1cb9e9aecbab5dea524e30673b8fdea7679a2e5a2ac2ab4e941a6bc5dd942008

Analysis

user interaction
yes
max time kernel
187s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nature.dll
Size 15.8MB
Sample261027-c31daace44
SHA256 1cb9e9aecbab5dea524e30673b8fdea7679a2e5a2ac2ab4e941a6bc5dd942008
MD5 970422c6ada34518b5621607c40d3b16
SHA1 072ae7a9bdd57b13b0b1845e95b97ea557c0d339
SHA512 fb83c5098f73ce48b14300cc6dfcc7ca4facb18255b7e6c7f668429832f40d270549b8e9e75e6c19d82a140636a0e56f1f1de862555a105407105796db1da115
SSDEEP 196608:UTDAnytwViyc7iEp2yRSAVjEiaqXFSHuEicF1x1K2hO9qEs7BOsfEMRF6+i8Ihun:UTDAnytlE91thPhREMRFTIhuWo
TLSH
T107F6AD836219388BC061A7BC4403927DF19EF80D9B55C7F79AD7FC2A99E71811E11FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
295	4188	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4188	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Sastasha Injector v1.7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Documents"	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Sastasha Injector v1.7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Sastasha Injector v1.7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Sastasha Injector v1.7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Sastasha Injector v1.7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	Sastasha Injector v1.7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Sastasha Injector v1.7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Sastasha Injector v1.7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e80922b16d365937a46956b92703aca08af0000	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Sastasha Injector v1.7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Sastasha Injector v1.7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Sastasha Injector v1.7.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{52D277BE-1385-4C5C-8412-8B97BF9D67FF}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000000000001000000ffffffff	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Sastasha Injector v1.7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Sastasha Injector v1.7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "7"	Sastasha Injector v1.7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	Sastasha Injector v1.7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 000000000200000001000000ffffffff	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Sastasha Injector v1.7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Sastasha Injector v1.7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Sastasha Injector v1.7.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3008	chrome.exe
3008	chrome.exe
1576	Sastasha Injector v1.7.exe
1576	Sastasha Injector v1.7.exe
1576	Sastasha Injector v1.7.exe
1576	Sastasha Injector v1.7.exe
1576	Sastasha Injector v1.7.exe
1576	Sastasha Injector v1.7.exe
1576	Sastasha Injector v1.7.exe
1576	Sastasha Injector v1.7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1576	Sastasha Injector v1.7.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe
Token: SeShutdownPrivilege	3304	chrome.exe
Token: SeCreatePagefilePrivilege	3304	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe
3304	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1576	Sastasha Injector v1.7.exe
1576	Sastasha Injector v1.7.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 4240	3304	chrome.exe	95
PID 3304 wrote to memory of 3124	3304	chrome.exe	96
PID 3304 wrote to memory of 3124	3304	chrome.exe	96
PID 3304 wrote to memory of 4188	3304	chrome.exe	97
PID 3304 wrote to memory of 3168	3304	chrome.exe	99
PID 3304 wrote to memory of 3168	3304	chrome.exe	99
PID 3304 wrote to memory of 3308	3304	chrome.exe	100
PID 3304 wrote to memory of 3308	3304	chrome.exe	100
PID 3304 wrote to memory of 720	3304	chrome.exe	101
PID 3304 wrote to memory of 720	3304	chrome.exe	101
PID 3304 wrote to memory of 516	3304	chrome.exe	102
PID 3304 wrote to memory of 516	3304	chrome.exe	102
PID 3304 wrote to memory of 1448	3304	chrome.exe	104
PID 3304 wrote to memory of 1448	3304	chrome.exe	104
PID 3304 wrote to memory of 4228	3304	chrome.exe	106
PID 3304 wrote to memory of 3856	3304	chrome.exe	108
PID 3304 wrote to memory of 3856	3304	chrome.exe	108
PID 3304 wrote to memory of 1564	3304	chrome.exe	111
PID 3304 wrote to memory of 2856	3304	chrome.exe	112
PID 3304 wrote to memory of 4044	3304	chrome.exe	113
PID 3304 wrote to memory of 3508	3304	chrome.exe	114
PID 3304 wrote to memory of 3508	3304	chrome.exe	114
PID 3304 wrote to memory of 2556	3304	chrome.exe	116
PID 3304 wrote to memory of 2500	3304	chrome.exe	115
PID 3304 wrote to memory of 2500	3304	chrome.exe	115
PID 3304 wrote to memory of 3424	3304	chrome.exe	117
PID 3304 wrote to memory of 3424	3304	chrome.exe	117
PID 3304 wrote to memory of 4824	3304	chrome.exe	118
PID 3304 wrote to memory of 4824	3304	chrome.exe	118
PID 3304 wrote to memory of 4256	3304	chrome.exe	119
PID 3304 wrote to memory of 4256	3304	chrome.exe	119
PID 3304 wrote to memory of 1048	3304	chrome.exe	120
PID 3304 wrote to memory of 1048	3304	chrome.exe	120
PID 3304 wrote to memory of 4960	3304	chrome.exe	121
PID 3304 wrote to memory of 4960	3304	chrome.exe	121
PID 3304 wrote to memory of 4416	3304	chrome.exe	122
PID 3304 wrote to memory of 4416	3304	chrome.exe	122
PID 3304 wrote to memory of 1960	3304	chrome.exe	123
PID 3304 wrote to memory of 1960	3304	chrome.exe	123
PID 3304 wrote to memory of 5084	3304	chrome.exe	126
PID 3304 wrote to memory of 5084	3304	chrome.exe	126
PID 3304 wrote to memory of 3780	3304	chrome.exe	127
PID 3304 wrote to memory of 3780	3304	chrome.exe	127
PID 3304 wrote to memory of 1252	3304	chrome.exe	128
PID 3304 wrote to memory of 1252	3304	chrome.exe	128
PID 3304 wrote to memory of 4656	3304	chrome.exe	129
PID 3304 wrote to memory of 2276	3304	chrome.exe	130
PID 3304 wrote to memory of 2276	3304	chrome.exe	130
PID 3304 wrote to memory of 3008	3304	chrome.exe	131
PID 3304 wrote to memory of 380	3304	chrome.exe	132
PID 3304 wrote to memory of 380	3304	chrome.exe	132
PID 3304 wrote to memory of 4944	3304	chrome.exe	133
PID 3304 wrote to memory of 4944	3304	chrome.exe	133
PID 3304 wrote to memory of 3160	3304	chrome.exe	134

