hxxps://github[.]com/BrianFreemanJr/simple_shell/releases/download/v3[.]7[.]7/simple_shell_v3[.]7[.]7[.]zip

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/10/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/BrianFreemanJr/simple_shell/releases/download/v3.7.7/simple_shell_v3.7.7.zip
Sample261031-cmd54sgw7s

Score

6^/10

discovery execution

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
30	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2624	cmd.exe
5132	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4928	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
3664	chrome.exe
3664	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe
Token: SeShutdownPrivilege	1188	chrome.exe
Token: SeCreatePagefilePrivilege	1188	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 904	1188	chrome.exe	86
PID 1188 wrote to memory of 1268	1188	chrome.exe	87
PID 1188 wrote to memory of 4928	1188	chrome.exe	88
PID 1188 wrote to memory of 1268	1188	chrome.exe	87
PID 1188 wrote to memory of 5432	1188	chrome.exe	89
PID 1188 wrote to memory of 5432	1188	chrome.exe	89
PID 1188 wrote to memory of 5448	1188	chrome.exe	90
PID 1188 wrote to memory of 1264	1188	chrome.exe	91
PID 1188 wrote to memory of 5448	1188	chrome.exe	90
PID 1188 wrote to memory of 1264	1188	chrome.exe	91
PID 1188 wrote to memory of 2540	1188	chrome.exe	93
PID 1188 wrote to memory of 2540	1188	chrome.exe	93
PID 1188 wrote to memory of 1784	1188	chrome.exe	94
PID 1188 wrote to memory of 6068	1188	chrome.exe	95
PID 2624 wrote to memory of 2268	2624	cmd.exe	112
PID 5132 wrote to memory of 4868	5132	cmd.exe	117
PID 1188 wrote to memory of 5240	1188	chrome.exe	121
PID 1188 wrote to memory of 5884	1188	chrome.exe	122
PID 1188 wrote to memory of 4488	1188	chrome.exe	123
PID 1188 wrote to memory of 3664	1188	chrome.exe	125

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/BrianFreemanJr/simple_shell/releases/download/v3.7.7/simple_shell_v3.7.7.zip
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffd0348c728,0x7ffd0348c734,0x7ffd0348c740
  2⤵
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,6760077930722391690,5627351366264861321,262144 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,15608534695047756648,4853170720197064019,524288 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,16148967744300435866,9850046915664771537,524288 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,16994803990153517218,17323202451086424895,2097152 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,15502329220120655669,14909019179973883239,2097152 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,16244100664489899181,12624003177069979381,2097152 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,16614866975804383488,5577997937253044627,524288 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,13568811717496803507,1277159510804807902,524288 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,17987680507002032535,968596236685225230,524288 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,16188858793118890202,7829036939359768681,524288 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,5467777954360199368,1640059447034283927,524288 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5812,i,6117909752641411225,3983076078362238057,262144 --field-trial-handle=1980,i,2709572219563329364,10208479148535987300,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5240

C:\Users\Admin\Downloads\simple_shell_v3.7.7\compiler.exe
"C:\Users\Admin\Downloads\simple_shell_v3.7.7\compiler.exe"
1⤵
PID:4984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\simple_shell_v3.7.7\Application.cmd" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\Downloads\simple_shell_v3.7.7\compiler.exe
  compiler.exe import.lic
  2⤵
  PID:2268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\simple_shell_v3.7.7\Application.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Users\Admin\Downloads\simple_shell_v3.7.7\compiler.exe
  compiler.exe import.lic
  2⤵
  PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0396749c-22c9-4429-93ae-6444691e3f9d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0396749c-22c9-4429-93ae-6444691e3f9d.tmp
Size 131KB
SHA256 8d14bdac2479c86aaf00af43b00705364c0f20413c90fa61b86da9561f14fdc1
MD5 1c00c804fa8641ad30ad0085f09d1239
SHA1 85dd5b6535c045add203be75d4cb65eae608ddbe
SHA512 ed9e025d9c50b204f3bb7b72d2dce7cfa76965e9ce3d5fe0144a1228aa8c0f5fb7325f2da095c128d4823e86d6a195fa75f4bcafb7e6999a2917a6e493bc92d6
SSDEEP 3072:8+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:8+hFD+7t56OD9ZfSAppry
TLSH
T12FD31232AA95D8BB89FC6541B147A300DD766CED81DE3A09444A9F8EE09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92d5c19a-c091-4caa-af62-b42819156ed4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\92d5c19a-c091-4caa-af62-b42819156ed4.tmp
Size 131KB
SHA256 ed81173d5d1dd67b3e0664c2e195598712b9a720e7a0182820d8f5decd16c2fd
MD5 dc4c9342e03493380b994018ba37f7eb
SHA1 6157544dca4e71bf4f78204032335589e3cf2aa8
SHA512 cbbd8f735febf6b97908fe9f51920c9b4cdd81c5caa709f38f47c577206905ba7e88cafc7aebd152bf100dcf5e2ccdde2773a56cd079034afd52246ef53e5159
SSDEEP 3072:x+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:x+hFD+7t56OD9ZfSAppry
TLSH
T157D31232A951DCBB89FC6541F147A300DD666CED41DE3A09844A9F8E909FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1efc7256-becb-42f2-9b8a-2a6f2f9fb2d9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1efc7256-becb-42f2-9b8a-2a6f2f9fb2d9.tmp
Size 17KB
SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
MD5 c8926c13ed1e541a9ebca052800d518d
SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
TLSH
T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5898edbb-45f7-4042-9dee-5329e7b28ff7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5898edbb-45f7-4042-9dee-5329e7b28ff7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2475c4a5-7b28-4818-b749-5a1f5254ab02.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2475c4a5-7b28-4818-b749-5a1f5254ab02.tmp
Size 2KB
SHA256 5055bf09a25b64577a1a736f71285592bd9c5ba5799ad2ef0c05b1930f0112ea
MD5 63f0ec13f5b7b78b0df34c5b2ac85528
SHA1 c633a5df5384079acee399d4c56e565a104906ff
SHA512 423c6119ca43c94aa1e50133c7b87370253f37aa05f12cadee984bf2fba65cd79955ca925b1ca85be75b19232a029ffbc20870d6349245205636036ec8afeaa6
TLSH
T11241BDF793B4857D8A1196F4EA15AE1FCE790524131C3CA6C8E46E1B83F2872D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

