hxxps://sourceforge[.]net/projects/processhacker/files/

Analysis

user interaction
yes
max time kernel
92s
max time network
58s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/10/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sourceforge.net/projects/processhacker/files/
Sample261027-3pmhdaws5j

Score

8^/10

defense_evasion discovery installer

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
52	1928	chrome.exe
92	1928	chrome.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
20	raw.githubusercontent.com
75	camo.githubusercontent.com
76	camo.githubusercontent.com
77	camo.githubusercontent.com
78	camo.githubusercontent.com
79	camo.githubusercontent.com
80	camo.githubusercontent.com
19	camo.githubusercontent.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\processhacker-2.39-setup.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\processhacker-2.39-setup (1).exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1928	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x000400000002ab61-171.dat	innosetup

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\processhacker-2.39-setup.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\processhacker-2.39-setup (1).exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4464	chrome.exe
4464	chrome.exe
584	powershell.exe
584	powershell.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
412	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 2772	4464	chrome.exe	81
PID 4464 wrote to memory of 1928	4464	chrome.exe	83
PID 4464 wrote to memory of 1688	4464	chrome.exe	82
PID 4464 wrote to memory of 1688	4464	chrome.exe	82
PID 4464 wrote to memory of 3968	4464	chrome.exe	85
PID 4464 wrote to memory of 3968	4464	chrome.exe	85
PID 4464 wrote to memory of 1780	4464	chrome.exe	87
PID 4464 wrote to memory of 1780	4464	chrome.exe	87
PID 4464 wrote to memory of 4804	4464	chrome.exe	86
PID 4464 wrote to memory of 4804	4464	chrome.exe	86
PID 4464 wrote to memory of 5228	4464	chrome.exe	89
PID 4464 wrote to memory of 5228	4464	chrome.exe	89
PID 4464 wrote to memory of 3324	4464	chrome.exe	91
PID 4464 wrote to memory of 3324	4464	chrome.exe	91
PID 4464 wrote to memory of 5848	4464	chrome.exe	92
PID 4464 wrote to memory of 5848	4464	chrome.exe	92
PID 4464 wrote to memory of 5600	4464	chrome.exe	93
PID 4464 wrote to memory of 4172	4464	chrome.exe	95
PID 4464 wrote to memory of 4172	4464	chrome.exe	95
PID 4464 wrote to memory of 4524	4464	chrome.exe	96
PID 4464 wrote to memory of 4524	4464	chrome.exe	96
PID 4464 wrote to memory of 1456	4464	chrome.exe	97
PID 4464 wrote to memory of 5048	4464	chrome.exe	98
PID 4464 wrote to memory of 5048	4464	chrome.exe	98
PID 4464 wrote to memory of 3040	4464	chrome.exe	99
PID 4464 wrote to memory of 3040	4464	chrome.exe	99
PID 4464 wrote to memory of 5676	4464	chrome.exe	100
PID 4464 wrote to memory of 5676	4464	chrome.exe	100
PID 4464 wrote to memory of 2788	4464	chrome.exe	101
PID 4464 wrote to memory of 4656	4464	chrome.exe	102
PID 4464 wrote to memory of 1328	4464	chrome.exe	103
PID 4464 wrote to memory of 4604	4464	chrome.exe	104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sourceforge.net/projects/processhacker/files/
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc66b1c728,0x7ffc66b1c734,0x7ffc66b1c740
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,3847729486585892820,7167095825954091416,262144 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,17071219596004573968,39601383845851531,524288 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,7046363144035942859,2616204349160381313,524288 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,6229092423405671232,4371934015429088979,2097152 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,11205946186343438568,16029515167344444895,2097152 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,11746608520725210185,4836068425689116696,2097152 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3436,i,107599369566913958,3480966108825933911,2097152 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4588,i,10913476817458950248,7955224053729341322,2097152 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2248 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,8199728295068104350,17655306547689016848,524288 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:5600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5988,i,17398135558793016837,7811444946775537342,2097152 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5976,i,17833812449918313584,6838061612359580914,2097152 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3688,i,14622044046143118174,16504254562084796146,524288 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3696 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6184,i,15506559024443650232,4484760865164778812,2097152 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6116,i,6824223963449634743,17028872401484446543,2097152 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6012,i,6251605846120309106,6497399165335058547,2097152 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,1627389484957538186,17401539135312135969,524288 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=212 /prefetch:14
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,856082494898357524,11188743405594736281,524288 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4836 /prefetch:14
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6200,i,4798280004432711637,10982429682695690397,524288 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6180 /prefetch:14
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,2357580106049084716,18228080031439042100,524288 --field-trial-handle=1948,i,4405457259387371812,1242769885585361167,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2348