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Nature.dll,#1
1⤵
PID:332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffea2d6c728,0x7ffea2d6c734,0x7ffea2d6c740
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,8027452437606505481,2954898134580132625,262144 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,18183431972777383391,10073163822064682801,524288 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,7148610246576962324,4120773019409646486,524288 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,7190800161170606807,10598692687536161109,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,3391605316215422054,13404848526259400955,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4516,i,6813615182547301826,4580214521849907083,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4524 /prefetch:2
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4808,i,3153782229654627249,9968638730553912483,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,7954531627826599024,6647797514764978427,524288 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5600,i,10058372458170652697,14558483183977982347,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,7723176646644296272,15124077031308134024,524288 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3420,i,1690530071039699242,18055023445209302480,524288 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3384,i,18010386843069177968,10181231268857136997,524288 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5664,i,3000807510560010953,2483355411592118949,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3324,i,9832877387727782472,18033386439568847519,524288 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3520,i,1581145004972164103,11546276038875032299,524288 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6080,i,17950370110205887813,16746986296403802143,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5888,i,1732098695963376759,437591149572271675,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3476,i,2383921042102989846,14340577053783750520,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6340,i,7300427021012940443,6324269436086048910,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6748,i,12016274801961690301,8006245212178021939,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6940,i,13237213925719108852,14224992682667429335,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6648,i,18228238868652524667,10944907598919889669,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6500,i,3279982190888051915,2725042625360124804,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5488,i,12137853539043908981,13982727577003932939,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7216,i,701423451920993823,11413295363390967006,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6496,i,18223628320395584291,18441058047244739988,524288 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7572,i,14038359899685895338,11326505822653609029,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7716,i,9164290599649185348,9020311646012931589,262144 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7724,i,6619172004733430039,11510153649904724885,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6872,i,12134652825454421885,12102342232227989127,2097152 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6692,i,13567471307703369446,9986382462096627474,524288 --field-trial-handle=1844,i,10449336439784001180,18284133745755861481,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7712 /prefetch:8
  2⤵
  PID:3160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4204

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Sastasha-Injector-v1.7\Sastasha Injector v1.7\imgui.ini
1⤵
PID:4700

