agenttesla | hxxps://gofile[.]io/d/ctp7YjJz

Analysis

user interaction
yes
max time kernel
318s
max time network
318s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/ctp7YjJz
Sample261102-w2b4vaev7r

Score

10^/10

collection defense_evasion discovery execution agenttesla donutloader keylogger loader persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://91.210.109.228
Port
21
Username
FTPUSER1
Password
Kingdom12345@

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/2168-455-0x0000000004110000-0x0000000004154000-memory.dmp	family_donutloader

Executes dropped EXE 1 IoCs

pid	Process
2168	VWRJGUMCHOEEOVMLOJIW.EXE

Loads dropped DLL 1 IoCs

pid	Process
2168	VWRJGUMCHOEEOVMLOJIW.EXE

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Roaming\\SystemUpdate\\SystemUpdate.bat"	reg.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	VWRJGUMCHOEEOVMLOJIW.EXE

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
25	api.gofile.io
27	api.gofile.io
46	api.gofile.io
70	api.gofile.io
24	api.gofile.io

Deobfuscate/Decode Files or Information 1 TTPs 3 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1300	certutil.exe
3776	certutil.exe
908	certutil.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
46	ip-api.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2596	cscript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4600	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4056	cmd.exe
244	cmd.exe
2808	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	VWRJGUMCHOEEOVMLOJIW.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	VWRJGUMCHOEEOVMLOJIW.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VWRJGUMCHOEEOVMLOJIW.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4376	chrome.exe
1992	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3562044790-535044693-348086427-1000\{62BAA90F-A923-431B-9123-92EFCB1AB27A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000_Classes\Local Settings	msedge.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ANYRUN_Sandbox_Analyzer.zip:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\LabSample_20261102_182533\original_sample.bat\:Zone.Identifier:$DATA	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\SystemUpdate\SystemUpdate.bat\:Zone.Identifier:$DATA	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5824	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe
4600	powershell.exe
2168	VWRJGUMCHOEEOVMLOJIW.EXE
2168	VWRJGUMCHOEEOVMLOJIW.EXE
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
6128	chrome.exe
6128	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeIncreaseQuotaPrivilege	4600	powershell.exe
Token: SeSecurityPrivilege	4600	powershell.exe
Token: SeTakeOwnershipPrivilege	4600	powershell.exe
Token: SeLoadDriverPrivilege	4600	powershell.exe
Token: SeSystemProfilePrivilege	4600	powershell.exe
Token: SeSystemtimePrivilege	4600	powershell.exe
Token: SeProfSingleProcessPrivilege	4600	powershell.exe
Token: SeIncBasePriorityPrivilege	4600	powershell.exe
Token: SeCreatePagefilePrivilege	4600	powershell.exe
Token: SeBackupPrivilege	4600	powershell.exe
Token: SeRestorePrivilege	4600	powershell.exe
Token: SeShutdownPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeSystemEnvironmentPrivilege	4600	powershell.exe
Token: SeRemoteShutdownPrivilege	4600	powershell.exe
Token: SeUndockPrivilege	4600	powershell.exe
Token: SeManageVolumePrivilege	4600	powershell.exe
Token: 33	4600	powershell.exe
Token: 34	4600	powershell.exe
Token: 35	4600	powershell.exe
Token: 36	4600	powershell.exe
Token: SeIncreaseQuotaPrivilege	4600	powershell.exe
Token: SeSecurityPrivilege	4600	powershell.exe
Token: SeTakeOwnershipPrivilege	4600	powershell.exe
Token: SeLoadDriverPrivilege	4600	powershell.exe
Token: SeSystemProfilePrivilege	4600	powershell.exe
Token: SeSystemtimePrivilege	4600	powershell.exe
Token: SeProfSingleProcessPrivilege	4600	powershell.exe
Token: SeIncBasePriorityPrivilege	4600	powershell.exe
Token: SeCreatePagefilePrivilege	4600	powershell.exe
Token: SeBackupPrivilege	4600	powershell.exe
Token: SeRestorePrivilege	4600	powershell.exe
Token: SeShutdownPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeSystemEnvironmentPrivilege	4600	powershell.exe
Token: SeRemoteShutdownPrivilege	4600	powershell.exe
Token: SeUndockPrivilege	4600	powershell.exe
Token: SeManageVolumePrivilege	4600	powershell.exe
Token: 33	4600	powershell.exe
Token: 34	4600	powershell.exe
Token: 35	4600	powershell.exe
Token: 36	4600	powershell.exe
Token: SeIncreaseQuotaPrivilege	4600	powershell.exe
Token: SeSecurityPrivilege	4600	powershell.exe
Token: SeTakeOwnershipPrivilege	4600	powershell.exe
Token: SeLoadDriverPrivilege	4600	powershell.exe
Token: SeSystemProfilePrivilege	4600	powershell.exe
Token: SeSystemtimePrivilege	4600	powershell.exe
Token: SeProfSingleProcessPrivilege	4600	powershell.exe
Token: SeIncBasePriorityPrivilege	4600	powershell.exe
Token: SeCreatePagefilePrivilege	4600	powershell.exe
Token: SeBackupPrivilege	4600	powershell.exe
Token: SeRestorePrivilege	4600	powershell.exe
Token: SeShutdownPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeSystemEnvironmentPrivilege	4600	powershell.exe
Token: SeRemoteShutdownPrivilege	4600	powershell.exe
Token: SeUndockPrivilege	4600	powershell.exe
Token: SeManageVolumePrivilege	4600	powershell.exe
Token: 33	4600	powershell.exe
Token: 34	4600	powershell.exe
Token: 35	4600	powershell.exe
Token: 36	4600	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe
