6292d1c55f671aef93c4e8e2df554753e7457b361771844fe92a812801956e3c

Analysis

user interaction
yes
max time kernel
600s
max time network
586s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ISLC v1.0.4.8_setup.exe
Size 1.2MB
Sample261014-svsapsgg52
SHA256 6292d1c55f671aef93c4e8e2df554753e7457b361771844fe92a812801956e3c
MD5 9b4ad7e81cc727262f8ac08b38d41f05
SHA1 945d2b17067e79282334a93b769931d9c6fe337d
SHA512 e1380236a906025c75251cd49531e584cd1a617095ef7790bdf28e72fce93c05846bc3ca4855429e5091eb0d8d1b5b761e780f8a817075fa064147e66c6d037f
SSDEEP 24576:JyWZClubgsjDIq3rIo+349/am/+h56iV5Z5obGuDryj0JqZV:I34sZ1o+Ism/+H6qASuDrjqL
TLSH
T10145236A5A10D023E58F037228325FD78BF79520488C92CF5B54B2FD25B27E16D76EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files\ISLC\ISLC.Core.pdb	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\ReadMe.txt	ISLC v1.0.4.8_setup.exe
File opened for modification	C:\Program Files\ISLC\ISLC.url	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\de\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\ja\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\ru\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\fr\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\pl\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\tr\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\el\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\zh-Hans\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\Intelligent standby list cleaner ISLC.pdb	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\LICENSE.txt	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\THIRD-PARTY-NOTICES.txt	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\it\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\ko\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\pt\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\sv\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\config.json~RFe5a31ee.TMP	Intelligent standby list cleaner ISLC.exe
File created	C:\Program Files\ISLC\fi\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\nl\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\no\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\ISLC.Core.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\cs\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\es\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\uninst.exe	ISLC v1.0.4.8_setup.exe
File opened for modification	C:\Program Files\ISLC\config.json.tmp	Intelligent standby list cleaner ISLC.exe
File created	C:\Program Files\ISLC\Intelligent standby list cleaner ISLC.exe	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\ar\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\da\Intelligent standby list cleaner ISLC.resources.dll	ISLC v1.0.4.8_setup.exe
File created	C:\Program Files\ISLC\config.json.tmp	Intelligent standby list cleaner ISLC.exe
File opened for modification	C:\Program Files\ISLC\config.json	Intelligent standby list cleaner ISLC.exe

