hxxps://buzzheavier[.]com/lgskjpj2sktp

Analysis

user interaction
yes
max time kernel
266s
max time network
840s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/10/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://buzzheavier.com/lgskjpj2sktp
Sample261030-ltppvsys4q

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	autoplay.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	autoplay.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2964	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
4372	chrome.exe
4372	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
4372	chrome.exe
4372	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
4372	chrome.exe
4372	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
4372	chrome.exe
4372	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
4372	chrome.exe
4372	chrome.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe
Token: SeShutdownPrivilege	3480	chrome.exe
Token: SeCreatePagefilePrivilege	3480	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe
3480	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 1128	3480	chrome.exe	84
PID 3480 wrote to memory of 1376	3480	chrome.exe	85
PID 3480 wrote to memory of 1376	3480	chrome.exe	85
PID 3480 wrote to memory of 2964	3480	chrome.exe	86
PID 3480 wrote to memory of 1264	3480	chrome.exe	87
PID 3480 wrote to memory of 1264	3480	chrome.exe	87
PID 3480 wrote to memory of 4612	3480	chrome.exe	89
PID 3480 wrote to memory of 4580	3480	chrome.exe	90
PID 3480 wrote to memory of 4612	3480	chrome.exe	89
PID 3480 wrote to memory of 4580	3480	chrome.exe	90
PID 3480 wrote to memory of 5008	3480	chrome.exe	91
PID 3480 wrote to memory of 5008	3480	chrome.exe	91
PID 3480 wrote to memory of 4308	3480	chrome.exe	92
PID 3480 wrote to memory of 4308	3480	chrome.exe	92
PID 3480 wrote to memory of 4340	3480	chrome.exe	93
PID 3480 wrote to memory of 4340	3480	chrome.exe	93
PID 3480 wrote to memory of 2456	3480	chrome.exe	96
PID 3480 wrote to memory of 648	3480	chrome.exe	101
PID 3480 wrote to memory of 648	3480	chrome.exe	101
PID 3480 wrote to memory of 4440	3480	chrome.exe	103
PID 3480 wrote to memory of 4440	3480	chrome.exe	103
PID 3480 wrote to memory of 1868	3480	chrome.exe	105
PID 3480 wrote to memory of 1868	3480	chrome.exe	105
PID 3480 wrote to memory of 2012	3480	chrome.exe	107
PID 3480 wrote to memory of 2672	3480	chrome.exe	108
PID 3480 wrote to memory of 1636	3480	chrome.exe	109
PID 3480 wrote to memory of 4372	3480	chrome.exe	110
PID 3480 wrote to memory of 3692	3480	chrome.exe	111
PID 3480 wrote to memory of 3692	3480	chrome.exe	111
PID 3480 wrote to memory of 2112	3480	chrome.exe	112
PID 3268 wrote to memory of 1748	3268	autoplay.exe	120
PID 3480 wrote to memory of 1128	3480	chrome.exe	84
PID 3480 wrote to memory of 1376	3480	chrome.exe	85
PID 3480 wrote to memory of 1376	3480	chrome.exe	85
PID 3480 wrote to memory of 2964	3480	chrome.exe	86
PID 3480 wrote to memory of 1264	3480	chrome.exe	87
PID 3480 wrote to memory of 1264	3480	chrome.exe	87
PID 3480 wrote to memory of 4612	3480	chrome.exe	89
PID 3480 wrote to memory of 4580	3480	chrome.exe	90
PID 3480 wrote to memory of 4612	3480	chrome.exe	89
PID 3480 wrote to memory of 4580	3480	chrome.exe	90
PID 3480 wrote to memory of 5008	3480	chrome.exe	91
PID 3480 wrote to memory of 5008	3480	chrome.exe	91
PID 3480 wrote to memory of 4308	3480	chrome.exe	92
PID 3480 wrote to memory of 4308	3480	chrome.exe	92
PID 3480 wrote to memory of 4340	3480	chrome.exe	93
PID 3480 wrote to memory of 4340	3480	chrome.exe	93
PID 3480 wrote to memory of 2456	3480	chrome.exe	96
PID 3480 wrote to memory of 648	3480	chrome.exe	101
PID 3480 wrote to memory of 648	3480	chrome.exe	101
PID 3480 wrote to memory of 4440	3480	chrome.exe	103
PID 3480 wrote to memory of 4440	3480	chrome.exe	103
PID 3480 wrote to memory of 1868	3480	chrome.exe	105
PID 3480 wrote to memory of 1868	3480	chrome.exe	105
PID 3480 wrote to memory of 2012	3480	chrome.exe	107
PID 3480 wrote to memory of 2672	3480	chrome.exe	108
PID 3480 wrote to memory of 1636	3480	chrome.exe	109
PID 3480 wrote to memory of 4372	3480	chrome.exe	110
PID 3480 wrote to memory of 3692	3480	chrome.exe	111
PID 3480 wrote to memory of 3692	3480	chrome.exe	111
PID 3480 wrote to memory of 2112	3480	chrome.exe	112
PID 3268 wrote to memory of 1748	3268	autoplay.exe	120
PID 3480 wrote to memory of 1128	3480	chrome.exe	84
PID 3480 wrote to memory of 1376	3480	chrome.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://buzzheavier.com/lgskjpj2sktp
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff815fcc728,0x7ff815fcc734,0x7ff815fcc740
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,13288794592488570666,6928560443005520336,262144 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,6393333599669932367,10187489968832787026,524288 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,2067183285348206670,10391182355357961743,524288 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,594328919799292713,7354270161126698189,2097152 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,18210126384324368658,4381843230634848107,2097152 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4584,i,12144595112855871857,12634370238114075644,2097152 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3296,i,7124154895209051116,3913344262240939435,2097152 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4720,i,8312073918948802487,3022342971742648295,2097152 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,16136389075740198465,10871740575487005254,524288 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5812,i,12917792174485489535,9311146120433355803,2097152 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3976,i,8469956977413296594,14068367706476187184,2097152 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5972,i,1346976830237480929,6809764519856115667,2097152 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6272,i,3904829013627733840,18258372729497297979,524288 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3232 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,8194622170719487147,3525529058126771995,524288 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6184,i,15581121945237678228,6297780637984898228,524288 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6340,i,14346855192633798750,1575041294202308987,262144 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,16310353840154929286,1061338589266775376,524288 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1532 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,14976663934745297605,14617286972390876435,524288 --field-trial-handle=2012,i,14704762527251193867,14910753613030074659,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:2112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1044