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:412

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22691141-f939-4a71-afcd-925c75cd86a8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\22691141-f939-4a71-afcd-925c75cd86a8.tmp
Size 131KB
SHA256 72eb715ba000d3e98716a6819db4f70d24a617bb13186bbbd93f5de3fd0e26f0
MD5 40ad4290ff055d63a298b0a605316231
SHA1 3504e7a7d3d812d58fac8d6dd5b75356c3ba8073
SHA512 0e9e8306f0714bd327067f856beb23dd5bf0481959546e2f8032b5dc8bbcc8f6d5255396ac01c89695cf5a645334c729a53a28d429931d0ee4c3842c9d1428c1
SSDEEP 3072:+LPjhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:+LPjxmX/B5UgKf2ne1utLV
TLSH
T1E9D302BB9DDDEFE36391B02669691B6BC9F57FC8A160EA4081F41184009F1FD83D9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9742e726-aea7-4eb4-8459-87c1cd946645.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9742e726-aea7-4eb4-8459-87c1cd946645.tmp
Size 130KB
SHA256 7fec373ecaa2698f6de7c9b0c902d84b0a4b179a120295815c3959e9f9bdde81
MD5 f6c89c195e01a3984f96de103972cf7b
SHA1 125ab19be7db3d2d66783f6297c5c609d3bda0ff
SHA512 8fca12d19830f9d5150e18f895478fe4b877831e155ebf6c8d062fa83c0344bb604cadb6fa56dd79c151fa0903e28b508adcddc1808e7117a133e277916baac7
SSDEEP 3072:FLshgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:FLsxmX/B5UgKf2ne1utLV
TLSH
T137D302BB9DDDDFE36361F02669A91B6EC9F67FC8A160EA4040F41184005F1FD8399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 7cd4d930f4e2895a941e8cd451dfaa5d7afb0a4eab6b2c1ba3c0a9fac276c913
MD5 3d796cb6002d5c2a73ca7eada21b52ff
SHA1 4f1ac5a1096d7182ec9385cf15f3f87647e81045
SHA512 770769671784e35c0e2d505b4daca77224453922a6151b366c7ab39088845eca875538028114eb10cd910a6e5da1441d268d1a3203f2e19f212e1e85f462f587
MD5 SHA1 SHA512

Submit Download

01ca127f-f506-4faa-8e43-f85d08476796.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\01ca127f-f506-4faa-8e43-f85d08476796.tmp
Size 11KB
SHA256 570370b72ba0ada930209c9bc771014eecca1954004f266db03ad4763626ca39
MD5 cf07285652f03067c979d0e2864db0f2
SHA1 475015f1be2bc3e0deccb6f1c50140907c2a88fe
SHA512 54de3a7c208fb772755ec8197e7dfd280a7055d0e32431bd2d5fb352244b2fb8957ce774c223c8898b626803eb117178af7683f30dc0a92573782053531df26e
SSDEEP 192:eSt4K6gu7KxkXqK4I40pUZNCgVLHrKHfFKslExKEXzKD/fK+ErUkKN9CzNFKx6AT:Dtjnu7KxkXqKf/pUZNCgVLH2HfgslFEq
TLSH
T1E532EA27A48DAA3F4FD8D509DC166F4F6CB5429672780D2496FF9C0803A57CE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15d28d08-25f9-4bca-9355-71ee41093e8e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\15d28d08-25f9-4bca-9355-71ee41093e8e.tmp
Size 414B
SHA256 ccad811e16edc9386c6f4cf8766240a4ff100dc6bf546835f57f37bfdb8810ef
MD5 c0373029569e2210013915a5afb33b34
SHA1 cd732bdd0eb12ec020c98c571e0653ba6476613e
SHA512 1a96409cdeae63cd2ba35f7b666fab5f527780a3425aef2e9a9232630f74a3a702a213bef4195a9c6be366252dfd39c4bd54facfa6de5259a0e0ae6c79dddf24
TLSH
T15CE02B6DC912EC3715F8075850550B46EB00436B2B81894B373EC20D8FF163B828683C
MD5 SHA1 SHA512 TLSH