Executes dropped EXE 1 IoCs

pid	Process
4844	Intelligent standby list cleaner ISLC.exe

Loads dropped DLL 3 IoCs

pid	Process
4852	ISLC v1.0.4.8_setup.exe
4852	ISLC v1.0.4.8_setup.exe
4852	ISLC v1.0.4.8_setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Intelligent standby list cleaner ISLC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Intelligent standby list cleaner ISLC.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ISLC v1.0.4.8_setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2372	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4844	Intelligent standby list cleaner ISLC.exe
4844	Intelligent standby list cleaner ISLC.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
4308	chrome.exe
4308	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	Intelligent standby list cleaner ISLC.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe
Token: SeCreatePagefilePrivilege	3764	chrome.exe
Token: SeShutdownPrivilege	3764	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4844	Intelligent standby list cleaner ISLC.exe
4844	Intelligent standby list cleaner ISLC.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4844	Intelligent standby list cleaner ISLC.exe
4844	Intelligent standby list cleaner ISLC.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe
3764	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4844	4852	ISLC v1.0.4.8_setup.exe	99
PID 3764 wrote to memory of 1180	3764	chrome.exe	109
PID 3764 wrote to memory of 2372	3764	chrome.exe	110
PID 3764 wrote to memory of 2148	3764	chrome.exe	111
PID 3764 wrote to memory of 2148	3764	chrome.exe	111
PID 3764 wrote to memory of 616	3764	chrome.exe	112
PID 3764 wrote to memory of 616	3764	chrome.exe	112
PID 3764 wrote to memory of 1220	3764	chrome.exe	113
PID 3764 wrote to memory of 2752	3764	chrome.exe	114
PID 3764 wrote to memory of 1220	3764	chrome.exe	113
PID 3764 wrote to memory of 2752	3764	chrome.exe	114
PID 3764 wrote to memory of 1264	3764	chrome.exe	115
PID 3764 wrote to memory of 1264	3764	chrome.exe	115
PID 3764 wrote to memory of 1748	3764	chrome.exe	117
PID 3764 wrote to memory of 1748	3764	chrome.exe	117
PID 3764 wrote to memory of 2516	3764	chrome.exe	118
PID 3764 wrote to memory of 2516	3764	chrome.exe	118
PID 3764 wrote to memory of 2660	3764	chrome.exe	119
PID 3764 wrote to memory of 2660	3764	chrome.exe	119
PID 3764 wrote to memory of 2412	3764	chrome.exe	120
PID 3764 wrote to memory of 4452	3764	chrome.exe	124
PID 3764 wrote to memory of 4976	3764	chrome.exe	125
PID 3764 wrote to memory of 924	3764	chrome.exe	126
PID 3764 wrote to memory of 4308	3764	chrome.exe	127
PID 3764 wrote to memory of 3684	3764	chrome.exe	128
PID 3764 wrote to memory of 3684	3764	chrome.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ISLC v1.0.4.8_setup.exe
"C:\Users\Admin\AppData\Local\Temp\ISLC v1.0.4.8_setup.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files\ISLC\Intelligent standby list cleaner ISLC.exe
  "C:\Program Files\ISLC\Intelligent standby list cleaner ISLC.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbac98c728,0x7ffbac98c734,0x7ffbac98c740
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,5522249743267853508,7119326995095939726,524288 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,14670250848357757298,11750209450629815871,262144 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,2839981983540465233,64713114347822861,524288 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,4616144661296644547,17406124880190524877,2097152 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2688,i,8954615892438292479,9149497774466704860,2097152 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,14159378736475977205,9517717605470876047,2097152 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,1666679102298312256,4190385390501497752,2097152 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4296,i,467638888815219798,4470389592632561430,524288 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,5589901344102408110,11707203115513042121,524288 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,6305680903839246634,143754022971452328,524288 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,1135576325237418935,13090485160797687654,524288 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,4680190513790258208,9513012579525240512,524288 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,9336065566488857346,5088034056018935009,524288 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5708,i,7881763653322963856,9908127125121773408,262144 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5112,i,14168659550051969368,14140882282710192519,524288 --field-trial-handle=2056,i,8448670669825257428,10170275579509927243,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1536 /prefetch:8
  2⤵
  PID:3684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ISLC.Core.dll

Path C:\Program Files\ISLC\ISLC.Core.dll
Size 48KB
SHA256 11dc5458940033634e40b855ec117a07edadf78d3c3fe2aca989098a46c590ac
MD5 cb4361b1389a2f5955532e56e76dc32b
SHA1 80e63874166f6e0c186819f8374e978011d81d76
SHA512 5bb5a1786cccacfb0e579eafa2dd0f35ce8b5fe0d46fe4ea7bbcca8b21e93dee748a0ccbc5759e84bc997642566ce3b13be371d0004299342ed1493fcb206b11
SSDEEP 768:R7ZuEWd0djeGFUt8aAXbJeleKOkg6dmGW1JrA+hLK:R7ZNWdeeAja6JeleKO96dmGw4
TLSH
T162233860F3A8C01BDADF1F76A4F281161BB0B6C52812CABF1CD49094AD6BB51077777A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Intelligent standby list cleaner ISLC.exe

Path C:\Program Files\ISLC\Intelligent standby list cleaner ISLC.exe
Size 1.1MB
SHA256 11e4ed0b322adced3214c5a73ca1e807140341be6327b2a47a4c52434e73322f
MD5 2984e961fe2e6d9183e7fda7d93962d2
SHA1 ea96c0391c2b5194e44ab41d7a818040c41f3bf4
SHA512 563f8314f809484232276b59b87da2f76921afd753051da670e412d7246fec9066865a331d05c9a29d291fa5cedb72cba68634428b958055af4bf8799871aaa5
SSDEEP 24576:RlubgzlubgtBjk38WuBcAbwoA/BkjSHXP36RMGolubg0fV:R4sz4stCSA/Bkj0h4s4
TLSH
T160459D4123E88E2BD1EF6B35B4304F1447F9F913AAB5D78F6A44E9A91C93B418E50363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json.tmp