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\After.Effects.CC.2018\" -spe -an -ai#7zMap14735:104:7zEvent14130
1⤵
PID:816

\??\D:\autoplay.exe
"D:\autoplay.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268
- \??\D:\Adobe CC 2018\packages\setup.exe
  "D:\Adobe CC 2018\packages\setup.exe"
  2⤵
  PID:1748
- - \??\D:\Adobe CC 2018\packages\setup.exe
    "D:\Adobe CC 2018\packages\setup.exe" -sfxwaitall:0 "NetDisabler.exe" /D
    3⤵
    PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Adobe Temp\NetDisabler.exe
      "C:\Users\Admin\AppData\Local\Temp\Adobe Temp\NetDisabler.exe" /D
      4⤵
      PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

56842622-dc9d-40bc-a221-341dfc22e14b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\56842622-dc9d-40bc-a221-341dfc22e14b.tmp
Size 132KB
SHA256 30e40af812f807a0fac6dc45bd93eee98675095134d07fe56805da563eca28a8
MD5 7ddb78bd37d3dc2ad509cc6f3c063169
SHA1 d9d6a2406bb42b3033ba88bf0e1933b0d2d49fc0
SHA512 f1fcf0e63e991022e09448448299db16f57c256ecae292a7483ea8f82502c97945b95e24446809537b5efa16eec9ad621b2a7cd58ceceb4690da251ea038fae9
SSDEEP 3072:kIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzC:APtbmf1K49XLWbEPi4NTKlLzC
TLSH
T1DBD312213D51BCB4A9DEDB21A1402A16EAF8D84B953D3BE65CDE3F4C06E3699C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e8dc0b6-f64c-416b-bbec-9f3400038bc1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5e8dc0b6-f64c-416b-bbec-9f3400038bc1.tmp
Size 193KB
SHA256 b67406939f811b6dbe9d38006c754099493d8648b245fb952a528116eee9c84d
MD5 47ecf7a869627117baa99ea45255c40c
SHA1 fdd54e6966a9c43be277b4f4ace26d2f1ff76a2b
SHA512 48b08115f808aa0450c7934e61af7aa7a7530043359bb6f311677362bb839cbc6f4904fd0478afa67bdc1e01f0984170477e3065ccba04b343ee503990245a64
SSDEEP 6144:heP7Ez0K4NYnw/3jPtbmf1K49XLWbEPi4NTKlLzC:EzEzp4N8wrofM49s4NTK9m
TLSH
T1D01412207D667DB899EEEF6260506E1AADBDDA0E453D2FA054DF3F8C0167AD8C300852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6858fba7-1420-4e96-b5ac-eaa3050f6d50.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6858fba7-1420-4e96-b5ac-eaa3050f6d50.tmp
Size 131KB
SHA256 da437274dcf8e95337b4f679d0cf68a1f7c8e807ea844a5fa1c14415c3a794e1
MD5 51be5b0a0d6c1e7141fa15694f908a49
SHA1 73a845d41da34b6aab94ae94aa05a4c92c5128f6
SHA512 87f18475d06a7240588c165d1cff9d94549b9505947b9c621795e71ebb2283e7c2fc96824ccf15ce2c219fdda54abbaab2b2008ce9a15f80ee4c15feba36c10e
SSDEEP 3072:wIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzC:MPtbmf1K49XLWbEPi4NTKlLzC
TLSH
