bcb21f1b4b14892370d2e935bcdb20feae7ff36d8d7eab8bf24a72ef43b01f89

Analysis

user interaction
yes
max time kernel
900s
max time network
876s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDM_6.4x_Crack_v20.6.exe
Size 66KB
Sample261003-svt5astsft
SHA256 bcb21f1b4b14892370d2e935bcdb20feae7ff36d8d7eab8bf24a72ef43b01f89
MD5 99e93f400964b6c8bab5a18e0e216500
SHA1 2cfa756887ba67240c73791782386bd389a83454
SHA512 da8e355bd93692cec82ac59cd899f25112be270fc69b7aac49d4abe7e95428b3ffd9f18ebdc5cfbc196c2fb8290ff5051ebeb639ac56e4cad4762ea437f43af1
SSDEEP 1536:/RGKmid3B3HHF49xGwwjE/kzOhB0a4oPkcTLa:/AhC3tHHF4kjYkzOB0a4Ncfa
TLSH
T1FA63F151C3E85D23F7FA0471839AEF91E2469DF690854623312FAD0E17BF4D00BAAD58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	624	wscript.exe
8	624	wscript.exe

Blocks application from running via registry modification 1 IoCs

Adds application to list of disallowed applications.

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "0"	IDM_6.4x_Crack_v20.6.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	IDM_6.4x_Crack_v20.6.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	IDM_6.4x_Crack_v20.6.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	IDM_6.4x_Crack_v20.6.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
4392	cscript.exe
864	cscript.exe
1852	cscript.exe
3240	cscript.exe
3608	cscript.exe
212	cscript.exe
4848	cscript.exe
4952	cscript.exe
3776	cscript.exe
1356	cscript.exe
4440	cscript.exe
2980	cscript.exe
2312	cscript.exe
220	cscript.exe
2624	cscript.exe
3620	cscript.exe
3452	cscript.exe
4464	cscript.exe
3704	cscript.exe
4208	cscript.exe
5020	cscript.exe
4116	cscript.exe
1908	cscript.exe
636	cscript.exe
812	cscript.exe
5048	cscript.exe
3000	cscript.exe
3956	cscript.exe
5056	cscript.exe
2160	cscript.exe
4268	cscript.exe
2788	cscript.exe
4944	cscript.exe
2400	cscript.exe
3636	cscript.exe
4528	cscript.exe
1200	cscript.exe
900	cscript.exe
1864	cscript.exe
4776	cscript.exe
3332	cscript.exe
4648	cscript.exe
4760	cscript.exe
4204	cscript.exe
3804	cscript.exe
1892	cscript.exe
1708	cscript.exe
1480	cscript.exe
1972	cscript.exe
4452	cscript.exe
3868	cscript.exe
4904	cscript.exe
1672	cscript.exe
4336	cscript.exe
3000	cscript.exe
4628	cscript.exe
2124	cscript.exe
4692	cscript.exe
4752	cscript.exe
2648	cscript.exe
2716	cscript.exe
4392	cscript.exe
968	cscript.exe
2020	cscript.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\rarreg.key	IDM_6.4x_Crack_v20.6.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3300	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
4224	chrome.exe
4224	chrome.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe
1588	IDM_6.4x_Crack_v20.6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4224	chrome.exe
4224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe
Token: SeShutdownPrivilege	4224	chrome.exe
Token: SeCreatePagefilePrivilege	4224	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe
4224	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 452	1588	IDM_6.4x_Crack_v20.6.exe	86
PID 1588 wrote to memory of 624	1588	IDM_6.4x_Crack_v20.6.exe	88
PID 1588 wrote to memory of 4344	1588	IDM_6.4x_Crack_v20.6.exe	97
PID 1588 wrote to memory of 1852	1588	IDM_6.4x_Crack_v20.6.exe	105
PID 1588 wrote to memory of 4224	1588	IDM_6.4x_Crack_v20.6.exe	107
PID 4224 wrote to memory of 4220	4224	chrome.exe	108
PID 4224 wrote to memory of 4356	4224	chrome.exe	109
PID 4224 wrote to memory of 4356	4224	chrome.exe	109
PID 4224 wrote to memory of 3300	4224	chrome.exe	110