5932	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4868	3840	msedge.exe	80
PID 3840 wrote to memory of 1992	3840	msedge.exe	81
PID 3840 wrote to memory of 580	3840	msedge.exe	82
PID 3840 wrote to memory of 1244	3840	msedge.exe	83
PID 3840 wrote to memory of 580	3840	msedge.exe	82
PID 3840 wrote to memory of 580	3840	msedge.exe	82
PID 3840 wrote to memory of 1244	3840	msedge.exe	83
PID 3840 wrote to memory of 3376	3840	msedge.exe	84
PID 3840 wrote to memory of 2604	3840	msedge.exe	85
PID 3840 wrote to memory of 3376	3840	msedge.exe	84
PID 3840 wrote to memory of 3376	3840	msedge.exe	84
PID 3840 wrote to memory of 2604	3840	msedge.exe	85
PID 3840 wrote to memory of 2604	3840	msedge.exe	85
PID 3840 wrote to memory of 3192	3840	msedge.exe	87
PID 3840 wrote to memory of 1012	3840	msedge.exe	88
PID 3840 wrote to memory of 3192	3840	msedge.exe	87
PID 3840 wrote to memory of 3192	3840	msedge.exe	87
PID 3840 wrote to memory of 1012	3840	msedge.exe	88
PID 3840 wrote to memory of 1012	3840	msedge.exe	88
PID 3840 wrote to memory of 4356	3840	msedge.exe	89
PID 3840 wrote to memory of 4572	3840	msedge.exe	90
PID 3840 wrote to memory of 4356	3840	msedge.exe	89
PID 3840 wrote to memory of 4356	3840	msedge.exe	89
PID 3840 wrote to memory of 4572	3840	msedge.exe	90
PID 3840 wrote to memory of 4572	3840	msedge.exe	90
PID 3840 wrote to memory of 548	3840	msedge.exe	93
PID 3840 wrote to memory of 1812	3840	msedge.exe	94
PID 3840 wrote to memory of 548	3840	msedge.exe	93
PID 3840 wrote to memory of 1812	3840	msedge.exe	94
PID 3840 wrote to memory of 4452	3840	msedge.exe	96
PID 3840 wrote to memory of 4728	3840	msedge.exe	97
PID 4728 wrote to memory of 1148	4728	msedge.exe	98
PID 3840 wrote to memory of 4912	3840	msedge.exe	99
PID 3840 wrote to memory of 3932	3840	msedge.exe	100
PID 3840 wrote to memory of 4912	3840	msedge.exe	99
PID 3840 wrote to memory of 3932	3840	msedge.exe	100
PID 3840 wrote to memory of 3932	3840	msedge.exe	100
PID 3840 wrote to memory of 1172	3840	msedge.exe	101
PID 244 wrote to memory of 4600	244	cmd.exe	106
PID 4600 wrote to memory of 3304	4600	powershell.exe	107
PID 4600 wrote to memory of 2808	4600	powershell.exe	110
PID 2808 wrote to memory of 4640	2808	cmd.exe	112
PID 2808 wrote to memory of 1984	2808	cmd.exe	113
PID 2808 wrote to memory of 3220	2808	cmd.exe	114
PID 2808 wrote to memory of 2596	2808	cmd.exe	115
PID 2596 wrote to memory of 4056	2596	cscript.exe	116
PID 4056 wrote to memory of 3816	4056	cmd.exe	118
PID 4056 wrote to memory of 1256	4056	cmd.exe	119
PID 4056 wrote to memory of 1300	4056	cmd.exe	120
PID 4056 wrote to memory of 3776	4056	cmd.exe	121
PID 4056 wrote to memory of 908	4056	cmd.exe	122
PID 4056 wrote to memory of 4696	4056	cmd.exe	123
PID 4056 wrote to memory of 4440	4056	cmd.exe	124
PID 4056 wrote to memory of 2168	4056	cmd.exe	125
PID 4600 wrote to memory of 5684	4600	powershell.exe	126
PID 5932 wrote to memory of 5944	5932	chrome.exe	129
PID 5932 wrote to memory of 3412	5932	chrome.exe	130
PID 5932 wrote to memory of 3412	5932	chrome.exe	130
PID 5932 wrote to memory of 4376	5932	chrome.exe	131
PID 5932 wrote to memory of 1560	5932	chrome.exe	132
PID 5932 wrote to memory of 1560	5932	chrome.exe	132
PID 5932 wrote to memory of 5012	5932	chrome.exe	133
PID 5932 wrote to memory of 5012	5932	chrome.exe	133
PID 5932 wrote to memory of 5032	5932	chrome.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	VWRJGUMCHOEEOVMLOJIW.EXE

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/ctp7YjJz
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffcfdefc188,0x7ffcfdefc194,0x7ffcfdefc1a0
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,15420544606589768785,16966658390030560829,524288 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,16558894068589390333,13589301603866054179,262144 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,4261329158567353360,2889193306347925354,524288 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,9334098293318369709,17256333240209141299,2097152 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,7844932646301594990,13454110229738698203,2097152 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,14981843770679690630,7420011387361442361,2097152 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,14881794322915184821,2752118073381035251,2097152 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4312,i,11436005520941933861,2401427940996293889,2097152 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4324,i,12398694299215005959,333146238045431177,2097152 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,3653218251521239044,9840119940918138961,524288 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,5460216136302960274,5249312529196473381,524288 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,9546519828579556085,16004049253406244115,524288 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,9546519828579556085,16004049253406244115,524288 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,4866840130401959514,18164216943519043071,524288 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,7759900483804938590,13398036240019712010,524288 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6596,i,8861828669853663695,10441275080220257475,2097152 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,7352087739296991268,844408375610054777,524288 --field-trial-handle=2320,i,3434759822719620405,4042511688380909302,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2268