C:\Users\Admin\Downloads\Sastasha-Injector-v1.7\Sastasha Injector v1.7\Sastasha Injector v1.7.exe
"C:\Users\Admin\Downloads\Sastasha-Injector-v1.7\Sastasha Injector v1.7\Sastasha Injector v1.7.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24845324-4311-490e-a32f-d16ab53844b3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\24845324-4311-490e-a32f-d16ab53844b3.tmp
Size 270KB
SHA256 182a61fa48c4278fda7be7f7cc1ece34023e82f24ae3aa44cbba50b278417c7c
MD5 49bd2f72e557206e535291c518298b10
SHA1 cfe088702a7ce5f6b02f18a7bc97ddd428e3ddd7
SHA512 0c1911f68af4e90ea4bf783f14e1273aa3fc2983c0f775501bf28726864130b08ca127578a59c1905c87666e5d3e7003502387110d305c59dfe29213ee2fd4c0
SSDEEP 6144:a+HhYbFusKYrxbyvK3uWEPi+hFD+7t56OD9ZfSAppr8j:RbsKcbyvyIiyFSXD9ZfS4+j
TLSH
T12444123A7610BC77C7FA9701E0073705CE7A9AD981C9846881496ECBE19F95D0BF3DA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bf35d37-89d4-4964-848e-ae770f858ac3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5bf35d37-89d4-4964-848e-ae770f858ac3.tmp
Size 130KB
SHA256 a8a347628678073f5579f606b3cd9e94a891ff17030e3dad93e68ef0fe7cdc17
MD5 06e49257e9e7b0ffb9caf06adb78d0a9
SHA1 609fc4dcaf6cf1253c189b617a2ba410f988dcd6
SHA512 057f8b8427bba278ec3429f1379f58316b45306d12d67da04ea756784eb34152d130a0f41e450bb29f0c95ab0315cc1d2e746c02ac69047606ca1168ebf48730
SSDEEP 3072:v+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:v+hFD+7t56OD9ZfSAppry
TLSH
T1DBD31232AA91D8BBC9BC6541B157A304DE666CED41EE7A09444A5FCEE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

705d2652-a8e6-42af-a476-38f8f09b4e8d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\705d2652-a8e6-42af-a476-38f8f09b4e8d.tmp
Size 269KB
SHA256 2dde6f81b50763c66d738b814e524654b699da741fba7a0042ee8ea8b2d2c92c
MD5 086b3f06ff04792d538b10e5fcacf9bf
SHA1 a1601a519984ef09401ec766ab5316f2034ad1fc
SHA512 aecf155815015c266a17c8055439f503b4386c0be3211b62cc6448a367433785b9583fd3083adc6589f076895fe4a85bcb651475ac38351dbad06f26a6ac7c36
SSDEEP 6144:vHhYbFusKYrxbyvK3uWEPi+hFD+7t56OD9ZfSAppr8j:vbsKcbyvyIiyFSXD9ZfS4+j
TLSH
T1EA442226B250BC77C7FA9701E0077B06CE7A99D881CA446442456ECBE19F95E0BF3DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f2bf5bc-5cad-4d89-84ba-d2985be736ab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0f2bf5bc-5cad-4d89-84ba-d2985be736ab.tmp
Size 13KB
SHA256 245171eb29e6a4763195b5858714d99d6c316bc00459f45c17da428bd5b04008
MD5 ba14c6cda8e8fbd45b6bf89df71042db
SHA1 2e4b5652c062db5cade922c37bdb899f0bae4c8c
SHA512 076434cb0cda00a89a36a70d95480dda007424f161fbfa02e35c221aae56fde5fd7d4973c381f3c85118e669fd484c0b65dd762ad9cb1d0803f078216ff29c7f
SSDEEP 192:SRDccBzZzr/qeilyv7i0shAPRp2kqXx9+Hsb+WNFxOovlue+aKeDkHEes2adira3:SRDcmzZfueuj8XaUwmo9eeAHm2S4aSe
TLSH
T15452B42AAD20797B5CEBC329FA267757E3F5102520942E80EAFC893C15D7ADC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ab0adf3-72f9-42ca-869d-dcff645a6c70.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2ab0adf3-72f9-42ca-869d-dcff645a6c70.tmp
Size 13KB
SHA256 c80cc556c872c7182a3d88d1678dfdb7a67225cff125c8a55239039dba19ba49
MD5 d9ab3367b590f08d58ef97a9d53ee2dd
SHA1 7e7fda2a12cbc16a597f0c8b9c6659e4f58216f6
SHA512 659294013c0dfbe843a96de0154d9c9e7ff20722ec3ef61fac28272dec22ba1a556fa003e03880a36a265642da055b57a9b5e97b3f5095d087154bcc36050c3e
SSDEEP 192:SRDccBzZzr/qeilKv7i0shAPRp2kqXx9+Hsb+WNFxOov4aKezkHEes2adiraSVyr:SRDcmzZfuGuj8XaUwmocewHm2S4aSe
TLSH
T10E52B52EAD20793B5CEBC329F9267757E7F5102520942E84EAFC893C15D7ADC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a70d43f-30dc-4d8c-8e5d-f1154c172173.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5a70d43f-30dc-4d8c-8e5d-f1154c172173.tmp
Size 17KB
SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
MD5 f47488285ba0b5fb4fc947c0cd4d65d0
SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
TLSH
T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60405678-b0ae-444d-b39f-7815d11e3945.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60405678-b0ae-444d-b39f-7815d11e3945.tmp
Size 14KB
SHA256 993ee5c168bdedbebbb8349e5c260b2d74545e5553bbcaac4e5358a062e148dd
MD5 f05b0d95a15f128f1227163c81bac8e7
SHA1 8a9758b57f40d3d236244c372c63978a986ec8b4
SHA512 2d39be40b89cf24c2a5740ef00ea141c9ac1a8e6c99ae6a17e0ea11c155462145472de290138d75ad6175448b8970cd590ab53dea1795a143a79d3336d1f1057
SSDEEP 192:SRDccBzJzr/qeilwv7i0sh2PRpMkqXA9+Hsb+WNFxOovl/sc/aKe9kHEes2adirG:SRDcmzJfusujmXlUwmoSkeiHm2S4aOe
TLSH
T19762B52AA810793B5CEBC329F9267B67E7F5202520D42D84E6FC893C15D7ADC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