Path C:\Program Files\ISLC\config.json.tmp
Size 347B
SHA256 8b68292c7d840f7dc5f3f7c64a6011be77b6eed2fc3aee9720c289b6d37f01ad
MD5 577a2ec8a7a2ce554a17563c6b7db66c
SHA1 fd187c28edb97480ac6822b4731e677c1e8890bf
SHA512 5d2a4b621fb81fb06882d97d0ef5520d4bed976e2a7fe7e8933b6ca3078480457b82848f7b6246079cf649742b9b60816511cbb072b2b4125d9e2ddcd2daee75
TLSH
T185E04F13C85614BFD6F9D32C9075856632514F6A35341C4BF1B7464DB6B5E703048F96
MD5 SHA1 SHA512 TLSH

Submit Download

58ea93db-cf47-407c-a3fc-ac6029b23691.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\58ea93db-cf47-407c-a3fc-ac6029b23691.tmp
Size 268KB
SHA256 d018acbc0eeb55cdae141b911c2ece8cb17ed86a0480c806066e13fbb6757079
MD5 4b6093ffbf3ff987e72d6229887719ff
SHA1 b28a75df8f6bc82217e22cade83f0b99b8928d90
SHA512 89cd87b8ec50518bb15731c8854092f442940cc4655dd9dc05f79c666c44721356177b8458e4c4d821a2e68432a1b198b7f7a3c53126bdc1b227e774b6de24ef
SSDEEP 6144:n0O/tUZvxYkhkW9JbYE++hFD+7t56OD9ZfSAppr/:H/ebhR7bYE+yFSXD9ZfS4V
TLSH
T1BE4423A1FD19DC5BC6FD545572AAB304CFB2A8DE44CA68CE84E81ECB525F18C0BD3912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6133edd3-81b8-42ba-aaa4-16e48e4b51f4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6133edd3-81b8-42ba-aaa4-16e48e4b51f4.tmp
Size 267KB
SHA256 025d528d6932bb37ac9d8ddd1f2aaec743520599f641e43db20a23c1a0c2371f
MD5 ce7534320c1ad913b4c2678c7fd76ced
SHA1 c2fe084a34192fd40cef71c75541294cdab842ce
SHA512 9b6836aaf65d9b6b8a09794c3af36cf27269367b8738de095bf1493e5ec701ab9adcbed424ff8bfcf52b6d44852e60ea6fe2b05f672f684a9abca90860703323
SSDEEP 6144:8C/tUZvxYkhkW9JbYE++hFD+7t56OD9ZfSAppr/:1/ebhR7bYE+yFSXD9ZfS4V
TLSH
T1C6441292FD19DC5BC6FD505172AAB304DF72A8DD44CA288A85F50ECB525F5CC07D3A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7543ee37-cb79-4e5c-aa16-09aabcbb005a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7543ee37-cb79-4e5c-aa16-09aabcbb005a.tmp
Size 268KB
SHA256 3439866c62a656a95965459c173be0bef04f12a0664565f0f933f308129bb395
MD5 7f8cc2a2f1f7aa0c81c0e2603cd33ee9
SHA1 1cc4b06ee9b8042d2813e122380df5f7a01c4e17
SHA512 4cababe5b35b45c17b4aff9bca2b0e5959d365f14fda48603fef5b71c88607065256afb915c255bab4fabf4d04f310087e2bd74f98d2be5a5c654f4beac64669
SSDEEP 6144:70O/tUZvxYkhkW9JbYE++hFD+7t56OD9ZfSAppr/:L/ebhR7bYE+yFSXD9ZfS4V
TLSH
T1084423A2FD15DC5BC6FD545572AAB304CFB2A8DE44CA68CE84E81ECB525F18C0BD3912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c0a5c6c-98c7-4e3d-9ced-f5f56af02f0c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5c0a5c6c-98c7-4e3d-9ced-f5f56af02f0c.tmp
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b3ea9d2-3b69-4326-b170-8e17ab196d7e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1b3ea9d2-3b69-4326-b170-8e17ab196d7e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