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ANYRUN_Sandbox_Analyzer\RUN_IN_VM.cmd" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\Downloads\ANYRUN_Sandbox_Analyzer\Analyze-InSandbox.ps1" -SampleText "C:\Users\Admin\Downloads\ANYRUN_Sandbox_Analyzer\original_sample.bat.txt" -DurationSeconds 45 -ConfirmedInVm
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Query /FO CSV /NH
    3⤵
    PID:3304
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Temp\LabSample_20261102_182533\original_sample.bat""
    3⤵
    - Executes a command shell one-liner
    - NTFS ADS
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Environment" /v UserInitMprLogonScript
      4⤵
      PID:4640
  - - C:\Windows\system32\find.exe
      find /i "C:\Users\Admin\AppData\Roaming\SystemUpdate\SystemUpdate.bat"
      4⤵
      PID:1984
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemUpdate\SystemUpdate.bat" /f
      4⤵
      Registers new Windows logon scripts automatically executed at logon.
      PID:3220
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo "C:\Users\Admin\AppData\Local\Temp\~run.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\LabSample_20261102_182533\original_sample.bat" hidden
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4056
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\Environment" /v UserInitMprLogonScript
        6⤵
        
        PID:3816
      - C:\Windows\system32\find.exe
        
        find /i "C:\Users\Admin\AppData\Roaming\SystemUpdate\SystemUpdate.bat"
        6⤵
        
        PID:1256
      - C:\Windows\system32\certutil.exe
        
        certutil -decode "C:\Users\Admin\AppData\Local\Temp\temp1.txt" "C:\Users\Admin\AppData\Local\Temp\VWRJGUMCHOEEOVMLOJIW.EXE"
        6⤵
        Deobfuscate/Decode Files or Information
        
        PID:1300
      - C:\Windows\system32\certutil.exe
        
        certutil -decode "C:\Users\Admin\AppData\Local\Temp\temp2.txt" "C:\Users\Admin\AppData\Local\Temp\VWRJGUMCHOEEOVMLOJIW.ini"
        6⤵
        Deobfuscate/Decode Files or Information
        
        PID:3776
      - C:\Windows\system32\certutil.exe
        
        certutil -decode "C:\Users\Admin\AppData\Local\Temp\temp3.txt" "C:\Users\Admin\AppData\Local\Temp\VWRJGUMCHOEEOVMLOJIW.zip"
        6⤵
        Deobfuscate/Decode Files or Information
        
        PID:908
      - C:\Windows\system32\where.exe
        
        where tar
        6⤵
        
        PID:4696
      - C:\Windows\system32\tar.exe
        
        tar -xf "C:\Users\Admin\AppData\Local\Temp\VWRJGUMCHOEEOVMLOJIW.zip" -C "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\VWRJGUMCHOEEOVMLOJIW.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\VWRJGUMCHOEEOVMLOJIW.EXE" "C:\Users\Admin\AppData\Local\Temp\VWRJGUMCHOEEOVMLOJIW.ini"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Accesses Microsoft Outlook profiles
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        outlook_office_path
        
        PID:2168
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Query /FO CSV /NH
    3⤵
    PID:5684

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:1456

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\ANYRUN_Analysis_20261102_182533.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd01f1c728,0x7ffd01f1c734,0x7ffd01f1c740
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,17103277501089996930,2900525785378296162,262144 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,6803476595526830406,14560760168180188706,524288 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,12105043613518229347,15201526569961586477,524288 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,4641093318971443995,5280076695755936763,2097152 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3348,i,14651780600727860237,4577873198925097352,2097152 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3916,i,1433826290071946969,8822709829189716852,2097152 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4512 /prefetch:9
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4776,i,15502213255941246223,8931806577442213092,2097152 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,14785350454687155341,16259550628501781667,524288 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5872,i,15200433031577954486,9009149462356527136,2097152 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4920,i,11147302762993590927,13929030068225737303,2097152 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4640,i,12809492263220811594,12824929902358886251,524288 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3424 /prefetch:14
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,6371201414628933350,14999034835343042299,524288 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,14806760911243065204,9310897774036800692,524288 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3516,i,10394551921145589370,2506556853756620961,262144 --field-trial-handle=1908,i,707006932179356735,9853709104703792262,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5708 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3816

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2da1ecff-c224-481c-acdf-02f2ab6241c5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2da1ecff-c224-481c-acdf-02f2ab6241c5.tmp
Size 130KB
SHA256 c57ac7fc0558eabbdc7bf159496583d815f012b9a13c4f072d5486484fe2e6a6
MD5 886f6075c9946a37b6e5729c16444f41
SHA1 b4d9f4e5f3e583e50d6315b82fd9f67ae83d85d7
SHA512 92e3191d04cc5c9d65306f6b5d44547f8d3c1a5ea61d15915ecfe3da7bd711e14ec631b827eaac2a9f032bdc0343976f09206add3a686fa38ba9ce6352c50628
SSDEEP 3072:1JH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:1ft4fLJ0L6nGJxi3bzqapJjP
TLSH
T188D312F1D1E0AC7ACBB7EE4145755E948E71E5C289CDBE2408ED8C1816CEA344E17EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