691e25af-d564-4122-831e-6a6d1b30a3b1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\691e25af-d564-4122-831e-6a6d1b30a3b1.tmp
Size 13KB
SHA256 c1993cd2730150fc033fa1f9b47c7fe0b080ac42e12d34d67ca44adf39061563
MD5 6be9c328fb871f3b9563fc03c3838a22
SHA1 122172a6973f06462f1ecf13389d66fb469648db
SHA512 bb89c5a46ee29285a022c989e499dccaed0e089e25746dc429589a3db5183dd323b73874e39bf97cfb55bdb4a02d997b9e9820723594cfe11eb44be15c199185
SSDEEP 192:SRDccBzZzr/qeilJv7D0shAPRp2kqL9+Hsb+WNnOov4MQ2GkHEes2adirawVyIsH:SRDcmzZfuJvj8XKUwOog2PHm2S4a08
TLSH
T14852B52EAD10753B5CDBC329F9267757E7F5102520942E84EAFC8A3C15D7ADC222742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 23KB
SHA256 2189adb857ece9719580dacedeaa2a98369f932831fc8e115372348546dc88bb
MD5 a3c3e499fa22844d03d7bdb7c37fd6b5
SHA1 cfe7674c199f559d53a693dfb936e02e5662ecde
SHA512 2ef01323749093dea90820ec6c539869b507e20553366c920c551ab1520f630212881808a76121a970cb9564aa8be9ac469498711ed1bf2faa5c7409e734bdf5
SSDEEP 384:GbGrQWgTJFHD4Nl9zaoz9qF2v2tGodYcf2Q9SQfkbMzOFLDu/XPe+4ujgb:GqrQWQJ8l9zakqF2Zo3EQcwsDu/2+fjI
TLSH
T1AAB2D02D8B760E59D6394BEB98B71CE38E61FD906F28740F16430EC74CCA1686C0F551
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 74KB
SHA256 70e4d628843c8aa128f28b04653deba8bc351b4b868d4d6e9ada67a3e2cfb400
MD5 5c1cb34c1dd3766326afedfbef9f4aab
SHA1 da51bf4e974c86eddbca6e3b7e07967b21a08367
SHA512 a42ca1fe34d594fa550c9f806022d3c3674a7f03ccf0359b1bf623883b807fad668fdb2a05e89e4335a98a88bb94a8f9b47423e22f2bc9d882899ed6ff26de5c
SSDEEP 1536:sl9xog1rbd61Os/oqNREWWFkSXI0SlxUbW8uIl/7SpLP/v9:s5Fp6l/RvWFkSu/d7Il8Pd
TLSH
T1DB730260BEEE2E1A9C337F0F5D94C9852562FE9B60CF16EC4FE44D98D15C1E682402A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 17KB
SHA256 334fffb50b8d73898b8f7316a1995e85a4c88ef68b926309345623652237bcd1
MD5 4a0854f6e0405689c195c19451966a72
SHA1 63d9274c97b4e7499c31e914c31642fcbebce1c5
SHA512 79e8f279fb4cac00b06b87f47abf5dd0bf32b6b3d1592ca43ea5334783f11701d95276156348fc345465cf46a36fd02f7e9cb863d4b5f349896208ddaaf17af8
SSDEEP 384:jEU9czoqCwflMd3VX1qp7PBuKvGtvLwQE92o9h4LNDEnQYV4Rg:jlqKwGdjqp7PIqoDwpqNDw7J
TLSH
T1CE82C16F3893F412306E55118CC21E9AE34D947C5C71DAA6CAD98398FC7B43293DB0AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044
Size 62KB
SHA256 f65d41ac0d99c9c1b85e9445de69c41149e9e970a14abc8c95fa4c4b994a6028
MD5 267d4881c6e6aa63f87b6f0266045e35
SHA1 ddbe1298f922b1c3a6db418adb8309c99ff8dbb4
SHA512 753a77c2f508394622c1ad29242c997d6f86eb8a8df4e3b4608c7e0d5fe8782009048e033c550067d15b56c40f8bc666dc759d55ef42f9eed25c5d4a8495843e
SSDEEP 1536:f55Wl47gYh6T5CQfsAfUjY+kf/0VfVuumCynbeA:f5csjhzysIPrfcV4usKA
TLSH
T1885302FE4774084ABB5C0F542956B55E5C25D73EA2BB71E2C4413EF67E4A1E0B081293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000045