Submit Download

26856c93-de09-4ca0-810e-7057203e6cc0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\26856c93-de09-4ca0-810e-7057203e6cc0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

37b7cafa-c000-401a-a0ff-11815911513a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\37b7cafa-c000-401a-a0ff-11815911513a.tmp
Size 13KB
SHA256 8ef2ae6a46fc8eb9ecec12cbe674091fcb4de6266efdcf3a1e32e6b5f0b6f436
MD5 281f13dde9063f76b28fa49211ab117b
SHA1 2e71c7032d485dc51187c544b0c4584eee4f660b
SHA512 1b296d678a25ccecb42b1640b1807214926d81b736c5ac9f556b975c03b7664481ad90472645085cc8e51b8c3f9817db3e69dc6c89ee20092541863d9e9719ed
SSDEEP 192:NRB47Hm9v7qNsAPRp2sO0BSt9fHsb+WNGQyd1Y2ovqeF9+F2bwB2KPZ7tU/VyIsv:NRBMG9mNXwdwOyxZa202KxoE
TLSH
T19B52C86AAD243A7B5DE7C229F966775BE6F2102275C42E84E6FD8C2C20E36CC3117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7132f03a-ed96-46d6-ad49-c0eec17a6a33.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7132f03a-ed96-46d6-ad49-c0eec17a6a33.tmp
Size 12KB
SHA256 bc47074ba18c1dc1ed2e0ed1d294c95a208ca6e1d7e5a0c6802c68b351e5fb44
MD5 dc23f757f0c58519003eeceda72060dc
SHA1 4996fe8a844041e952623f934849ff0ce523549b
SHA512 c480a93a70443f3b107e36ac61b228b2e9799dd38eebd7063209d626f6a15cac9c2324906e590104eec2d47dbda46517cd79bba912d3f729fc3d95b04ed20abc
SSDEEP 192:NRB4QHMYv7qNvAPRp24jY9fHsb+WNnd1Y3eF2oB2KPZ7tUxVyIsnAUge:NRBdsEm6Xcdwdy42I2Kx2e
TLSH
T18742B52EAE24793B5DEBC21AF9757757E6F6102271842E84E6FC8C2C24E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 41KB
SHA256 0e2e6d1994902577a3d3a7f0e37875dd22de26342bec8403ebe262f92f2eddd7
MD5 a587d1a659231c3c59460569a5564da7
SHA1 eb542e028c0b1d2fd44d24b15f20176a26255d07
SHA512 73c9bfccbe137b51140469d22c9469ccda975e6caee5402a819a4629d1d5a23664e062e5f96271c1ca37b2f737e39cba6f7c25d25c0f1a3d7a31394ab8ecd814
SSDEEP 768:aS1GIh+o3q6EIwVfpJWMT3PHw1ALy+wBAPYqaia1PsbtUZE5JCaUvZGJatEG2fhN:aq9/EIwVTT3PHGAmPXRiMPmoKkHZGJau
TLSH
T17313F1CCED8DD55C266FF1E788F8B6B35468BF818819D336A4A067DC0724803743BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 78KB