415b7dd2-7b34-40aa-8ae6-10778d673e28.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\415b7dd2-7b34-40aa-8ae6-10778d673e28.tmp
Size 2KB
SHA256 0f6efcde454f0a1348d7b8430b1d7c79045a433e45fee9f767ef5c516cbc539a
MD5 e667735f5432c7ec24dedb474e7c41cc
SHA1 93db5ad124c4c3debf3b31c0458963aac07cbac0
SHA512 0e5cce013a4c0ca4796b8a5b548057c33426052edf778250a53e1158c741e73518205a33a4e2879ba3163c65741515c307dfe5fbcee5f2c9fefcffbb0fa53793
TLSH
T154518BF7C3E4856D891156F4DB257E1FDE290A24132D3C66C8D4AE1B53F2872E20178E
MD5 SHA1 SHA512 TLSH

Submit Download

627c547c-9431-40bd-bc38-7efff49440c9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\627c547c-9431-40bd-bc38-7efff49440c9.tmp
Size 2KB
SHA256 6dea97ac38763326657bc063b34010b6322364e9d222132ea0d25a302caf24c9
MD5 12dfb8311f2a0e8f55e7cda7bd3f2726
SHA1 d968c1076e3889b5106a012495fb7022703484b6
SHA512 8a84d4eae50434dc5086be4bb846490f37a9ee82ae65adaa1c922e99bbaf89cba41490714aebd8fbe6599742306d2eac2b82ef8fe998f29c96aa4a054cb0eea6
TLSH
T119518AF7D3E48A6D851196F4DA217E1FDE7D0A24231C3C6689D4AE5B43F2872E20178E
MD5 SHA1 SHA512 TLSH

Submit Download

ff9ba8b6-227b-49c9-8bfe-1c92122f7922.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ff9ba8b6-227b-49c9-8bfe-1c92122f7922.tmp
Size 2KB
SHA256 4640dd8329cb5494cf41b5af21796b47a06f2a4feaad3ae6011a7e823c88403c
MD5 f5248a6370cd670aa6d0449f70ba6393
SHA1 2649d618b988b71ab4aadc1944cfd4a32d17e4cc
SHA512 f508333bc9c1e719f0eb1be4bdf3a3204b4bdd426cf576ae4c485b0a1e31eab771ba44e0fe0c0fd9879ad1426e1e226f83a76085dede31a6af20a115ae24a838
TLSH
T1C7516AF7D3E4896D891156F4DB257E1FDE790A28132C3C6688D4AE1B53F2872E20178E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 3d6925b2fcc22bc3c923e4c5aec9eafb41166a6d95a40385cb60f255a05b9a05
MD5 5e81e1eec05209b45317963073225960
SHA1 c9e51552f9857ce52e0ef910f404fd9464193064
SHA512 08715b7d4593fcd3ab16efba9d6933eb1d5ad7acc9b4f7c3cda811b3e37025a2150f223e8decd91b27dd13b9a65231422dcb68338898fecaa68c3bf169349f24
TLSH
T16BB00259C1036316C58703B02A9595E8B2B0DF65CE43261BA2EC2E66DC2D6604625D66
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1e7d06de2a865121d65e6ab7903568abdf817a48cfdac146605c982d9e1c5099
MD5 4f11729be0eb4ca38535ddea5c1d4c0b
SHA1 d236a25fe1ce30cb7cbc33026317a0f1ab25afa0
SHA512 d0a0510db4f6e68ddd85a97a079c4a811682bef7fd72d263c418ea8965e42ae00ec4790ab9ba44dd3802aed9adfc5dd9e4b23952a4f15b1e4b24f5bebff945c4
TLSH
T163B0124490425301C01342F42A5418D831A8DF30B60A170982F00D11C839160811B564
MD5 SHA1 SHA512 TLSH