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000045
Size 27KB
SHA256 086b49ab926e11b266a8b9a9b757bfea456480924564bbc1a33f34b826766bd7
MD5 e57cda44d47e95b002f94198932aafa0
SHA1 e6a8f713c9dec720ec5bb6660d92f4fadc14191d
SHA512 6d1f3cc34dc863f4a02efec673d811cd5d6586629d15615ff68c167280e966e7a17709391d5db3e4f69cfad5e7ceec3890234463c4098b282042f1ba8c69205f
SSDEEP 768:Opx/MamUiqIqzW7I8hLxOKr+XD0zg8PA0TLkn3Mft:OLUamRqpW7I8DIk7TLEcl
TLSH
T1F9C2F1C957942F187E94F827C1CA25FD9C329652EB60CC22F1B48D4C262EB21E5DFD4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000051
Size 26KB
SHA256 e73c0b4119b946d97e900bf2c467c4b221e9530d55b085794ed037311208d13c
MD5 8c2f937f66ce1b854ee39c5e839fc158
SHA1 10a7ba6ea5791efcf13d5db204f90547c5d8b44c
SHA512 6444795746da289e299b24d6ada89c6f66d8a54fb4e7fb5c2c5720c992beeb0d6332a8453e250793c67fa5121ffb9fce594a1aaa8ec34eb3967252a1d81e2a02
SSDEEP 768:m2wg8VazwDxp+dJ6NFYfSmu/eWyZs0u562aMxO+scYKtg:m2wg8gzwNsT6NF6vu/eRZjA6UscYK2
TLSH
T19FC2E0A6A3814A17EF382BE4F5179513AB1303B627AFE1765FC4083D1CE880E05A5B9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000052
Size 17KB
SHA256 f38d6dff8ed8e9c879a81ad280394d9ba22c226f5e6d14556744c93b8aaa1359
MD5 f2e9f457b0d113b900f8c018db41b437
SHA1 7ae8af5e38a91b2e4aeb96c1dadc97d10a98185b
SHA512 e7608cf3aeeb688d3c0588d22117f4b9d31e5685091674b0a30b786fc0d2ed4211f9713408dd3784584753c852c39ed818624c184e1f332edddcc8877e5e1f67
SSDEEP 192:3gzZ/9sPHHmS20thj2b1bgvFsAXtcREfWSI/Hop7i9gA7vrZcQ6u8p60UGPOX:KnUHHjbjybgCq+Up29gA7vrZcQ6u8pmX
TLSH
T12E82CFCD8D04B427B0467AD720E49C2C12854834EF27DD5E8DAADBE88E91DDE8C4975F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000055
Size 16KB
SHA256 6b6976af53db42832918dc1bab384fb53af830124fcb8021a3924c8710097f89
MD5 1db5509087434ed9eea4ff430ffe96fb
SHA1 32fa9c910343f1829a7631bf5f6059e1fb495e01
SHA512 de1f761c79ed247ce41dc1ca9f16efb114253a957edaba4b001d6e7a921ef452ac0b1dfe4b8a3eaff1aa39f89c70c7061987075a24f3a31d6a021d7eed6f0ba8
SSDEEP 384:HSXS85ZK9PnBFs1Uw4uBYW6Z3JREBfT1wlroVI:yXlq9PBFsGwlKWwEpTyiI
TLSH
T1E472D05AD339236098C47481F17D2884924BFA0CEFE9A06E5C209BCBD5A2BFB1525233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd4e9f8d3c311f3a_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\dd4e9f8d3c311f3a_0
Size 263B
SHA256 116bd55a59d30cecd61a83655481ebb08a0ef4b132e2ae4faa43b5fdd5e32728
MD5 e276f5e03f19cf4990750212ec791fe4
SHA1 b131b024574c23b27cbb2005012113ea106e6b0f
SHA512 f0fc29470385446d1fe8069d2a9851f3a39971b249831550eb8954eaef51f22b3ee62b5270aefbdcd7ba539f64049e325c8291bf2665013cdc8a516e64cd0067
TLSH
T1CBD05EAF92A02840D87E81F087EA9706C65750C5487AE096B811A6AA2315BA27289662
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 ef8f60b1d32058d8f6f09e49dcf1f0be37e41797549324054e4c7f018c7bae1a
MD5 1d78808f5d150b182e12733c4cb74106
SHA1 089c37a5eac31f2ccd740aa473d288b45368ffa8