482da815-73a7-4153-afde-db8956ac6c5f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\482da815-73a7-4153-afde-db8956ac6c5f.tmp
Size 269KB
SHA256 28726735b201523b22c85d8d8535f2a38e5267a76be75d820fbc446a61410b33
MD5 ac9deec9a1e8b6e338fa97283a918ab1
SHA1 2746fcb746e6f9d2ab971e8a354001e42fb90b7b
SHA512 769314f95677d5db0872132fc846002d79dd9c1a244831700f1343bbe3ed259549957f2be63c75a4c106eed56b30e0778c22f5de0d16333eacdf06ee624ad407
SSDEEP 6144:IBlvHWe40m3otUf+8Wp53EX9pxsNTAt4fLJ0L6nGJxi3bzqapJjO:IR493obX3ETxsyWXUx8zvpJ6
TLSH
T1514423B4C5C06C3BCFF9DA572829BE555F74CAC28589DE200DF51D0A264AD7A0E23A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c75d3f5-9f5f-4d42-826f-8faccaea6dd7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3c75d3f5-9f5f-4d42-826f-8faccaea6dd7.tmp
Size 414B
SHA256 98dc1a948a87639ba600513cd53ac0aee9dc67b3a20c421daa478f114bf533b3
MD5 f205455acb35114c5abc4ee14d445f20
SHA1 62f1de32910f3e92b7e334e2b0875405cad9ac94
SHA512 168ee3f85bab852fef206a40eec08487338a4e246ac3234235b40a1d6e72eb4fef5e2c05d9e62686564931a84dd31a3e3ff555e1825d138478d1115c96d36696
TLSH
T153E02BA6C821EC2B28FD0B1A5054160AF65027272E414D4F3B3DD11D8FB1E7B01DA85C
MD5 SHA1 SHA512 TLSH

Submit Download

60d54937-05ae-4f70-af0d-8257b20f3f8c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60d54937-05ae-4f70-af0d-8257b20f3f8c.tmp
Size 12KB
SHA256 1f2f8baaf0125dcf0e346028c1c7a2f054bfecf4416ab606633e6d7495d86749
MD5 f26d08a0ba5b53976df5c391d0dd4204
SHA1 d7b1956d5d397253e56f6b5c90ae5b6e9952fea3
SHA512 7412ad140e78c9fe55fdf48f52a1b2f473d610ecb860f8935aeb27b7de41ae5f57185663aac67c9a89dfdaa4168c018c6b16152684484a48ba0d9bb56258ebf8
SSDEEP 192:sRXOnPGDFMSHv7fpAPRp2G9UHsb+WNn390YdZa7ZvGVyIsnAUgtaJ:sRXOspPjUXBWwN0saI8
TLSH
T14442962EA950753F6CDBC22EF9227767E7F5102520A42EC4EAF8892C19D75CD222B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90648dfc-0fb3-4554-8fe5-2edd2699a020.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\90648dfc-0fb3-4554-8fe5-2edd2699a020.tmp
Size 12KB
SHA256 e28f1801703cdb9957e31d80d891308b05098de006eb17733533ea9cd4e8703c
MD5 2655df8cdf6530e0999d3ed65f2f461b
SHA1 b3fc163fa5efca1cdba36eb8b8e35d7f7e107124
SHA512 85ca5c0795dd63e110c95bf491be0167325f857fdec3cd28b0b4f19d1bc3fd3fa8f21f3b4c628d4fb635e73bb16e312670f673eff5fbe15e379162bd4ac49f5e
SSDEEP 192:sRtOnPGDFMYHv7fhAPRp2G9UHsb+WNnw+tBdZa7ZvGVyIsnAUgtaJ:sRtOsxPj8XBWwltdaI8
TLSH
T12042A72EA950753F6CDBC22EF9227767E7F5102124942EC4EAF8893C19D75CD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91f8a141-99c8-4fab-913d-fe85e65b10b6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\91f8a141-99c8-4fab-913d-fe85e65b10b6.tmp
Size 17KB
SHA256 00b1f5e3f2ee15e41635cc5776beecab26489b83cc8da1b01e578cec0f125545
MD5 4c845b2618eefdd47280df258df1e5fa
SHA1 90d6142c1453e2f700bea476669cfb9e36befbb6
SHA512 4f4b1bf9d6b776e477d3ad3578fd52d3bab53a83694fa9eecdba8eabeff22ee1e9679f0c42ddd6998d0b7c0b64c1dbe2a8235c40f3d2f87323a4df5053bd2ddf
SSDEEP 384:wGjUD7KxkXqKf/pUZNCgVLH2HfgslMl7pLuLceSOPXODU/+ErU36GHGiGTE9t:wmUD7KxkXqKf/pUZNCgVLH2Hfgsml7pT
TLSH
T11872FA67AC4C9E3B0F94CACDDC167A4FACB5024B65E9886443FA5C2903D5ADF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 20KB
SHA256 cfde44d5f86bfd62622253fc8e1090162756b25ccd15fc3d881e1cbae5e374f1
MD5 22cc079b4472dc5fad5e657f343f3d39
SHA1 18a0aa683b6500ff83f84201c6de670a95c8d5bc
SHA512 88a8aaeb830c0bb35eec256c61879ca64ebb7aaa0f844b3c49b3cc2d7ab494bb22a7dc596d33a475ff64d96fa9b94fa9773ee0de3b306153e22964a88c739cb3
SSDEEP 384:j+rGoAr2UOxWfQwypaVjGH7HtDza3Yp1yls/fVcE65REWD1dRiwjH:j+rK6UxypgSbHtDG3NlNfnECfRnH
TLSH
T1F292D104F7560B8955B590AA0F15F4D536DE6C378B0678F9F7D8AE490378432AF85C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 105KB
SHA256 018d0fcb1ca9683ce51b72fd83b6b11c517090475794538e439c33c87e398f8a
MD5 dd2f8d47f9ae5c0d3f471470f5286a20
SHA1 99a31af4d0a17204ed94f2ecc86523f2f5c9cb53
SHA512 5d0c36ec5d8d6b3aadaaaa063f288e9ef2fd807ded75d7b9972506f05382607f421f0d98718d2f07fe3121de5f5c515a6f20cb3cc170591409264801a406638c
SSDEEP 3072:WnH5ja6PC6JXer7GdjvoffcYqJ1pzWZyik6kcO:WZuYCSqi9UfcYq1zWB3Y
TLSH
T18BB312B4ACA136D7420E5C560B33D1E8B75F5B2B6202FC07AD63263E460B3196DE9B0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 888B
SHA256 6d6fc834355011d32b1d36502c0c14577d1f02b559cece9e6914e8cace1f8b45
MD5 819bb6596f8b2ccbe25118ea5d67e00a
SHA1 37e20db0fcfee9f6211fb9441de10a71d0dbb4bc
SHA512 6017f5555ce85ebcebed5d79484c605a21e9f9dff105356325ad9e37b455e95f7d74befc0dde8cfa63a7387fc41814ffb7612d21a958d193c2032ba5ab9a6701
TLSH
T12E11C9F1224D8523D7616F7498CCB065FC3345B287732C9F40B804BC4721B82228916D
MD5 SHA1 SHA512 TLSH