PID 4224 wrote to memory of 3820	4224	chrome.exe	111
PID 4224 wrote to memory of 3820	4224	chrome.exe	111
PID 4224 wrote to memory of 452	4224	chrome.exe	113
PID 4224 wrote to memory of 1796	4224	chrome.exe	114
PID 4224 wrote to memory of 452	4224	chrome.exe	113
PID 4224 wrote to memory of 1796	4224	chrome.exe	114
PID 4224 wrote to memory of 3748	4224	chrome.exe	115
PID 4224 wrote to memory of 3748	4224	chrome.exe	115
PID 1588 wrote to memory of 4536	1588	IDM_6.4x_Crack_v20.6.exe	116
PID 4224 wrote to memory of 4128	4224	chrome.exe	118
PID 1588 wrote to memory of 212	1588	IDM_6.4x_Crack_v20.6.exe	120
PID 1588 wrote to memory of 4228	1588	IDM_6.4x_Crack_v20.6.exe	122
PID 1588 wrote to memory of 2400	1588	IDM_6.4x_Crack_v20.6.exe	125
PID 1588 wrote to memory of 548	1588	IDM_6.4x_Crack_v20.6.exe	128
PID 1588 wrote to memory of 4752	1588	IDM_6.4x_Crack_v20.6.exe	130
PID 4224 wrote to memory of 4404	4224	chrome.exe	133
PID 4224 wrote to memory of 3316	4224	chrome.exe	134
PID 4224 wrote to memory of 3816	4224	chrome.exe	135
PID 1588 wrote to memory of 4960	1588	IDM_6.4x_Crack_v20.6.exe	137
PID 1588 wrote to memory of 1716	1588	IDM_6.4x_Crack_v20.6.exe	142
PID 1588 wrote to memory of 3452	1588	IDM_6.4x_Crack_v20.6.exe	144
PID 1588 wrote to memory of 1672	1588	IDM_6.4x_Crack_v20.6.exe	146
PID 1588 wrote to memory of 2648	1588	IDM_6.4x_Crack_v20.6.exe	148
PID 1588 wrote to memory of 3000	1588	IDM_6.4x_Crack_v20.6.exe	150
PID 1588 wrote to memory of 3228	1588	IDM_6.4x_Crack_v20.6.exe	152
PID 1588 wrote to memory of 812	1588	IDM_6.4x_Crack_v20.6.exe	154
PID 1588 wrote to memory of 2800	1588	IDM_6.4x_Crack_v20.6.exe	156
PID 1588 wrote to memory of 392	1588	IDM_6.4x_Crack_v20.6.exe	160
PID 1588 wrote to memory of 4628	1588	IDM_6.4x_Crack_v20.6.exe	162
PID 1588 wrote to memory of 4944	1588	IDM_6.4x_Crack_v20.6.exe	164
PID 1588 wrote to memory of 4872	1588	IDM_6.4x_Crack_v20.6.exe	166
PID 1588 wrote to memory of 636	1588	IDM_6.4x_Crack_v20.6.exe	168
PID 1588 wrote to memory of 5068	1588	IDM_6.4x_Crack_v20.6.exe	170
PID 1588 wrote to memory of 3980	1588	IDM_6.4x_Crack_v20.6.exe	172
PID 1588 wrote to memory of 4692	1588	IDM_6.4x_Crack_v20.6.exe	175
PID 1588 wrote to memory of 3704	1588	IDM_6.4x_Crack_v20.6.exe	177
PID 1588 wrote to memory of 1452	1588	IDM_6.4x_Crack_v20.6.exe	179
PID 4224 wrote to memory of 4668	4224	chrome.exe	181
PID 1588 wrote to memory of 1120	1588	IDM_6.4x_Crack_v20.6.exe	182
PID 1588 wrote to memory of 3904	1588	IDM_6.4x_Crack_v20.6.exe	184
PID 1588 wrote to memory of 752	1588	IDM_6.4x_Crack_v20.6.exe	186
PID 1588 wrote to memory of 2716	1588	IDM_6.4x_Crack_v20.6.exe	188
PID 1588 wrote to memory of 3468	1588	IDM_6.4x_Crack_v20.6.exe	190
PID 1588 wrote to memory of 2904	1588	IDM_6.4x_Crack_v20.6.exe	192
PID 1588 wrote to memory of 5048	1588	IDM_6.4x_Crack_v20.6.exe	194
PID 1588 wrote to memory of 3768	1588	IDM_6.4x_Crack_v20.6.exe	196
PID 1588 wrote to memory of 3688	1588	IDM_6.4x_Crack_v20.6.exe	198
PID 1588 wrote to memory of 1200	1588	IDM_6.4x_Crack_v20.6.exe	200
PID 1588 wrote to memory of 1908	1588	IDM_6.4x_Crack_v20.6.exe	202
PID 1588 wrote to memory of 5056	1588	IDM_6.4x_Crack_v20.6.exe	204
PID 1588 wrote to memory of 4580	1588	IDM_6.4x_Crack_v20.6.exe	206
PID 1588 wrote to memory of 4300	1588	IDM_6.4x_Crack_v20.6.exe	208
PID 4224 wrote to memory of 2484	4224	chrome.exe	210
PID 4224 wrote to memory of 2484	4224	chrome.exe	210
PID 1588 wrote to memory of 3604	1588	IDM_6.4x_Crack_v20.6.exe	211