T1A4D312213E11BCB4E9EEDB21A1905A15EAF8D94B953D3BE61CDE3F4805A3AD9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96a7d83d-1433-479c-978a-335153c23aa1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\96a7d83d-1433-479c-978a-335153c23aa1.tmp
Size 132KB
SHA256 af0643aea2ef9e25131804d0093117f296e50e7ad6681300c1a780ef672e755d
MD5 b905993236c67d91958342155f814d55
SHA1 160d5b4e104770e7843eab8ee02092d66cdf8823
SHA512 66c8e6a9ffd3593b35bb525322d28f6d3d8f50accfea57c0cb7992c7a8ae4e3b5d3e7cd7d3f160c232c05268e16ad3209e9a681bae526f552b8f78f57fe78e8c
SSDEEP 3072:kIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzC:APtbmf1K49XLWbEPi4NTKlLzC
TLSH
T16AD312213D51BCB4A9DEDB21A1402A16EAF8D84B953D3BE65CDE3F4C06E3699C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 8027d51b149ae3b918e9c80334091909c4c0adb74832c8a5df1ed81fd931c6ba
MD5 05ec53dbb22aded9dce7518535b8e564
SHA1 f9b2b6294a329c53aeef95120e59c904444458b1
SHA512 3ba57cda6967a37934330405850db9ac5fc35b2f22d027e04734f19cd5c04e6752e4ccfcced5cb186ad712fabc5eae3ce7e171454e30111ea2c621b8858f6b61
MD5 SHA1 SHA512

Submit Download

1b1cc5be-fe91-4b46-bdfa-a0e70439ffe2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1b1cc5be-fe91-4b46-bdfa-a0e70439ffe2.tmp
Size 13KB
SHA256 52bd1b2ca3ec17451d88604aa103148156c19454f63a5bc0c729a8b24fb12290
MD5 4f0ad57a39890de33ffce1258bc688b6
SHA1 31fc8fb9dd07d42ea17cf08035f99fa0cc74ec90
SHA512 8567852cab7a37423fcb806d7f4f3a4c09e96c8d9ccc0e8431a780eb7d149aca56da433b71c2b158a34e73c007a0b957ce071bc54ef903fcfb3247c286478e75
SSDEEP 192:JRDauqmAZUv7bTp5PRpUMm/C9RHsb+WNBsxgs4qKtVzivk2w4IhkwoaltVyIsnAI:JRD1WSXTLXdbwV3nP24hIal7E
TLSH
T11C52A72EA964697B9CEBC21BF915BB57E7F5202122901F44FBFC892C24E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40eea0bf-b967-421c-8387-53d055a39df8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\40eea0bf-b967-421c-8387-53d055a39df8.tmp
Size 13KB
SHA256 8cea19575d5d285a9a821b6c5f1cb6a76afad92c83ee965f51e9e44465170e2a
MD5 95a1402221de6efda9010091ec2d48d1
SHA1 dd5b18f3122b20ec08de9e49f51cb945910e5cde
SHA512 542fbcc3eb76f8a2591d1127601af15e72edc24ca3cf58f8dfebf416a1fd4dec1a1cd1ea0f8118c9b7fde57f2713f6797b5e9b29458899082bfaa6f75dee8bbf
SSDEEP 192:JRDeuwmAZ6v7bTp5PRpUMm/C9RHsb+WNBsxgs4jI1Vzivk2B4IhkwoaltVyIsnAI:JRDZ4YXTLXdbwVI/P2NhIal7E
TLSH
T14E52B72EA964697B9CEBC21BF915BB53E7F9202121941F44FBFC892C24E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f5122f8-3be6-4c4f-ad85-9d4a5e70caba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4f5122f8-3be6-4c4f-ad85-9d4a5e70caba.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