Submit Download

6c3268f8-01db-4541-8ea0-0f8b87703242.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6c3268f8-01db-4541-8ea0-0f8b87703242.tmp
Size 3KB
SHA256 8eb64dd642e56397ff8923a8c3545b5967fd2f31c862da8a4b36f5f0ff866050
MD5 fde09afcafe0ecfb54d5857b331a66c6
SHA1 fac681a41990f95f1559c6d0a0dc3e507e5ad810
SHA512 ffa56040604b16d9cb3af330ce78ece61e36c8d19bcf1f35c2d4e31e1e6ec28619577d2cc6391285ebad58e73f9cec6b90ad3106fe91e30b636ef5a0929468af
TLSH
T11461BEF3C3E8856D891156F4EB116E2FCE691924532C3D66C8E4AE0B93F2972D24038F
MD5 SHA1 SHA512 TLSH

Submit Download

85c572b3-7446-4b2d-ba72-beae71b18816.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\85c572b3-7446-4b2d-ba72-beae71b18816.tmp
Size 3KB
SHA256 a27bec30fb86cf568de46a44718ede0e67778d188023dc6dc644a0f86f1f4aef
MD5 9922fb8f873d6daedf09364651c23315
SHA1 73e63435d04e6e14ad68444021693dd67fa512a2
SHA512 0005308254e55f21a2c91c5e31de87896f53d7dc67d346f9bc76a59950549d77125d2668ed65fb64d75c805ae6b1d2da3bf1107f8d21360b8a149cf096977811
TLSH
T168719DF3C3E8857D891156F4AB156E2FCE691924532C3D66C9E4AE0B93F2972D24038F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 ece7afb5b54ab08e41fb3dc719e9f90805fd7073d50b58f1e7b38308fc9e7a4b
MD5 6d556f838d5dece8718140b657845e51
SHA1 80a5a9855034e351658475868c4fcb9262d7963a
SHA512 9c091cab3a873bba27fecb72d778bd6eba65af41e7966125292fdf8aa73ef4efcb9cf5bcfd6e24b5a03d5c45d10ce3dd384dc67dfeb6a5142b1007791976b727
TLSH
T161B0124591456701C00503B1129594543B708F35E91313898AE00D19D831190401710D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 aecb0be9185c0ba64e28e84ff6cf4c5c1aba0b0f4e6bbc8219a7571bfc3940a5
MD5 50754b4d3104cb604c66e69970157864
SHA1 576a54fd72ccc9a10ae72555f811e16f3946182a
SHA512 0df7dab75b01d854217369cdbd51d71bece1fe1d046eaba29400ce7b914ceaa6f4c3bcaf9cfe2614770bc62908dcb457f3f46803819708d4075bc45427fd273f
TLSH
T158B02280C0022223C00303F02CEEA8CC3020EF20C223220A82F00E32EC38A2080200B0
MD5 SHA1 SHA512 TLSH

