25vAVpl2Pw2DAWnP+hFD+7t56OD9ZfSAppra:3TN8QoVpl2FnPyFSXD9ZfS4A
TLSH
T1D5442331FF49DABF08B86224B0A7E308CEB1219794DD676940DA5E49519FAD81F33D32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 ffc642634c4337f759852084b94b5bbbb247285d16408d4bec65f240004af5c2
MD5 eec69f1a7eff9b5f29366da620e7de88
SHA1 be3b8ae89646aa781dfeb338ecf1b10a8c0c6060
SHA512 70d7184fdd97388eb5eeeab2fb716e96a1a4d3a4339e83e98a9b2ca3621c19d379936a108b49d11da971cc428683835f44fc21c59ffb014e3fb5f19c07aa5061
SSDEEP 1536:heYaC+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h8:8YaC+jH04tAHk5MrxyNhftflJdPYodVD
TLSH
T164334093E9204E71E1A66F3EF15652227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

№ 7093 від 22 вересня 2026 р..bat

Path C:\Users\Admin\AppData\Local\Temp\7zOCC38640A\№ 7093 від 22 вересня 2026 р..bat
Size 4KB
SHA256 311d0910dc8bb69eae5514aff21d3411d62aa64e76de91cb916269fd1abd3901
MD5 475e4d840fa0e674c50289793c569984
SHA1 a5014e521ae3c0856e9f1212c6338d2af63cab03
SHA512 73f0d6cac26377df5d8f5cf542457c4f98dd204d6e5f3a5606da749a7c94d1b52522e8425b2c23fc78993267198313406588aa7ee0e386160c27acce0868db35
SSDEEP 96:qqc2g1oadjd6bVigiPiCn4mk6wb9Uoucpz1QB5eP5ZH0k7x1/tmxq:tc2grdqVz4GvWoucpz1QB5eP5ZH0k7Qq
TLSH
T13191A69DE21A4E0C148E1D31E0D562AAB9F6519153B0C539F2B49E603CD1FAAA0395FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ne5xahrk.q1o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ne5xahrk.q1o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/508-21-0x0000000007040000-0x00000000070D6000-memory.dmp

Download

memory/508-24-0x0000000004580000-0x0000000004590000-memory.dmp

Download

memory/508-0-0x0000000004580000-0x0000000004590000-memory.dmp

Download

memory/508-22-0x0000000006FD0000-0x0000000006FF2000-memory.dmp

Download

memory/508-20-0x0000000006E90000-0x0000000006EAA000-memory.dmp

Download

memory/508-19-0x00000000074F0000-0x0000000007B6A000-memory.dmp

Download

memory/508-18-0x0000000006BF0000-0x0000000006C66000-memory.dmp

Download

memory/508-17-0x0000000006050000-0x0000000006094000-memory.dmp

Download

memory/508-16-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

Download

memory/508-23-0x0000000008120000-0x00000000086C4000-memory.dmp

Download

memory/508-15-0x0000000005B20000-0x0000000005B3E000-memory.dmp

Download

memory/508-12-0x0000000005480000-0x00000000057D4000-memory.dmp

Download

memory/508-25-0x0000000004580000-0x0000000004590000-memory.dmp

Download

memory/508-6-0x0000000005410000-0x0000000005476000-memory.dmp

Download

memory/508-5-0x00000000053A0000-0x0000000005406000-memory.dmp

Download

memory/508-4-0x0000000004AB0000-0x0000000004AD2000-memory.dmp

Download

memory/508-3-0x0000000004BC0000-0x00000000051E8000-memory.dmp

Download

memory/508-2-0x0000000004580000-0x0000000004590000-memory.dmp

Download

memory/508-1-0x00000000044A0000-0x00000000044D6000-memory.dmp

Download