C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.6.exe
"C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.6.exe"
1⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:452
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\\CRK_UPDT_c5janco.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.6" "Crack" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent
  2⤵
  - Badlisted process makes network request
  PID:624
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://internetdownloadmanager.com/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa1268c728,0x7ffa1268c734,0x7ffa1268c740
    3⤵
    PID:4220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,15546941530296424012,7635535273292401332,262144 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1920 /prefetch:2
    3⤵
    PID:4356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,4951885231058440081,13343899605038485920,524288 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,8505587054438721998,744657120361371255,524288 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2532 /prefetch:8
    3⤵
    PID:3820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,13631371500242332527,4817994259557019485,2097152 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,16374426298420707935,5654194376269785032,2097152 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:1796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4500,i,6798433267357668825,10922556042487731761,524288 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4520 /prefetch:8
    3⤵
    PID:3748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,16790300385391278486,7647813279956985775,524288 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5284 /prefetch:8
    3⤵
    PID:4128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,10983716148586290971,5173630494989335483,524288 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5532 /prefetch:8
    3⤵
    PID:4404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,5583770276054176760,7310448175954799406,524288 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:3316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,5691941199064151214,14641786279664611224,524288 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5600 /prefetch:8
    3⤵
    PID:3816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5488,i,6536255836159541897,13861256704168540802,262144 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    PID:4668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,5271678878673209004,3592844283448498602,524288 --field-trial-handle=1912,i,3117532685538252795,6336758016244307698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    PID:2484
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4536
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:212
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4228
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2400
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:548
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4752
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4960
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1716
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3452
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1672
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2648
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3000
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3228
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:812
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2800
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:392
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4628
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4944
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4872
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:636
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5068
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3980
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4692
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3704
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1452
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1120
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3904
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:752
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:2716
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3468
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2904
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:5048
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3768
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3688
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1200
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1908
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:5056
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4300
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3604
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3804
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3744
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4336
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4992
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2528
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2804
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3560
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3764
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2288
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5056
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4656
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1248
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3000
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1356
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4440
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1892
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3008
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4464
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3892
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:3636
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4392
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:4528
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:688
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4180
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3232
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2152
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4536
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1864
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4312
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4776
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4344
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:3240
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2980
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3704
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4484
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3608
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3140
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2312
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5056
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3332
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4268
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:968
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:636
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2616
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:2160
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2036
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3080
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2288
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:220
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4440
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1704
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3000
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4208
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4308
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3620
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4344
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1612
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3488
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:332
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:3776
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:900
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1836
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:996
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4268
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:2788
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:1864
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2568
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1720
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1284
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2624
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1476
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1812
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3728
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4256
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:416
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4872
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:804
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:900
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1388
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3332
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3452
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3464
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4648
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1080
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2524
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2512
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:3620
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4760
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:1708
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3036
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4204
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1280
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3900
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3768
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3908
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4600
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:412
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2212
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4880
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4012
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4840
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4032
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2020
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4136
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4760
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4424
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1560
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4484
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1792
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4116
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3244
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3776
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2268
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1836
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:5020
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1764
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4536
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4028
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:32
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1480
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1972
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:4628
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:212
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4344
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3260
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4868
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3504
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2012
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4116
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4392
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4300
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1908
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3148
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4452
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1368
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3484
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2616
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2788
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3868
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4904
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4032
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3956
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4848
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3152
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3228
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4952
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2124
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1624
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:864
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1592
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3244
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