Submit Download

dead2ee4-9998-481b-b657-72ca3d9de283.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dead2ee4-9998-481b-b657-72ca3d9de283.tmp
Size 13KB
SHA256 a53f75294aa5d3a24667ee6270289b44553552b043b581077a69db984b188703
MD5 2bcb1d6972c3fb8e54f70307363ab41e
SHA1 d2d5780f8ec5a979ac10e1bb2d9d9552593abd9f
SHA512 52a3e8b6123c4bc7517ab2cbd55b4b9f62e97e07f193c045234467e802915b1e6507e9f629e3a3c9dddff03d24227869cd8ef8edd8230f8281657eaeb9830ac5
SSDEEP 192:sRoOnPGDFMYHv7fhAPRp2YlE9UHsb+WNnw+eiY2vdZa7ZvLVyIsnAUgraJ:sRoOsxPj8XSWwlE2raHe
TLSH
T10752C62EA950793F6CDBC22AF9227727E7F5102164A42EC4EAFC8D2C19D75CD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccb0cb6c-b910-43fb-ae46-1d8434b24a7e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ccb0cb6c-b910-43fb-ae46-1d8434b24a7e.tmp
Size 270KB
SHA256 221e44e713a6f02b2f3184311b7e405ef4b17f589e6f93020f36647d2aca5b0b
MD5 086b82ae1f0628208958596841622bb8
SHA1 c95af3d758d277191e0967554a8fe9851df11d57
SHA512 b06f933f2a6a76bee326a8b09106991ce3aeb7922a1d8384374b88652db59e6bb15d8e5e7a66fe974e6de7f5405ecfe7ddad95701dc03a6c73aa6de32dcb1af9
SSDEEP 6144:CbfvHWe40m3otUf+8Wp53EX9pxsNTAt4fLJ0L6nGJxi3bzqapJjO:G493obX3ETxsyWXUx8zvpJ6
TLSH
T10C4423B4C9C06C7BCFF9DA962819BE414EB4C6C78689EE201DF51D0A2609D7A0D13E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dfcee1e-6093-4af7-9fe5-97a388bc9a15.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\5dfcee1e-6093-4af7-9fe5-97a388bc9a15.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f74192af-a914-41ef-a96b-a036ed81db73.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f74192af-a914-41ef-a96b-a036ed81db73.tmp
Size 269KB
SHA256 760580874cbbe88a30f94fe548076392759693986d3fca73a66965f6554f55fa
MD5 c7e79d9781bbdf9941b0b43b59bbf3d9
SHA1 8f3052ff55be63fa728f300578ebaed0cfc3429e
SHA512 cb67fe46df07bd252fea8ca5a6f1648f30b218e4228421d466facc8265e884f4bdc369540519977734c5c9712841b3285f4de206b05a9a350090fe38518852b8
SSDEEP 6144:9BlvHWe40m3otUf+8Wp53EX9pxsNTAt4fLJ0L6nGJxi3bzqapJjO:9R493obX3ETxsyWXUx8zvpJ6
TLSH
T1914423B4C5C06C3BCFF9DA572829BE555F74CAC28589DE200DF51D0A264AD7A0E23A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b4e4e4f-4f52-4295-ba4b-c6712bd46416.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4b4e4e4f-4f52-4295-ba4b-c6712bd46416.tmp
Size 8KB
SHA256 566ad0c188d4c89cacd0eb8d5d76729fe012aa90ca861c480d8a23e8bc48379c
MD5 e045cb1a6907d863e17cf38a1996026e
SHA1 f85e4abfdd6841738b5582b9e68f94aadf1240b9
SHA512 872562784a95a86902ac50214b3d04fbf6703befbacc2306b54f918b30c906d44a71170e0bf28d4b066cd7e5aa7396431dc449cd307c89d9b80427390a2e1317
SSDEEP 96:DqGNk9Qsjpf4eEE325ih/cIPURHl8h4otop5V1iDBmB3PnvQixdZuP7inyib3Bdv:GGNt6GeLQmiUyzEc/9e76w+2u0/GTLU6
TLSH
T14F02EA35A8B87C7B8EE79E45B04777239FA0102BDAD56F48DAF81B1D01D769C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5397490f-c376-46c9-aa8b-702abc7368d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5397490f-c376-46c9-aa8b-702abc7368d1.tmp
Size 22KB
SHA256 49e2aa1db755593502cc116546d8f06fbda58d1ad232719a20f3a177957a01b4
MD5 9dbdf22c55d187418f127c332835b7cd
SHA1 26a5a978eede686111ce9c88243cf1762347eb97
SHA512 6ffd319570da6d2d8114e10044419c90a01d718dab83cc9d7d37b0bd8348ec0f1eee8f3f05f181d7963b2e4a2bd8ce6f6c8ff6af2f8b01365255e2b5863e0fdb
SSDEEP 384:vQkUSvB8N6SlMK7Ke5szwTQlJDwtdR+UqH7vBEjlTIIl9:xB8SzeUOt/+UqH75EjlTLr
TLSH
T1A7A26B3D9C641C3F89AEBB14A14D3A27AEA4117BD5F40E98DBD95B0DC0B658CF343825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67be71f2-599c-46e1-b722-e4d33e2a02f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\67be71f2-599c-46e1-b722-e4d33e2a02f4.tmp
Size 8KB
SHA256 5f88f6c6dedfede9b59d2d9c952c9ff907c4b86838af212f701a8cc2c0f244b6
MD5 e7f74973dd71cc7963f87b749cde1416
SHA1 bc23003943b695bb3486e52f9fe58c5bfd91c2ba
SHA512 3d2305de9dbd16f8d867d21f6ffd60fdcf5601db1578073beff9c3a83b1715e8df6bf0948230fc7fe3d27177c486cae164fca79c4b6fb7e8a467b04043e3517b
SSDEEP 192:TGN76GeOQmiUyOc79e76w+2QMYs1wEhqDU6:TGN765Kw79zwTQuGU6
TLSH
T1BC122A31A8A86C3B5ED3D995B0873613EEA14117DBC96F44D6FD2B1C02EF99C2307416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94f9dd59-344d-4495-8862-78ab00a746e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\94f9dd59-344d-4495-8862-78ab00a746e2.tmp
Size 105KB
SHA256 2ef96264d2b79f2f32ba7c3f4d8bc3a7cd12206153f6218f7bbe1251f2de650f
MD5 1ad9f96c1fcd1af763818d9e108bb5f4
SHA1 1e2816ec93f878922501ab302f5c8c4e7ebcd07d
SHA512 e00a04412dedd2975b5ca272c9660f6c9931bacff5f3a31e6eda9d9dbf0a5b61954f0ec88458dfe5f52a32f35c3785be60c678cc8a35853099cfde0c58ccdbe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7d:fwUQC5VwBIiElEd2K57P7d
TLSH
T1EFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b4a40ca26bf8b40dd6d4bb96f3b1b40e75981bbed21d8fe20231b4fb0a6b920c
MD5 48e2490867200968c658ab5d263908f2
SHA1 b6b1e2b68b59e053248e4e21e9851ebde9f5a432
SHA512 05f44212071aa2c097b4ebe7c3bef8f9c70e11d3d2fba2d7e7a84bc6036ab713e306ba978754542a30a670251dafc196850c64500d5a9b346555f51781eaa65a
TLSH
T182D08014E5777DFFC17F617505588B445554DA635543071495070C14095518B19E1FE4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc97280e46f7440a45ca3d2a51a46ccbb21ce65970031831397544d067fcd39e
MD5 87f523fa1a8097da3fde9c71dbb969ff
SHA1 7375fced196b7c9cce63a3345a696821addfdc92
SHA512 a94bf6eafa51a7b6313466d304e63e375b1cea0b04977cfda8012d4caa95bc0dd63b71901be89e02b766b5371ccbfa9869b8ff1599483dc18a36d6c017ae936b
TLSH
T1E4D02B18C5FAB5A2C0372938112A4309718CD01164431200D0810591084335B02D10B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 70982429a94c7f5dd6771982ccb678db478417c7823f5314a8ce85f4a72ea496
MD5 dfb696b1e6808f46315e2c8c5c490abd
SHA1 eed8ea23066b3749e52e643f4324c70d274c6e27
SHA512 746adb56bac7e6958650c3d0d518b5083955a4fd952fc98e6a5d9afa120b58ed181711f9d8797d55a5873c62e5525749aaaf733913575d7e6f10d2eba443d3f2
TLSH
T129D02B18C5FAB9A2C437293811294309718CD01164435301D0810591084339B02D10B0
MD5 SHA1 SHA512 TLSH