SHA512 45ebbdbe37eae788991a03728f3a3bd9df9a40bf0085a5bf993d01ba87f84f256ca2bce1e5d7b0738a515233130ba24c7572f24e4c534a73936fc5eaacc15a60
TLSH
T16AB0241311403057F71043F044CF044430D44C00C103170141F0D5F0C0533F0F143074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 48f4b6a2b06a003a0e362127cf4c4adc339f8b918bbae673adf5d75e46440027
MD5 ece668dc1a57db0415dce2e8e668aba5
SHA1 39129d92cb8346542e0ef60631d511253fb6e883
SHA512 c6de48fd91de17a784e85757e82d1ecd98d9aa9630f607039fb497c9e6ca313eab8765a27070c4a118b3ec7880beeb18807eef4543c6a507b821c3c0ef9bcb06
SSDEEP 48:yjbeQsrx5wTOHd4craNjep0mBn9jc7wj/Nl0uUqZ5UDvRDqDN3t2Vk:yjcrXu4CjG0o9nj/Nl0YUDvZqB3AVk
TLSH
T1B2912FB11246180EEB01C37156A93E3D79E104AD29274A3F3290FC7859DA7B6CDD03CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c2c8827-3ecd-402c-9c1a-8fe09a82f4c8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0c2c8827-3ecd-402c-9c1a-8fe09a82f4c8.tmp
Size 19KB
SHA256 ffc237ac18710bb9aa5339e5e5eac05b0e64c05751a982dfc192d4f57db05d82
MD5 5027b7dcddb7f6b6a4a2ebdc9f4b1fc8
SHA1 84f4900565057b31ece4aa70b8afe08f2dadace5
SHA512 c112c2ab42ceb2b6f4f124ad560114d25229d84f51bf5e6f6160c71fefabb08f5785f46807fdde5460595a6199ab40e66b0ec4149ff744017e0f9c3deae83d9a
SSDEEP 384:D6SXJfosQJXJJ/+PJyT9dseigmBem2J6JE7aaNqhWInsN+9axXfBIENwI7Ihgtj1:YtQxEgcBaUT05N3i1eC73QD6
TLSH
T17C92ABF7C3E8863DE81161F96A256E2ECD291924032C3C368AD99F0B93F5572D24674F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec3b400b-9b06-448b-8246-b37695c4f3a5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ec3b400b-9b06-448b-8246-b37695c4f3a5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 d52eee6181b46b6d7f917a2d734c0102dfc46dcc2d196e72624f06bee3519a98
MD5 b2dae58fecd6baf67a1beb7d8d7e71a4
SHA1 c8869923a8a0948592139f8999239a13176e7dab
SHA512 886c9071f64c6d8154f54303205a3cbfd0ed8df3d20e91cabb429d4aededa8835d6e5e04c5139618ff94d44ba72f5245a0ff381c9de2092b1075ffd9c8463b08
TLSH
T1B2B0120685452B01C00103702150A0743260CF38D122639681E00D12E8391604027118
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 74fcd1ada2f0910af177ef2c05cc5dab390a466dd23d0cbf209b15837efece68
MD5 d09f79c6e8977784f2dea08abfe80800
SHA1 a8affb6072ad619ad9ef2739ecca573d752ec485
SHA512 7fe294305f4cd2bc057add300b5ce3544550f446967922b4776a6f095d6419c8448d4a65a713a9b1871d565ae41313872f0ad85e29237a208322273bc466fe33
TLSH
T18BB00255C1066362C05303F9379999D8F1A0DF69C617131297E01BB6FE656714525170
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 afaba3afe0e7a630f3f2ed651af56548c0d6b1b6373e50f9e96ccd1c5135b369
MD5 956827fb5ba53e58009c7921dd3eb898
SHA1 5502bdbc32a2ba1095bce0fd514b5c6a17ab7f52
SHA512 4746a75830c4b8e36b47da75d64b033cfd7b26699e5e58b550f5429cbc8241ee76fd158f21845b0b17bf05da2af4bf89c852c52e37f3058ba788361fca122e60
TLSH
T174B022E0A2003802EC800B3082F000C833322E3C0303320B00F0823CC203B83838FAC0
MD5 SHA1 SHA512 TLSH