81348a44-c4eb-422b-96e6-6f862612c1d6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\81348a44-c4eb-422b-96e6-6f862612c1d6.tmp
Size 13KB
SHA256 db52940a6527a652d91a3b790ab76f96f4a0752681ae064fc0f2c1af54065e67
MD5 d8dc6b49ac7a99485fa6a3a6250d694c
SHA1 55e8a5a84d1050ee26d2931b619b6718528389ec
SHA512 d94bc476b7a22f47a64f4975a9bd9881e9df31e8eced6cdfc3d82a7aadd59cb82c24cce3a90736a00a9ac9d30777ebe70f6048f60fe190a48d57425246960f9a
SSDEEP 192:JRDeuwmAZpv7bTpAPRp2Mm/C9RHsb+WNBsxgs4jI1Vzivk2D4IhkwoaRtVyIsnAI:JRDZ4bXTUXHbwVI/P2nhIaR7E
TLSH
T17652A42EA964697B9CEBC21BF915B753E7F9202121941E44FBFC892C24E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

958e3431-7c33-4c83-8662-68466e4ef547.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\958e3431-7c33-4c83-8662-68466e4ef547.tmp
Size 13KB
SHA256 8947277e37fde3414f5e2d688a3c8d7e79a45b114216d4be379c91a10b961983
MD5 ffbf5842883d59633fb6880e11400ff9
SHA1 865e6b495d35129760e6ff1dd71310b22c2337a3
SHA512 3a22ddea74558e9dd1bcf38cfbdb194a45ff1081326bc3ed3b4419119081027096179a394b02c37eb6350b7afd7d6f26f15f5838797952d3d1c8b3fb1ae49d3f
SSDEEP 384:DVjv27KxkXqKf/pUZNCgVLH2Hfgslj8XODvS+ErU336HGwMMYtbz:DFv27KxkXqKf/pUZNCgVLH2HfgsBuObJ
TLSH
T167520A6B64CC963F4FD8DA4CDC126F4FADB102577668096853FB9C1803A57CA114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 192B
SHA256 f13f6cf1169592f6c52ce3dc5c5d9af3ae0bfdb52c947b9e2b343ea0d9460b64
MD5 d47365f2b46d0eb075669a92302caa14
SHA1 062ff5a1e515baa5b6f11840ff43865a917f2441
SHA512 53d9e9fd878f2015441ec1fd43ce8cdc6c53ba48b9fc9513d2a5ca266e76adde0bb9734693db5c486d66302086073229105441af2ef43052671c927c2feb7fdf
TLSH
T139C080B91491245DCBD045BC5551384CD01D7514114753538351D8F8580F5C7D491DD1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 e5a4f695030f1bcabb66f02c664b28d087b921231e24945c8c2b5bf89fdb8ebe
MD5 e1359d8e54f9286bd761a4473aa25c28
SHA1 da6c25e6b67b74d4ff228602b6d7ce3b055565d1
SHA512 0108e43b72a6292f1b946c5eb06eb93f2570feed5403324007893e16471e91fc258def128c178ca834b009146cd72349be39ce6f1165a5d87850fa505051f447
SSDEEP 3:MsEllllkEthXllkl2zE1l3Ht:/M/xT02zaN
TLSH
T145440204BF800449C9102030442193640360D46049125743289204235C997405D00080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67e15a64-91cd-4166-a728-02599b8a16b9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\67e15a64-91cd-4166-a728-02599b8a16b9.tmp
Size 691B
SHA256 b8fb511e8aadff442e50f9318f9dcd79bd54e08e196486ad2d0bf74e7334e9a1
MD5 c1b4a08c40fe1b005892c3cbaa2646cf
SHA1 2d70d9fc25a4c130d634c0ade7412e34ccc7e9d8
SHA512 e79938dd668df1747b78687b07dce1d68280715f289f9edc14750192b6c721462db7b08fc4fb054d46c45939e40652674813b3c353d24225a22c6f32a2c08df8
TLSH
T189019E67D76DB82B107E44E76D047C0A95B9B83111512CF0DE9B83AEE0C64F31F06853
MD5 SHA1 SHA512 TLSH