Submit Download

2ebb62e3-44dd-4003-9cba-e4c0478a78c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ebb62e3-44dd-4003-9cba-e4c0478a78c3.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7f53591e-b0f5-47fd-8e06-e8bac1d9d206.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f53591e-b0f5-47fd-8e06-e8bac1d9d206.tmp
Size 28KB
SHA256 8d2eb1e7ec9dddf9401f82d2595f2c132a3ce1a282fc36b15752eadf501cac91
MD5 74f02cbf849399e9360058542cc0d777
SHA1 363fbf4c12fa3eb6e93424f8be082c9eef1dc6dd
SHA512 8902d7a5c537731bf33c11463b68678ce490c5a2caab162165bcd98c0deea41bd61c7381e2545bf5a4167ec26a15f722ecdcc974f2821a35ba55effe470c45a5
SSDEEP 768:BO0nQWwy89q2pdWRm1rQ/78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nQLl/CE0M0nL:BO0nQWwy89q2pdWRm1rQ/7u1jaKnQLp0
TLSH
T1B5D20B3F240CCB7E4FC04AADDC566F976E9802C7A6549D4087FE894C02D77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b6a57668a729ebfe8d4690e0b336ada29a4703cb9505a53c716578a366468386
MD5 3eb831dc39c6355daa2ee8d9ce05091c
SHA1 1cbef46b2d94d905381c145769aca37bfba330d0
SHA512 739bd335c1e64fbdc5dc9b1cf5374465724f88e04e8db7a2f50956868367b1fbdb968f6b2cac808de40ebdf8fedab808eba922c792c09e48b843111091d23aee
TLSH
T1168133F6662B3290EBF46378A5C721863F7D758A7C432E9D0054CFBACB0178E71A8048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a02d49d679a0ad2f420864224da9fc45ecada84e69364b5c96649db8cfd9f838
MD5 7a59a356fdd30cdf4d8bc703fada317f
SHA1 d80d3f04b85bc19c1fb1ced62f390610cc91d8f5
SHA512 011750f49578ab035ca83cfc208cce92bfba61606f19f983f912eb786018674d1ce654cba8deda92bba9a934d7c33e583ccfa274577c185a56e710972188c7cb
TLSH
T1F15182C6673B42E4FFB5237CB1D53187377DA98E71832E8500A4C3BB4C0638682A8040
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

e213a1d6-5d63-481e-ad64-8f974a874f75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e213a1d6-5d63-481e-ad64-8f974a874f75.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

171dd0ca-0081-4c79-ac1f-6cad863baa93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\171dd0ca-0081-4c79-ac1f-6cad863baa93.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