Submit Download

bd7f1eec-ac73-4708-b826-183320b9c479.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bd7f1eec-ac73-4708-b826-183320b9c479.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c776ef41-9efb-4081-a016-f0c6a890c145.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c776ef41-9efb-4081-a016-f0c6a890c145.tmp
Size 414B
SHA256 3767bb495b4af56ae489d4d8bd15868c0d2c89e4382ae23aef15ec6e3effdc62
MD5 e3596eae145ddc40a2b550ded07c5bb7
SHA1 1ec35aea97bcf94b700978e2b712f0ecfec60d4e
SHA512 f41cd9651c5f9321d8f4dd952375bce169280ef71a6412aee51098479596e452b7e0b520f16042c3031c85e7a754233ea943b3f3c3cc1ab3f9e3948387ce2b7a
TLSH
T1D9E022EDCC20FC3B18FD4B6961140749E74013572681894F3A3DA02D8FB0A3B86869AC
MD5 SHA1 SHA512 TLSH

Submit Download

ce6c48d0-bd02-4e42-9766-9fac96364ae6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ce6c48d0-bd02-4e42-9766-9fac96364ae6.tmp
Size 14KB
SHA256 68641222bf8ba69397afd9592abd9c105bcf04de662d1369f00b972a6ab0683e
MD5 57c7b1a1fdcd23bc6bfabba07b578bc0
SHA1 51919b3d2d7f8be125f649f57d9e5d2a1a65dd0a
SHA512 2660b8449f894e0d082df28d227034f6161b59a3260d901e4397ff6c28aaf0d8cbb20da39a6f7b2616e08c6ba3646f134fede33f8753261d8b9b74f390970398
SSDEEP 192:SRDccBzwzr/qeil3v7i0sh2PRpMkqXN9+Hsb+WNc1xOovlIkeaKeKkHEes2adirG:SRDcmzwfufujmXEUwhoN+ejHm2S4aOe
TLSH
T13862B52EA820797B5CEBC32AF9267B57E7F5102510D42D84EAFC893C15D7ADC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4436095-0b42-4a40-8474-899586ad43dd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d4436095-0b42-4a40-8474-899586ad43dd.tmp
Size 14KB
SHA256 0d866f2357924197ea235567e2c1522deadc83ec129d2971a5b8cb2521c9dd6a
MD5 65f49b42d95a1301b93398c4db894e80
SHA1 248497d445c9911a72c6129e5e35fce284d9a9cb
SHA512 6b0051764e03aebcc0b03fedac07b0bb45d9ce7149d89a4248162bf74a6ccae2f0131cd4ce3c28908af91204180d6bf4dde3be58bfeffe9c836b1d2d61ef80c2
SSDEEP 192:SRDccBzJzr/qeilyv7i0sh2PRpMkqXA9+Hsb+WNFxOovlypMaKe0kHEes2adirab:SRDcmzJfueujmXlUwmo2Qe9Hm2S4aOe
TLSH
T19262B52AAD10793B9CEBC329F9267B67E7F5202520D42D84E6FC893C15D7ADC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0c37663-034c-4dec-a694-a450557facfc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b0c37663-034c-4dec-a694-a450557facfc.tmp
Size 268KB
SHA256 0c67a0d714ea3afbcc0f3d878b54ac55719fbc2e96a696066c5eef78bcea83a1
MD5 57d1241ce438136be0773a86bbbdbae6
SHA1 63735009b01923efa0243d69b6ee4489e14d299e
SHA512 2db27e5bf61b92c5e149b028bad94aeed5b724e2ceb862c5e23733a325c8689e84d8edacd5c31de5314d7e380eaf0e4a01f7ec76d07b9fd35c44f754968fa3bc
SSDEEP 6144:dHhYbFusKYrxbyvK3uWEPi+hFD+7t56OD9ZfSAppr8j:dbsKcbyvyIiyFSXD9ZfS4+j
TLSH
T1A0442326B210BC7BC7FA9701E0077B05CE7A9DD881CA406542456ECBA19F95E0BF3DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9fba3c7-c9ad-4146-a0ce-a082675e8549.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f9fba3c7-c9ad-4146-a0ce-a082675e8549.tmp
Size 269KB
SHA256 276bc93ef64a6304739470a6195d639a2b485bc2e4f7310c021a2b2c0c7b2ba8
MD5 3d7e1f9ef77d49a1a182e64c0077990a
SHA1 dcd9c8dfc26876a0783b570d249627c20d4919d6
SHA512 f68ef1c7bad7c6a70f871f53b02bf824de43cffc7c14399014b3f7fea179db602bcfe5f3d610c3f29d85cdff2ae6b05a777a7d23a68ea2fbb02ed6d4d8e1e6c7
SSDEEP 6144:KHhYbFusKYrxbyvK3uWEPi+hFD+7t56OD9ZfSAppr8j:KbsKcbyvyIiyFSXD9ZfS4+j
TLSH
T159442326B250BC77C7FA9701E0077B06CE7A99D881CA446442456ECBE19F95E0BF3DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nature.dll