Submit Download

b9e9d63b-25a8-497a-97b3-5cb5d5a5e18d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b9e9d63b-25a8-497a-97b3-5cb5d5a5e18d.tmp
Size 4KB
SHA256 50c4a99702365f1f7c2b9792350aee088c8d21ebda2cf73fd6e8ddafe3125717
MD5 b6b6839c8b19f606d1f8867f8a955e5a
SHA1 f5d73d3fbbf61085853a85c053b31bb8139fe6b4
SHA512 d8ec5ddbeb229067036201c2cefa491ecbfcaf16b401b01bedefdce704eb6c3e6e1550526e1e5f7e69b815c19f69cb3b4b1f6128ad38a3ce7140fa90bd86e76e
SSDEEP 48:YALluSv7FL+f++hcaXYfo7EdKs/4sG2sktsmUYsCT3sCZwXsI/YsjyXssXmZsKSu:DHl05CaIaEdBGCIGHwPDyxm6DK
TLSH
T1BDA17AF382E4CA6E891157F5EB153E1FCE691918422C3C5BC9D6AF4F97E2471D200A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2a8e6c8-cbd1-4911-a7f7-fe7bb13355ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f2a8e6c8-cbd1-4911-a7f7-fe7bb13355ba.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

abaace60-d053-449b-a327-11d6db16b9a4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\abaace60-d053-449b-a327-11d6db16b9a4.tmp
Size 13KB
SHA256 93cfa26ec08791ed6dd39844480f5a1df322ddf68d33e8dc9806026909755f97
MD5 40cbf14e20e4ad6605f75d11b3b7b98a
SHA1 b0b6327ad03c08c286783923db70ce0a6ca18b75
SHA512 6b9dfb5f051466cbb0a100f178c5e90f4227e5ad88ae24a163afd905510d612bf84078798feb01d018d508f450f3d24eb5c62a52b8c9f98a5e94d5fcc657ef8a
SSDEEP 192:JRDeuqmAZUv7bTp5PRpUMm/C9RHsb+WNBsxgs4qKtVzivk2w4IhkwoaltVyIsnAI:JRDZWSXTLXdbwV3nP24hIal7E
TLSH
T1A752A72EA964697B9CEBC21BF915BB57E7F5202122901F44FBFC892C24E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad8f0648-7a25-43f8-bbe1-ba2daeb59471.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ad8f0648-7a25-43f8-bbe1-ba2daeb59471.tmp
Size 13KB
SHA256 b8b15afc4e7fec2d79777b54adabf84346a5f1facb87f5080a093a8dd2d6537c
MD5 88e63f91697878e821e3a02d24828e39
SHA1 15c1a375e4c6751f433ab936af00a690c5542be7
SHA512 90c6c621abb50bf8bc1f6596483701094df6f5f37b054dbbed8839d40ba25e0c507982ea39f0141bdafdae7dce8294f163296571e3066104b78512b142ac8a50
SSDEEP 192:JRDauqmAZjv7bTp5PRpUMm/C9RHsb+WNBsxgs4O1ACVzivk2k4IhkwoaltVyIsnv:JRD1WtXTLXdbwVcAoP2UhIal7E
TLSH
T19852A72EA964697B9CEBC21BF915BB53E7F5202121901F44FBFC892C24E76CC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4c0b284-4d1c-4576-adbb-21b2e0e5a40b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b4c0b284-4d1c-4576-adbb-21b2e0e5a40b.tmp
Size 414B
SHA256 6204bd3bb12346518f333e1528e40e0899d0b05e144f8e281aaa7f65579bcf47
MD5 69fa3d3e50cb4177ce9d8eabcefab5c6
SHA1 6b0bfe4c1971fd6a6a9d282e141c6e54fdfc2f00
SHA512 c8af97e91da313920e29e9bc8b7f34d749c7536b0ee62731f88f1785bad0b03ea23c1b72549ef06d45fb9c627ce6af93c7e74c9a971896c37324239f04903f1c
TLSH
T1F0E02B79C822EC2B08FE0B5950651246EB5013172B50891F3F7EC61DCFB063B818589C
MD5 SHA1 SHA512 TLSH