SHA256 f938fc238c3cace5cf87f02858a89997564836b714140ca3f43f3af6f125dc5b
MD5 c0f0a732addab04aee41ad47d008fe63
SHA1 3fc9848e4db37e7b05a9445434d5a96484bc9dbd
SHA512 05ad5a7e54dcc5183069fb56712877491ab642ee20d996e757725ef1abdd86f7e956c9072298d1a043fb6eadd6734185bd1c46095b1d4b44f44cb877e08109d0
SSDEEP 1536:9fZc4jfMEWcy+P7EZQ1QI1NdO4eMyvEm3vbpA6Nv/UyCgth3N9qAzS8A:9fpfMdZLQ7LdO7amfbyWagtj9V0
TLSH
T1707302FC88FD5197B108A8B624A0F0F9572DEA383C4AE75B5382D02E776E8274A57C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0fb44b09e8855c83b4abf5e9dc78e8f564c5e18221b81ef21cb1e6a22fc2d54d
MD5 d416206947c80bb0c070cd44b5be616a
SHA1 a7c9b83b3b75fcf418c89e6f444363a7a62ea9ac
SHA512 81f04c7ccec44cb83892faf06b33a807009e0a179e3bd7a4290e98c8a214323491b05b9781855a447e7aeb2b25a845f9bc2856ecff3ae3e788f17d8e940450f9
TLSH
T142711EB47AB84C39D7A9913BA3DA5A5B363EB20404176E5BB3D8D8B01C237C35C31875
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 67eb2f5ae9fc07c93ea63307bbecf5ff660489a155e67afdabdbdd98dceba3c3
MD5 2b0c093c1822a5bb335e481ceb5cc266
SHA1 831d4dd36ccbab4ea14eb519169bd3ace76c6897
SHA512 9ec698750e0a876515956bc86fead0bc10e851cd6a3872eadb4541d050e2adcbe69ed53c37618d3302584ef679e35bc9e1bc8f89ea9b7bdcad5b65df737a3114
SSDEEP 3:MsEllllkEthXllkl2zEklvOnX:/M/xT02znGX
TLSH
T1844404047FD01C0FC50054315111C3510370D41507517F43347344335DC55504C05100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a87bc8b-12d8-4857-a928-e893f4c4c85a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9a87bc8b-12d8-4857-a928-e893f4c4c85a.tmp
Size 2KB
SHA256 1731db8b37cf79c376ee05c985972b040c14a574b564c0b26d3b879894499ac5
MD5 b8165b6594104b14f9b0b17eb8259dfd
SHA1 07b3298abc9535f542fff45165e1cc229e8448c4
SHA512 fea3c8dcc3fc7acc0acb32fb5e94ae0cf70dd0fb0d470d80022e861b4193524a821cff5b47f82c1938fcee838b42444b99b5379082e1913c5a8163d90811a9cb
TLSH
T1D75189D39A7EB4AB307949771E0878063A7BB835015174F0DA67836CB0E98F74B4283B
MD5 SHA1 SHA512 TLSH