Path C:\Users\Admin\Downloads\Nature.dll
Size 15.8MB
SHA256 1cb9e9aecbab5dea524e30673b8fdea7679a2e5a2ac2ab4e941a6bc5dd942008
MD5 970422c6ada34518b5621607c40d3b16
SHA1 072ae7a9bdd57b13b0b1845e95b97ea557c0d339
SHA512 fb83c5098f73ce48b14300cc6dfcc7ca4facb18255b7e6c7f668429832f40d270549b8e9e75e6c19d82a140636a0e56f1f1de862555a105407105796db1da115
SSDEEP 196608:UTDAnytwViyc7iEp2yRSAVjEiaqXFSHuEicF1x1K2hO9qEs7BOsfEMRF6+i8Ihun:UTDAnytlE91thPhREMRFTIhuWo
TLSH
T107F6AD836219388BC061A7BC4403927DF19EF80D9B55C7F79AD7FC2A99E71811E11FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sastasha-Injector-v1.7.zip.crdownload

Path C:\Users\Admin\Downloads\Sastasha-Injector-v1.7.zip.crdownload
Size 445KB
SHA256 ee07db94a179993d352c1569c678cbd8737f16d9bd45d361e49d4003acd9132e
MD5 727352b6e3e06decd71ccdfff61ab927
SHA1 39db0ea05d790c7461cde6d907dce3b6e801ec70
SHA512 23c94cf8e0dcdc8a4d685d3bd66d3c19ba6a29a5628f7451ca8c134315ae1187a6103f659d9ab1dc1c77161dbe6a38bb364b351b53ad4779a3a43827d8ec4013
SSDEEP 12288:C6jlTIgQsMDikkk6SrzWHGkU7oU05pB3sJvqOcni:C6jlTTQnVkZfHGN7oU0P0vbci
TLSH
T154A423EA0DDE8FC32B2B113A3715538281BB4098BA7FBD7789824CB5961DD79F01069C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7153edf-017b-4834-822a-673150d5605d.tmp

Path C:\Users\Admin\Downloads\d7153edf-017b-4834-822a-673150d5605d.tmp
Size 31KB
SHA256 935fc01ee53a582dcac3b710ef56f994aa7c97918971ee2a2f071bf7c30ba5ab
MD5 e13c8e13091b364c2a73bc2020767678
SHA1 c501d661a899d7b0de4e2405fc6423916bd98a81
SHA512 0bf9da676642d2b4a6cfd226b4a30ab3d10a2d45c89f5cddf0f5a81d9349c7fd9bc5285423a290e87fda6d25f421698888c51bf5472f9756749b5250a0b2eb36
SSDEEP 768:dV+trlqzErcCFs2GGLFIZZzy+LjooQ/UfDFJaaUA1:+trwGLFIDzj4p/sBOA1
TLSH
T132E2E1E01CDDCB11BF828EF2A65D655FDC2742056B633D6A4BE104E465BEC8C7A8C44C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download