304e384f-e2a3-4e20-a742-6ef28160073a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\304e384f-e2a3-4e20-a742-6ef28160073a.tmp
Size 264KB
SHA256 c9dd3a4ac843bcbe47ad78bbd30fa1c4b60c42a9dea5eaa8bf86fa913d27d273
MD5 82f1758872d8f8f436523463c8c55245
SHA1 049f909c7f6ca3fb40d2deca0edcffc1fe145d5b
SHA512 202d143a5a7852cc48d4ff7463baacb61d58c2b749f821517ae418d06fdf78967b95de512119af2f00b2346e137348261cedced605576ac549009716a883fc06
SSDEEP 6144:MvJlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWLW3+hFD+7t56OD9ZfSApprZ:MvvKwLPlUFWWdJrQRbqZ4yFSXD9ZfS43
TLSH
T1EA4412B2BAD2CD778EBD2141A1577320DC72ECDC41CD2806849A5BCBD19F19907E2C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45fea59d-7717-46af-a294-42bbfa0f0dbc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\45fea59d-7717-46af-a294-42bbfa0f0dbc.tmp
Size 264KB
SHA256 ab6846ad63038e3d3fe8508d831861afcad59fe9d41fa7bad994e95d8e1c00f6
MD5 d7e194f2c5cb105167e88904a9d7ba9f
SHA1 502477231830f88229d1b0906dc456956ce1cfed
SHA512 6951d03e305611c79f20d0a15d7df0480090953224331c1253dee7fc318bbbf8fd9c3fd13976027c3d065dcf0d2a1af0cd4bd34d5ed1b27c529d779cfaaeb9cd
SSDEEP 6144:vxFlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWLW3+hFD+7t56OD9ZfSApprZ:vxDKwLPlUFWWdJrQRbqZ4yFSXD9ZfS43
TLSH
T1B84412B2BAE2CD778ABD2141A1577320DC72ECDC41DD6806449A9BCBD19F58807E2C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15dcb6d5-a8f4-4158-9366-aa08e863854a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\15dcb6d5-a8f4-4158-9366-aa08e863854a.tmp
Size 11KB
SHA256 9397d1bdf808ae1c796e05e7c038ffea7728fffb62da00363b75cc9cca62a465
MD5 d229180a28984927f9366021bc82fc35
SHA1 d2460bd759947eb885f977388c435e2317ace4ad
SHA512 241db30b6ca93864f427a1d7aa1f1811953d0530e8ce73462ead2fc1a1893ab05c0f3f678b8fd2b9d3841ed0456082b7cba8b1b9b28841c01b0331fdf67082dd
SSDEEP 192:XRtEDNGv71vAPRp2Z9IHsb+WNn9DP/n2ueYzVyIsnAUge:XRtExy56X62whP/2Ge
TLSH
T1F532B42DAD10797B5CDBE22AF961B753D7F5102222882E84E6FD893C15EB9CD321B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

347eb096-ae55-4e6a-be36-0411a8e56189.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\347eb096-ae55-4e6a-be36-0411a8e56189.tmp
Size 11KB
SHA256 ae20cc5e49d46ea33c0a606ab88734f9a56ba165db80b724b6435c965df1b74d
MD5 f4059cd3c9ee66f4024374de3686f5a1
SHA1 662b0eae4de0d9deb7d9890d8f7fec4d9d293666
SHA512 294fcf02d7c9f564d5a66a7cf14a6a317a1b5430c07fc1dcba40b73da4cc46b2acde37a4ca11d9a679a2768a53c54431e481137726f69a3c4fd0c5c04de722df
SSDEEP 192:XRtEDNfv71vAPRp2Z9IHsb+WNn9DPsn2ueY9VyIsnAUgE:XRtEx356X62whPm2sE
TLSH
T12432B42DAD10797B5CDBE22AF961BB53D7F5102221842E84E6FD893C25EB9CD321B407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d6887ee-6a31-4c4b-9399-57357e24e848.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6d6887ee-6a31-4c4b-9399-57357e24e848.tmp
Size 649B
SHA256 0c706651879d8b0f023b5d85747ff510894dda1f7ceccf1f465cf189ea783d9c
MD5 bb0a5148cf50716e50eb9adb403ede9a
SHA1 b1d3319e8196a6385009e80398cea22ccdde4deb
SHA512 86473a2338424dbb3566c7f56a35a1c2d3a331d74c78e65c8ec6c3b52bdc8b76d82d3c7d5c36e476fe3b612ad5447c76c9f4c718b80103415e8c340396285c28
TLSH
T10FF028B5CD35EC3B18FD5B1820A84746FB9013572781899F3B3D810D8FB567B868691C
MD5 SHA1 SHA512 TLSH