Submit Download

de64f26c-1e9a-4973-a948-0aafcb408b3f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\de64f26c-1e9a-4973-a948-0aafcb408b3f.tmp
Size 8KB
SHA256 21ca1a89ee24a4d2985a5bea531976e76368f586a742f2d1479f9c97a0edc266
MD5 9a3f04f5bf63f8ad1fb1c14cfabce096
SHA1 579be557463f0bd9623946823610e9feadfa828d
SHA512 2f0a8369020a3aa8a8cc428b24a39ce336cd95bf6d549034450c7ce4a5bb86d92ce5b9f89ecd952ba2ef5ca95a8bf9a0f7842b559c2d73b1efb3e7d38a23b11f
SSDEEP 192:Dl8Z1jbd/m6vmBaaIaEdQT8bN4ziZTXCp/1H5fljmZmBmmmKOmDmt0mzmH:Dl8Z1jbd/m6vmBaaIaEdQTeN4ziZTXCz
TLSH
T19902E1F787E8866DC92256F1A6146F1BCE6D0528431C3C6AC9E4AE4FA3F3471E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f27ca2a3-b810-4c29-b64c-3f07188c972e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f27ca2a3-b810-4c29-b64c-3f07188c972e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a25dd79b-6642-4cbe-8568-53b57d21b1c2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a25dd79b-6642-4cbe-8568-53b57d21b1c2.tmp
Size 13KB
SHA256 1784d8cab62b7c3102d293eebeebf80f45a42493212df95d24407ceba34a12db
MD5 23abeff0eb15bd670bd84a5de655756f
SHA1 e98bb2ee8f6e6ae3a77a13fc078e04e2cd672c7c
SHA512 2c730b49184aff63386533f20cce03532a908d76caa3cd0b00fb703ecd974ec579bcb6bac4a0d1f29d7fb1df076a020788cb180b48bd59c8762cdc01e64a9cd3
SSDEEP 192:NRB4CHm9v7qNsAPRp2sO0BSt9fHsb+WNGQyd1Y3eF9+F2lwB2KPZ7tU/VyIsnAU3:NRBhG9mNXwdwOy4a222KxoE
TLSH
T17752C76AAD243A7B5DE7C229F966775BE7F2102275842E84E6FC8C2C20E35CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7762de2-f3a7-42b4-9bd9-7bdc26396383.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d7762de2-f3a7-42b4-9bd9-7bdc26396383.tmp
Size 12KB
SHA256 e875a24a1c6280e3ced6185cea5767beb08f3f1f92908bf75282425b7de1cadb
MD5 f3b6e76ada0eac4c86bd8e0d9c96e822
SHA1 a6d196a95f1708c6aca4b83720476f811c8f21b7
SHA512 c38332a8a85a86398ea6d58fcaeec0ae0850bcf8072df016eadb144153163a162d6ebbd29c0569a766f1a68e86adf0ccc80305cf0316813576e6aca6d2865fb6
SSDEEP 192:NRB4CHmBv7qNvAPRp24jY9fHsb+WNnd1Y3eF2oB2KPZ7tUxVyIsnAUge:NRBhGRm6Xcdwdy42I2Kx2e
TLSH
T1FF42C62EAE147A3B5DEBC219F965775BE6F6102271842E84E6FC8C2C24E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1c15c51-b4ca-41a7-8c1d-4f6721cce7d7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e1c15c51-b4ca-41a7-8c1d-4f6721cce7d7.tmp
Size 131KB
SHA256 cb0204c62c55b741bc42a9aafc08873da7ce4708b5f18719152e60f83a747b92
MD5 7e9868b5ceb262adcbcb81527a6dcb62
SHA1 b9b4d0f0ff8e0a533619c45d7bfbbf52edd2465b
SHA512 064891963500a4ceaa26c04e12c336792d822cdc8d94f2c0dea95862fc87008d22f517e59bfaa7669933ba27eb37fcc5e11c71d59085afe9f50e517239825c95
SSDEEP 3072:HL3jhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:HL3jxmX/B5UgKf2ne1utLV
TLSH
T14DD302BB9CDDEFE36391F02669691B6BC9F57FC8A160EA4081F41185009F1FD8399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e491ce93-60ea-4b4a-b49e-59e9d492b4e9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e491ce93-60ea-4b4a-b49e-59e9d492b4e9.tmp
Size 131KB
SHA256 49c9605b210d84879b70bde003cc7410b2d46e5f206f8fb549ac61fba7295fcb
MD5 228d2488682d935aaad30bcf9f18627c
SHA1 31b70296b64da203f2dfe01b5ab8bdb024c3ab77
SHA512 99f35dc926dd935d5d836d4a006d0673e4191cfa067fcdc05d98653049a625b7f372b65b0285cb38346fe21682939d3a4fa4c6f365590e9dc09d053f5a5abbf5
SSDEEP 3072:HLZFhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xCV:HLZFxmX/B5UgKf2ne1utLV
TLSH
T138D302BB9CDDEFE36392F02669691B6BC9F57FC86160EA4081F41185009F1FD8399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gzzfnaux.mxz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gzzfnaux.mxz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