e6b1fca1-b197-40a8-8b04-108df38a6398.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e6b1fca1-b197-40a8-8b04-108df38a6398.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 28529da0653b69121e186f7c78184bcb710101e93bd56bcc89ea78cb63dab393
MD5 4490b3fec5a1e40a2a9ba1286a13d279
SHA1 569a2b71748aea39c5b8b39daec296d0198e8d64
SHA512 c6a4dbb8492cf8cfe44b1de65cf57f5f4c1ec76c780bb1c1be105bf66ec55d4c4ef65ff16ce6c8094eb4cc377d0d785056d54f454c33801d9d05a7579a56beb4
TLSH
T1C3B01245C0413302C40A03B02170947433608F3AD15213C942E00D31C8311505117108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 968d05e102f0ca7cb0aa5cca7e2ca9f0a6f19d61c24164d4a3e1909eacd1e455
MD5 eeb99168f94085d633b9b75df76dea15
SHA1 aac66f84154d32209276dcdf05ab46d7407541d8
SHA512 7016b7dd884ca25de279ebd2882f175f609417280103b13ad189e3ea96e93b86a8603062fbc3a8f530c615fcb289c9719f7e36335bbe0e079c8491ef9fed957c
TLSH
T15AB0029AC2066213C0524BB42DA599F87174DF65C603121EA6F51E76FC266704D2556C
MD5 SHA1 SHA512 TLSH

Submit Download

aab6006a-b9c6-440c-bdab-b7e4cb884442.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\aab6006a-b9c6-440c-bdab-b7e4cb884442.tmp
Size 414B
SHA256 3d0f3812f5a548cfd91a328b0e410131f8043a244eb6532f32e62b0a17f80892
MD5 39c5dd4f068877186278821dbdad7157
SHA1 35fbf244b6132e0b696c62977548a5f54b1ac064
SHA512 7e6d7d586cfe2c3cf400572f94771bc58ff0d8a51a2092955afde4734550cdee3f1cddcfbfd1ffcaf667dcea5a70269de4ae86b248d819b1ed0e3ca30be5034f
TLSH
T184E061A6D811AC375CFE07296195CB49EB65232B3B40490F363C951C8FB123646DED5C
MD5 SHA1 SHA512 TLSH