Submit Download

d358bc53-ae05-468b-b397-0722a841dcfd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d358bc53-ae05-468b-b397-0722a841dcfd.tmp
Size 12KB
SHA256 e1ba1038d54ac8dea3c21d0a8faaa3e8254c2f03aa7180e89fba27b6f958d78f
MD5 2b0b826464ebb01742f898138d87f292
SHA1 2f5973e075edc77ba8c893474c23748667e08b27
SHA512 d06104eb114221e2ace56f65d3efc6a87d1b903090586c73b9e514868618241afe0d3fbcbb93701c50d63d6540c3520a220dd16fe17708ba624e373ef49e8e52
SSDEEP 192:JRDeuwmAZVv7bTpAPRp2Mm/C9RHsb+WNBsxgs2Vzivk2b4IhkwoaBtVyIsnAUge:JRDZ4vXTUXHbwVVP2fhIaB7e
TLSH
T13952A62DA964797B9CEBC21BF915B753E7F9202121D41E44EBFC892C24E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d60edea7-9562-4f60-92d7-27f051cda9de.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d60edea7-9562-4f60-92d7-27f051cda9de.tmp
Size 12KB
SHA256 d2d6e8a9ceffafd6bb5e73cbe48a09c0ea4633bea05fd3bf4b7f612a6ff6e1a2
MD5 3d1c9191a91651f7724c68612730403d
SHA1 70e7a439323e6d40b23aaae56f2121a7274f519a
SHA512 68cd67353b8fb1fa6626890800a07517fe936409bf41caf5457b40dfafd16651966243af6e3a6e2ff83364ba1998fcba65496dfb6451566a298eefc12ab85ed3
SSDEEP 192:JRDeuwmzZVv7bTpAPRp2Mm69RHsb+WNnVzivk2b4IhkwoaBtVyIsnAUge:JRDZbvXTUXVbwJP2fhIaB7e
TLSH
T13942B62EAEA4757B9CDBC21AF9257B53E7F5202121942F44EBFC892C24E75CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a853f508-5acc-47f5-bec6-2ba8609e5e8e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a853f508-5acc-47f5-bec6-2ba8609e5e8e.tmp
Size 132KB
SHA256 b6933cf81be71fc1688711d82bc1983fca8ec4734d307eb69bfee29475a53730
MD5 db5f01ce2f80452b86ea26cc64b13809
SHA1 a0dc59d8a520b6b69b44a979cf1b1e35e4ef92fa
SHA512 790fbc166fa980fd84b53677432d2ae7bd6ed95446eca56bae4aeddf9d5e2cfbf9b92fd35f819df09bde6c24c9bfcfae69ddb0209c51b98146888d8f39019ce5
SSDEEP 3072:cOIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzC:cOPtbmf1K49XLWbEPi4NTKlLzC
TLSH
T140D302217D15BCB8A9EEDB21A1902E15A6F8C84B953D3BE55CDE3F8C05A36DDC304863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdf12081-a596-4640-a91b-cf9b762cdc6f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bdf12081-a596-4640-a91b-cf9b762cdc6f.tmp
Size 132KB
SHA256 01deacd3fd7dbd49dfc4fbef0c1f1b0ea5885c7a2bd07cbe23022fbc080b43bb
MD5 bc090a4327c60fb3aff00bfb783877e6
SHA1 b6fdef27aa50222306a753a05e90783e0621399c
SHA512 7663dae0e9486e6f831008333cc9ea21e1ee9405ffcc71a37067d2ced79f322ecf19d6c0a70ad66989ee01c66b30979021aa5f00887e9ff2d7cd28b809391cd8
SSDEEP 3072:uQIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzC:usPtbmf1K49XLWbEPi4NTKlLzC
TLSH
T178D302217D15BCB8A9EEDB21A1502A16E6F8D80B953D3BE55CDE3F8C05A36DDC304863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c22a722d-69ed-4298-8445-4c9640be0f14.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c22a722d-69ed-4298-8445-4c9640be0f14.tmp
Size 132KB
SHA256 2ca78b8f7d8a24025689b0dc032711693870c3bcc35e60f1aed768ad5fa5a100
MD5 6dea30d125589e6ff50f8d281339299b
SHA1 aa10f53f9f3e11549b71600a45271f5a05326e4b
SHA512 4caf932f19a4e6483a4d824575a1b537707dab8331795bfb207c3df1549dfcdec1410cdf60e030af655d463b69fb51df6c13ae472f06d505874da986ac6cbe1e
SSDEEP 3072:YIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzC:0Ptbmf1K49XLWbEPi4NTKlLzC
TLSH
T1A8D312213D51BCB4A9DEDB21A1402A16EAF8D84B953D3BE65CDE3F4C06E3699C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetDisabler.exe