Submit Download

87925a01-1399-450c-817c-84f6120713d3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\87925a01-1399-450c-817c-84f6120713d3.tmp
Size 11KB
SHA256 69de6dc15114076d475e4d2dcbd4f54f468751981803dff78752531ab5ac90ad
MD5 c653853b21659f0f1a17088bce964c32
SHA1 c9af26cd4f271345652cef22d3ee94263e07c6fb
SHA512 17294d3e2da7c128a1afbab2436f67089293d2f455551945ced92cf318cec61acb969153487bfbefa7e45c0fc427f6d759842991c793ab38adf722dd3735d291
SSDEEP 192:el64K67/7KxkXqK4I40pUZNCgVLHrKHfFKslEz9LXzKD/Qj+ErUkKN9pVS27SS0+:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLm
TLSH
T13D32D827A44DAA3F4FD8D50DCC12AF4BADF502527368092497FB9D14039A7CA214E6BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87cedd32-568a-40fe-9e75-e455ec897764.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\87cedd32-568a-40fe-9e75-e455ec897764.tmp
Size 11KB
SHA256 686aec52e257ebfde152c9b3ab8fc636a1a8e4f388659530ed48a0f48c09a567
MD5 437510d0d5009e385594eb25420590a7
SHA1 8eee9bc6fb9380c2d7b0f085d538c016b839b230
SHA512 79327d10f4f4bc9ed04ec464d379755c3649e2bfb1fd0d39a287af35d47ebf01f0843f8d7447406714fc5d92c5f0891c3bae3590502b5e2257a0030b7d76bb02
SSDEEP 192:XRtEDNfv71v2PRpkZ9IHsb+WNn9DP8en2ueYzVyIsnAUgE:XRtEx35gXc2whPb2wE
TLSH
T1C642B52DAD10797B5CDBE22AF961BB53D7F5102222942E84E6FD893C15EB9CD321B007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0076a203-d7f1-432e-9ddc-189772c1ce18.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0076a203-d7f1-432e-9ddc-189772c1ce18.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8132fb66-33f7-470e-80f8-079099f6b84a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8132fb66-33f7-470e-80f8-079099f6b84a.tmp
Size 2KB
SHA256 d90a32e8360a14cab0b40223751b5f26024c23c12ca287c54a9be5577d2b6490
MD5 32e709249812b3acaf430eb2f3f7d5ab
SHA1 9a687bf81a41a3ac1f0bf1ef1315e42fc024d12c
SHA512 c6679362b830890320b82f510b660d98591298d552698206b1bbeba5cf622fe69a2b69d8c4a0fbedfe50e1c5b3fdab8794b3dfecee6bf51d3d5cb9a4e8b4c1c7
TLSH
T1EC518BF7C3E49A7D890156F4AB152E1FCD3E0A18536C3C5688D4AE1F53F29B2E24068E
MD5 SHA1 SHA512 TLSH

Submit Download

b84e0cd0-b9f7-4a8c-ac0a-30a47be68309.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b84e0cd0-b9f7-4a8c-ac0a-30a47be68309.tmp
Size 2KB
SHA256 ff2cf7d235e7fcc160d608702cfa421469368b0bb2e25a8a63cb07238a5bd0f7
MD5 7289137eb3ff82bd73c98f7da7ecb0cc
SHA1 208eb9dd6ed31811dfbe03e46ef98cdd9d6d3068
SHA512 776df32f3115b4b8a127554eb919df872e5fc12a703724cc712d7845b897b4e8fe717b3451f0f0d96f57ac78a8080985d5c2f9b0d76aed343b1fab5554873e88
TLSH
T1BF5169F7C3E49A7D890156F4AB156E1ECD3E0A14532C3C56C8D4AE1F53E29B2E24068E
MD5 SHA1 SHA512 TLSH

Submit Download

bd1ea172-5b3a-40ce-a398-378d21585c05.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bd1ea172-5b3a-40ce-a398-378d21585c05.tmp
Size 523B
SHA256 c8448bc4ccd11cac7ca2d7c7c274667b7bb5dfa74e25f335a813d34af3c9f4b9
MD5 b58ccdb6bb8c11c935baa53085788d2c
SHA1 71c3dbb9281dbb90226a58a9c49805d4fb21b2a1
SHA512 2f53426d556427a489b4540ad6d535effcc6a716893a5c37aa06f229677ad847ff15a974eca560000db4ec2039b0ece65d0ac361e2fa2fd33a7844483fea8b15
TLSH
T1A2F059A7E6BA757B10BA45A72E04B8451976A83001416CE4DEAB926CF0D61E71B52093
MD5 SHA1 SHA512 TLSH