73ea3bb4-2c9c-412a-be3b-3b03e5e90794.tmp

Path C:\Users\Admin\Downloads\73ea3bb4-2c9c-412a-be3b-3b03e5e90794.tmp
Size 15KB
SHA256 2c95ffb741e655eebbb26d3ef58f97f65eea6bdd872a011daa7efce01acb6e97
MD5 5800cb72ad0b923503e8ff7835f51f3a
SHA1 7a96e82aeba4d446b71cce6b7ed24262f14f840e
SHA512 7ca591657f24703911a10d7bcdebcdd0a7a011bbdd3ebb76c1ffac6f79773f9d0e338063882dc714db52e94b187cd8b7bedf39d134d7d57c42f33f982e94a72a
SSDEEP 384:gjTfbnjvPr3Gz/7HBWh+YqitrxsLKP6vlgGpIKQ0ZGQwTFbnjvE/7HDPLXTfbnjV:0h3qitxsLKP7GpnQ0ZnwFE
TLSH
T1B5725C43CAB2C97BC011E4B0193DE428E7335B75183A3465B7BE9CDCED1B2A0584E65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 266182.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 266182.crdownload
Size 2.2MB
SHA256 28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
MD5 54daad58cce5003bee58b28a4f465f49
SHA1 162b08b0b11827cc024e6b2eed5887ec86339baa
SHA512 8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829
SSDEEP 49152:l9hfV/U5NkLXXzGZjt6kFTCVP6hWE0wvmk/eE+FrAl+NGsOSE6IX8pq:Dh9/ULkjKxtTGP6VZd2rAcvOSE6Nq
TLSH
T14CA53303DF540D3BD5B79B76973FCB154E6A734528346C63B20D5C8E8BA47A288923B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

processhacker-2.39-setup (1).exe:Zone.Identifier

Path C:\Users\Admin\Downloads\processhacker-2.39-setup (1).exe:Zone.Identifier
Size 1KB
SHA256 681688b006b4429618e185821e41b8a22294ed1c7992108521b1c0f02b8a8d90
MD5 74a868f53834e10f54e5cc010f097146
SHA1 1363043290dfb7f74bd9e4854366a9b6f77709d1
SHA512 09b30fc16cbfe5c74ce4efe9bd2832f53cfa1facf62f3d651356ac4bd54b7f28b257a41abe9214b8936c081c283ad585fc6244289403bfc9c5c5794a4f38a50d
TLSH
T11A1165EB80268B0E071235C15D6D5D9FA43BF4E68B07419D159EE14DC0C007A40DA83B
MD5 SHA1 SHA512 TLSH

Submit Download

processhacker-2.39-setup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\processhacker-2.39-setup.exe:Zone.Identifier
Size 248B
SHA256 eb26830911ff2be089f2b00ffb2bcf7e00f74a58b7b3de9dfe254b8f9ec05671
MD5 bda0c61175f73869d2007c18ae5875b4
SHA1 f87ec21377cdf4aaafdf2aa7e1fe5be7fdaa3606
SHA512 fd0ef7e5c09612bd9ce71ca3d4d42db73e658c95bf95222a2d631224e337c936d00b08daa63faea8c8e83a3c5ebb9e73aadc2d1c70ff6df22cdc511b86264da7
TLSH
T151D02B5B8C0DC00942F010CCA69C760B4CCF944806D88278D6D0C492A9D40A188E8512
MD5 SHA1 SHA512 TLSH

Submit Download

processhacker-2.39-setup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\processhacker-2.39-setup.exe:Zone.Identifier
Size 248B
SHA256 eb26830911ff2be089f2b00ffb2bcf7e00f74a58b7b3de9dfe254b8f9ec05671
MD5 bda0c61175f73869d2007c18ae5875b4
SHA1 f87ec21377cdf4aaafdf2aa7e1fe5be7fdaa3606
SHA512 fd0ef7e5c09612bd9ce71ca3d4d42db73e658c95bf95222a2d631224e337c936d00b08daa63faea8c8e83a3c5ebb9e73aadc2d1c70ff6df22cdc511b86264da7
TLSH
T151D02B5B8C0DC00942F010CCA69C760B4CCF944806D88278D6D0C492A9D40A188E8512
MD5 SHA1 SHA512 TLSH

Submit Download

memory/584-556-0x0000019691DC0000-0x0000019691DE2000-memory.dmp

Download

memory/584-563-0x00000196AB970000-0x00000196AB9B6000-memory.dmp

Download