Submit Download

dad8f1b0-4376-44f3-b250-fd4939e1fbb8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dad8f1b0-4376-44f3-b250-fd4939e1fbb8.tmp
Size 12KB
SHA256 f11b7a0d3483d062a2353d57b5f1843f678195b577215e5e4d6f3c3969a526b8
MD5 a4fa968fecfa55dfed5f4fae014b85c6
SHA1 e466edfc1a12c42935d1a0d6cd7df5540841f14a
SHA512 6a8378707921a5d31fa1e44615c4a727e7b2d34de2c8648a0646902e93539d780b2382043fa57349fc3c3c3d67b77148a4057aa05afc62865d2f633dc814c021
SSDEEP 192:aRFvFMYt1f76QBv7VJpAPRp2B9fHsb+WNnKo0cvy27eE2FSaBVyIsnAUgraJ:aRFNLRvUXGhwV0cq2KAane
TLSH
T109429229F910793BADEBD31AE9613753D7F5202621842E84EAF8C93C15E75CD621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db180bcd-2738-4804-bb11-fd18a02c6ce6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\db180bcd-2738-4804-bb11-fd18a02c6ce6.tmp
Size 414B
SHA256 e7395c1820e5ae8104b0f234fc3d49fc3acfe584da342be2285a8b5f1d6f9801
MD5 b9cc4a71ac26c8305ac24815978c3c42
SHA1 3a60bb0aed0c344dfd2469a3433cf8325638513e
SHA512 73bea9d8859177bf1b1c60ababff8d757fa8845ca8086b8413bbab1698e3f5d53b805d6e80e795439bcac66b596f880a121d9a6d9535baf34d4b4307b8d6d0ea
TLSH
T1FDE0E5AAC820EC3718F80B3A50D00B46E76123662A51850B773C811D8FF052B468585C
MD5 SHA1 SHA512 TLSH

Submit Download

f1c52f39-4cea-4795-9877-a10dac73e9a1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f1c52f39-4cea-4795-9877-a10dac73e9a1.tmp
Size 12KB
SHA256 3a378527b49a29e90682b35832b9aa5da977790d15625942a4405215fcf0521b
MD5 493b4dec96d7e1c0dddb7bca2b1f786d
SHA1 17026e6bc85e14f380baf2a322ee32491fc87803
SHA512 5fd59803da49e471d22b71533215aee0c17dcf1a96b778dc430249bb7f4269f7adc070f6e4a9653753bd9dccce85c1ec4d000ee8bc8800b9792ecbcddf1465e0
SSDEEP 192:aRFvFMYt1f76QHv7VJpAPRp2B9fHsb+WNnKo0cyy27eE2FSawVyIsnAUgtaJ:aRFNLPvUXGhwV0cR2KAa08
TLSH
T19042A22DEA10793BADEBD31AE9613753D7F6102521842E84EAFCC83C15E75CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe3d1a06-e7dd-436e-8348-097d4eb61d8e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fe3d1a06-e7dd-436e-8348-097d4eb61d8e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ca7c567a-e36e-4666-9986-52b3a741921b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ca7c567a-e36e-4666-9986-52b3a741921b.tmp
Size 130KB
SHA256 383434a98509f747ea8bfd46321855f0a7d6eb6bc2613c7caacee973f2aaa099
MD5 42501d3612e540e577b8ff6078123fc7
SHA1 9f72e3230b8e1f9f8bd1e192f6a87c64cfdb74a0
SHA512 5b87f9f2d8bc7d04eca75a7020627a7b996b3b94f44eaf2cc18c3203b1e7c77d1e7165766113ddf6db3e134fc90b7d13cba6af06f9f3e1b81936a07c6d6c6338
SSDEEP 3072:wJn+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:wp+hFD+7t56OD9ZfSAppr3
TLSH
T10AD31232AA94C8BBC9BD6541F157A300CE626CED45DE7A09444A9F8EE09FD5C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e52aa9e4-4a7d-43e1-bb17-bcff962d6af2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e52aa9e4-4a7d-43e1-bb17-bcff962d6af2.tmp
Size 267KB
SHA256 47a0b7a998ab8c977bed6d9efb7d6608e97b78503fea1a3ef80073965a9418f2
MD5 405ece8c22ee290234779ca00d85ec89
SHA1 5125094fd846aa07def0e8dab8efd060abefb6a9
SHA512 aa07a9e07401492264b96965c17ab660a15e78b3bc31c7a26f2d67a176a33233a5ed63f5bb8a98589d91f0e678f8ec367e7a51144b51d478d47ef26c2a4eedff
SSDEEP 6144:7C/tUZvxYkhkW9JbYE++hFD+7t56OD9ZfSAppr/:O/ebhR7bYE+yFSXD9ZfS4V
TLSH
T1FF441292FD19DC5BC6FD509172AAB304DF72A8DD44CA288A85F50ECB526F5CC07D3A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi64D1.tmp\LangDLL.dll
Size 5KB
SHA256 760df89c2341f9c39c0250c283cb9caad185244fd6b76e8157cdf49928dc1d8e
MD5 5e2fd68a1ce97cc2866becb699fdb4c0
SHA1 55469bdaea8e9660f69f15107affda81de2787ae
SHA512 de94531b4f0d85bfb8de5a30390631dca84064e48f1984b7521d54382ddd26e3d886738455a4ed7fcba3f7ee8b092cf01cadcb8c3326b9fa5721e6d952db871e
SSDEEP 48:S46+/DTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mW2ofjLl:zpuPbO5tCZBVEAWyMEFv2CmuL
TLSH
T14BC19370B3D248B9D591413778AB33D36612EE746784504FDB6315AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi64D1.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsi64D1.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsi64D1.tmp\nsDialogs.dll
Size 9KB
SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
MD5 cf0351a2ab9128838be6b54cea8238d3
SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
TLSH
T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4844-105-0x00000217F6350000-0x00000217F6360000-memory.dmp