Submit Download

adba3072-fa13-45e9-b11c-b75272e1c4a6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\adba3072-fa13-45e9-b11c-b75272e1c4a6.tmp
Size 12KB
SHA256 19150db6aa1d1b8bbbc5dd4008c2c6ff3545441c50542a7aac1e6d9ff983249c
MD5 3d8bb4c0053bb38b90f8eb92bd0573bb
SHA1 c07362a29f27d6a315909a9acc96de36f2332fc3
SHA512 e0abc63ccbb6047e2e596dc36320223b2deb537e905890431894086efffef8420c4198286ae5d5382b19483c038a96c1113524e44ae99d68049090cbbb141fa2
SSDEEP 192:kRdv+y+WKHEs1v78pAPRp2b9THsb+WNn6nPehWdKkwkcDaAcVyIsnAUge:kRdvABF4UXwJw4Pe+KEaaA4e
TLSH
T1CC42A62DED50793B4CDBD62AF9617663D7FA102160D02E88E6FC893C15E75CC622712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da4529ef-3346-4aba-8050-4607ca591965.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\da4529ef-3346-4aba-8050-4607ca591965.tmp
Size 130KB
SHA256 c48e054b233e03582ad878b36314abb3f594779799e00c9d9347ba209beb68f2
MD5 b10fb516db7a78e45bb4c927d67ab469
SHA1 1edba2539d436f23174bcea369bfe697cec94c8c
SHA512 dddc99af4fb551ded7f65e18e80d8d5346928f11cda0a08eaadbf189f787137a96a48a1457cc887be2d51917f04ee2bdee878a3eff19c5a705e043cfdbb359d1
SSDEEP 3072:i+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:i+hFD+7t56OD9ZfSAppry
TLSH
T1A8D31232AA91C8BBC9BC6541B157A304DE766CED41DE3A09444A5F8EE05FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3dda5be-89be-4dbe-8559-3b6dc43bd1a3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f3dda5be-89be-4dbe-8559-3b6dc43bd1a3.tmp
Size 131KB
SHA256 d4a26ac6a1c6cc1c24e4eed25b30850f87e14c9fe6187b50d54b3fe101fe8d8f
MD5 560842ad23fc714b26181e362d97ae16
SHA1 d8e32325d938f57fcc524c292f8b2b4e84cc51f5
SHA512 e391295136f3a190a81020bb30b79d2f86d0061f7b68f53a2388e8e7fe89f26e8996216c71bddab83c5793bd600fa54e3c0ce62a5322d49c4410791b1503d459
SSDEEP 3072:r+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:r+hFD+7t56OD9ZfSAppry
TLSH
T124D31232AA95D8BB89FC6541B147A300DD766CED81DE3A09444A9F8EE09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b51b1516-c8ad-4c4d-95a6-b3561ba6305e.tmp

Path C:\Users\Admin\Downloads\b51b1516-c8ad-4c4d-95a6-b3561ba6305e.tmp
Size 15KB
SHA256 346d36d561c60f270523d1e45798d78867fc166d6a2e677048ab0d7247980ffc
MD5 188787ca9bf9c8408ded3fbdefdeabbc
SHA1 59390ea68fb9cda38c84fe508a9e73050660cce3
SHA512 659c4b7e7177401ba8b4d1ee472e5476212e3dd89f72c155146fc64258c1ba21b038734932bcc2bd9647cd018210e3ea2f2bafc07e061332b3c4f5abe43dfe96
SSDEEP 384:6mCXXap7BfULaWjuqciRjJISVwcPpylGEvRFlsBrsxXBESrWPGLL0e:6mCns7BlvW+Q7RylDpsyxxESiOLwe
TLSH
T18A72D03FE7E8300C27292B66CA16CDAD749684E3950B69B6BB566178400C3076F78B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

simple_shell_v3.7.7.zip.crdownload

Path C:\Users\Admin\Downloads\simple_shell_v3.7.7.zip.crdownload
Size 1.3MB
SHA256 6cd97eb6617b1a053c00a2399390b1b3e13cdbec2685a2464c9d61c45abaf8ec
MD5 2e6002803a00403f91fe9093d911c2b3
SHA1 6688466206dac58b6b6abd7c0e88751f401c2f04
SHA512 02e2ef5e16f9916d85998dc78ef9e421daa50b5af03ffc37d89ecc1946a694a518ac3fff7551bbf044c75e5ff2f9e3d7926ae0afe38ba8c64a9c8812a4a56ac0
SSDEEP 24576:a5oB6RN7oZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRy:a5oB67oZ9bq+MmMEL+hcjXHC/wnwdy
TLSH
T1DE55338A813C18C48F7D0A677BFF956C72254EFC100118B72F5604AB663EB9F867499E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2268-120-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-111-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-82-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-81-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-80-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-79-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-78-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-88-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-97-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-138-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-137-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-136-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-164-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/2268-163-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/2268-162-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/2268-135-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-134-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-133-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-128-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-127-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-126-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-125-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-124-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-122-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-121-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-84-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-118-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-119-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-116-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-115-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-114-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-113-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-112-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-83-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-110-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-109-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-108-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-107-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-106-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-105-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-104-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-103-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-102-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-101-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-100-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-99-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-98-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-96-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-95-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-94-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-93-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-92-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-91-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-90-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-89-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-132-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-131-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-129-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-130-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-123-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-117-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-87-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-85-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-86-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/2268-77-0x0000000052200000-0x0000000052210000-memory.dmp

Download

memory/4984-76-0x0000000066D80000-0x00000000670D1000-memory.dmp

Download

memory/4984-75-0x0000000000400000-0x000000000041B000-memory.dmp

Download