Path C:\Users\Admin\AppData\Local\Temp\Adobe Temp\NetDisabler.exe
Size 743KB
SHA256 9e5ae53145637abd7b3992de092eb389614cc2710c4cd01ee0cfd60d8ba104d5
MD5 3032a3a5ea3a7f16124dfd8a85562aa1
SHA1 42774729f2d226f23795a739cf87a592b358d1a3
SHA512 3f43f41ee4c40e0874a74097fcd511d4cba72e15c8d98bfe6ec6a633495e90629f16c9bbf1833e19ea5ef43cb3fea53a847271e909097d8caa491dff67bbcdb0
SSDEEP 12288:RaWzgMg7v3qnCiKErQohh0F4oCJ8lny9Qr8VUcOHpu+PEE:AaHMv6CerjUny9Qr8eY4EE
TLSH
T129F4BF52F7C680B2D9A33AB5197BE337AB356D198323C49797E03E729E311405B3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Adobe.After.Effects.CC.2018.u4.Multilingual.md5

Path C:\Users\Admin\Downloads\After.Effects.CC.2018\Adobe.After.Effects.CC.2018.u4.Multilingual.md5
Size 83B
SHA256 f202c0cb0f5ac632a00b6d789691db70f96c5db93d41f3ddd3351f17a65a2ead
MD5 fcd34c0ed205f5f60431873a588428b4
SHA1 0ace5b3513c229e13ee3bacfc36001b014af6b3c
SHA512 c502315297641a34eb8d5c42cf40d1263f2a9a814deb43d4cdd109a8e468e3f4c813e736113c4ccb9e67e61eab6457b241992e37c826c470ea736d68d4a7c9d7
TLSH
T148A0126440645A0411E19504C4F00C0020368144C063B2B001923C264AE15304C11051
MD5 SHA1 SHA512 TLSH

Submit Download

Adobe.After.Effects.CC.2018.u4.Multilingual.md5

Path C:\Users\Admin\Downloads\After.Effects.CC.2018\Adobe.After.Effects.CC.2018.u4.Multilingual.md5
Size 83B
SHA256 f202c0cb0f5ac632a00b6d789691db70f96c5db93d41f3ddd3351f17a65a2ead
MD5 fcd34c0ed205f5f60431873a588428b4
SHA1 0ace5b3513c229e13ee3bacfc36001b014af6b3c
SHA512 c502315297641a34eb8d5c42cf40d1263f2a9a814deb43d4cdd109a8e468e3f4c813e736113c4ccb9e67e61eab6457b241992e37c826c470ea736d68d4a7c9d7
TLSH
T148A0126440645A0411E19504C4F00C0020368144C063B2B001923C264AE15304C11051
MD5 SHA1 SHA512 TLSH

Submit Download

Adobe.After.Effects.CC.2018.u4.Multilingual.md5

Path C:\Users\Admin\Downloads\After.Effects.CC.2018\Adobe.After.Effects.CC.2018.u4.Multilingual.md5
Size 83B
SHA256 f202c0cb0f5ac632a00b6d789691db70f96c5db93d41f3ddd3351f17a65a2ead
MD5 fcd34c0ed205f5f60431873a588428b4
SHA1 0ace5b3513c229e13ee3bacfc36001b014af6b3c
SHA512 c502315297641a34eb8d5c42cf40d1263f2a9a814deb43d4cdd109a8e468e3f4c813e736113c4ccb9e67e61eab6457b241992e37c826c470ea736d68d4a7c9d7
TLSH
T148A0126440645A0411E19504C4F00C0020368144C063B2B001923C264AE15304C11051
MD5 SHA1 SHA512 TLSH

Submit Download