Download

memory/4844-115-0x00000217F6350000-0x00000217F6360000-memory.dmp

Download

memory/4844-122-0x00000217F5FD0000-0x00000217F61C7000-memory.dmp

Download

memory/4844-123-0x00000217F5FD0000-0x00000217F61C7000-memory.dmp

Download

memory/4844-124-0x00000217F5FD0000-0x00000217F61C7000-memory.dmp

Download

memory/4844-125-0x00000217F5FD0000-0x00000217F61C7000-memory.dmp

Download

memory/4844-126-0x00000217F5FD0000-0x00000217F61C7000-memory.dmp

Download

memory/4844-120-0x00000217F5FD0000-0x00000217F61C7000-memory.dmp

Download

memory/4844-136-0x00000217F5FD0000-0x00000217F61C7000-memory.dmp

Download

memory/4844-119-0x00000217F6350000-0x00000217F6360000-memory.dmp

Download

memory/4844-118-0x00000217F6350000-0x00000217F6360000-memory.dmp

Download

memory/4844-116-0x00000217F5FD0000-0x00000217F61C7000-memory.dmp

Download

memory/4844-117-0x00000217F6350000-0x00000217F6360000-memory.dmp

Download

memory/4844-121-0x00000217F5FD0000-0x00000217F61C7000-memory.dmp

Download

memory/4844-114-0x00000217F6350000-0x00000217F6360000-memory.dmp

Download

memory/4844-109-0x00000217F6350000-0x00000217F6360000-memory.dmp

Download

memory/4844-110-0x00000217F9530000-0x00000217F9552000-memory.dmp

Download

memory/4844-106-0x00000217F6350000-0x00000217F6360000-memory.dmp

Download

memory/4844-107-0x00000217F95F0000-0x00000217F9628000-memory.dmp

Download

memory/4844-108-0x00000217F95C0000-0x00000217F95CE000-memory.dmp

Download

memory/4844-104-0x00000217F6350000-0x00000217F6360000-memory.dmp

Download

memory/4844-103-0x00000217F6950000-0x00000217F6958000-memory.dmp

Download

memory/4844-91-0x00000217F6450000-0x00000217F6502000-memory.dmp

Download

memory/4844-90-0x00000217F6350000-0x00000217F6360000-memory.dmp

Download

memory/4844-89-0x00000217DCAE0000-0x00000217DCAF0000-memory.dmp

Download

memory/4844-86-0x00000217DAE60000-0x00000217DAF84000-memory.dmp

Download