Submit Download

eac7ca6e-db94-44dc-98a3-85e64c79d7b0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eac7ca6e-db94-44dc-98a3-85e64c79d7b0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 2e3fd4d5bc89a9a86784ea8fb1817165c6298d897930c2348764571a67d10879
MD5 618ee639ec1f27decdefafa1ca97bf0b
SHA1 d58f0b032e295b2d6265fee7160d8dbfa390cf45
SHA512 d73c9873d64f9a0c68b719a0b29b7680adc34d4656089bd7a5d99debcf7a07228937143778beb6c7a6482e620b2220cdf38558733df193d2e87f984a49b740e7
SSDEEP 3072:dyB+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:dyB+hFD+7t56OD9ZfSApprr
TLSH
T159D31232AA91D8BBC9FC6541B157A304DE66ACED45DE3A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9f92654-82c5-4213-84c3-b156249f8a2f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a9f92654-82c5-4213-84c3-b156249f8a2f.tmp
Size 264KB
SHA256 099163db6a674c320fc627ebd30ff83d259cb101c2312c64c229e7c79301caa1
MD5 00f11782da38c11d32c08c6acdfeaac6
SHA1 17cbea645bdba6e6d4ee32021106cf603a7bb502
SHA512 9ca61c08e8c4ad457782fb1687bd034824e22988990db77dce56dc00f018e3e838d0b43c769adbc6c4c6ddba464737fbfe212a9e77109cc80d69dce7d62ed466
SSDEEP 6144:vvJlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWLW3+hFD+7t56OD9ZfSApprZ:vvvKwLPlUFWWdJrQRbqZ4yFSXD9ZfS43
TLSH
T1294412B2BAD2CD778EBD2141A1577320DC72ECDC41DD2806849A9BCBD19F19907E2C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CRK_UPDT_c5janco.vbs

Path C:\Users\Admin\AppData\Local\Temp\CRK_UPDT_c5janco.vbs
Size 2KB
SHA256 92fe72cceb630c7eff3b2d3bed9c6969f53e5b9dff1f481888754e59b3c76ab7
MD5 b91c1157d6f1e605cc965d092551b307
SHA1 02469c313acdea89c3a669741093e9fe09dfcdfb
SHA512 bc3174aa8962d92910c6183dbefdac6987893eaf10a7dce029cc5bf4133f9b23af7b440c3ed0ed7a499a2049f72d331344ad7472241bcc737aa4dcf878000a6f
TLSH
T1BA519A5DBB0FC53905011AE04DB905096FFCC723D157CA29794FC88E0B1A57DC6E6AE6
MD5 SHA1 SHA512 TLSH

Submit Download

WININF.vbs

Path C:\Users\Admin\AppData\Local\Temp\WININF.vbs
Size 2KB
SHA256 14f12199c930e4d4d6671dd9565423aac5ae259668c64298e194f329895d670a
MD5 ed182dc22e8b528b90631fd660782168
SHA1 8af052394d4fcb016f2d205bc18cd88d8f8667f0
SHA512 42f61103935f51fe7f9a2141458798ba4a1c6ea486ba07950527881edabe25e5e3d809139bf353f78eb568dd9ac3f24ecb6a3c10324fa2be096f3070e218e633
TLSH
T1CC414F163A01E2B5D1331EF09D7F655ECAB8011B38A689C43584CAC90F3607F9AB12B8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1588-144-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-154-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-103-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-104-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-106-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-85-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-84-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-57-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-128-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-129-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-131-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-132-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-133-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-134-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-135-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-136-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-137-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-138-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-139-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-140-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-141-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-142-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-143-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-0-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-145-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-146-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-147-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-148-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-149-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-150-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-151-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-152-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-153-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-86-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-155-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-156-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-157-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-158-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-159-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-160-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-161-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-162-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-163-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-164-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-19-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-173-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-174-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-175-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-176-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-177-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-178-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-179-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-180-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-181-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-182-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-183-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-184-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-185-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-186-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-187-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-188-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-189-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-18-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-195-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-196-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/1588-197-0x0000000000400000-0x0000000000442000-memory.dmp

Download