3ce97ec6-4fbc-4467-98f4-2d5233473b00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3ce97ec6-4fbc-4467-98f4-2d5233473b00.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

bb8516d4-72d5-4150-a555-e1438847de49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bb8516d4-72d5-4150-a555-e1438847de49.tmp
Size 1KB
SHA256 6015952b46be8cd2bee81d8950b592d9793004c902a803ff7fda2554abb7220c
MD5 2a6218a0628648793946b2e611834ab5
SHA1 c6d68778bb0f033b3eda38e4e7dc812b0e24a89c
SHA512 ce796bb9bd4580e4dd5b9c1a3564f07a861a6b64e68663905846919896a4aaccc70a513c95ec6a3110f0af248bac22ba81b57bb636fecd7c9975fdb30c63a10a
TLSH
T17A219CF3C3E9956E891556F09A14AE2BCE1C0506832C7D2989D4AE2793E3471E00565B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 1cd73f4080aca8692dbda4a943187f1e6365cb62b150968f94e9e1e2244ff04d
MD5 7873a0450db6de5419e805ec0ec37623
SHA1 76ea3ba46196533c319be5dcde48f2c77fb60517
SHA512 f71c7571a1a516f28303419cdcc5f8b78f3c77fdbaf76812931496ef9993f3e2fad66109a0ebe0164567e4e3c7720e4d00a13a6d85b3bcd757467653308423e4
SSDEEP 48:K4bIhKkY8fy9bINKoEYIHIBKgA0PyrQnGSACOfbG12IqKfKlO9cfxoP4dWh:K4b2KkYmubWKoE/HmKgAeWf+KU0o
TLSH
T14FB1CB4172BA534938FE290891F8AB1B02417177341DE6BA7FBD04A68E77F085CF99C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0773a37-bbb6-479d-af0d-53f4258a1aae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0773a37-bbb6-479d-af0d-53f4258a1aae.tmp
Size 10KB
SHA256 b4e0b516984f2e9142fb7497f8eb304e451e50d806753bcc103920d8765cf315
MD5 5d36571a2a922ffedbc7f3ac13a1abb8
SHA1 8cc7977b4ee46873a1b72ae60252dfbc5c8879c4
SHA512 1155b4a7c185d005265a228a83a34cd95416e2f7d2ec589a03a468f59a36fbe61130a2981fae8489935dcb67498342c3282c60c46cde50569208866306d4fb9a
SSDEEP 192:sxZARROD/fQsBRIdpKlb/W6+WNeGkK4/Y0txAdvOcIgrJ:sxZAuD/fQsBaA/bXp4/5XQp9
TLSH
T19A22B8166E34697B9CCBD24DBA15BF53E6F9103291D11E88EAFC851C05E76CE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4d8ec6e-16b1-400b-a1bf-a7fb5447f136.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4d8ec6e-16b1-400b-a1bf-a7fb5447f136.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e73c6371-83fe-41b3-a63e-e5d6db03bedb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e73c6371-83fe-41b3-a63e-e5d6db03bedb.tmp
Size 11KB
SHA256 e2f1a914db49c00528a52e39000b9c761250b0cda705837a6113a0b5a62b205c
MD5 220ebf5da7bf487a56761f0ae5c9b341
SHA1 62cc6eac4c92a172d8a46b2904e09a33c851a361
SHA512 4869fb8f20da8723b52e7344e3c3eb0020d8180d11b883eb4bc9a95f34f2256968b6c37632167408d44244ad344dfb0eb89d28c579cd0b97e910115c57780ffb
SSDEEP 192:sxZARTOD/fQsPWpVR/IdpKlb/W6+WN0bGkK4/Y0R9A2zv7uIgbtJ:sxZAID/fQsPWvRwA/bhp4/5f16j
TLSH
T1B732C6166D34A87B9CCBD24DBA65BF13E6F9103291D11E88AAFC851C05E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f44a4728-8137-46cd-a87d-caf5a9b071a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f44a4728-8137-46cd-a87d-caf5a9b071a3.tmp
Size 18KB
SHA256 ddf5b136337aea9ffe59761e433dd7c65e5342f1ee8278e26fa7816694b749c9
MD5 5e85af0d4a836275d81e468949460a4f
SHA1 ffde6aebd16f3a2a538a0c5dde69879c43f6e4c1
SHA512 58c250a50a0499ffbc0fcab4d4fa0f943641e1547dd06b31ce12fc4bda488828fdfba1bbd99b6d75b8e0b366d664d2064d21f561da37f60e9f991ea44bdea28f
SSDEEP 384:1QkUSvB8N6GlMK76z5szwTQcGH7vBEjlTIIl9:PBNSzetGH75EjlTLr
TLSH
T10D828C32A8B86C3F4EA3D591F14A3613EEB0905BDAC85F94D9EE671D02DB2DC2307416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_stderr.txt

Path C:\Users\Admin\AppData\Local\Temp\LabSample_20261102_182533\launcher_stderr.txt
Size 95B
SHA256 c87d58ba0583bb0105c76415fdde16296621b49988b2b88ffa859c1b36481c2f
MD5 9726a433abfecf305885ac649d5d39c5
SHA1 3c0fd7be6f124128c0c30e48e896e31f1f8a3393
SHA512 34ba8256a0b577de4bbcb1a428a6a9ffcfc9d0bf47cd667b61a571e0d78396ca18bc853145f6447e0cff04808ace18f55a3f41b53c0c0e938c54242f8fd17ac4
TLSH
T16BB012F70EDD155500079001A2140540401CB491A24D87D213450B2F80A6F10A21CA0C
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_stdout.txt

Path C:\Users\Admin\AppData\Local\Temp\LabSample_20261102_182533\launcher_stdout.txt
Size 61B
SHA256 3a49d8a334ffd7505be79c67114e39afe6012b991597975fabe7d1b946958a20
MD5 c9ac82bef8a8822df4c01fa04c43aed7
SHA1 b4439a637b24e8068319b788e2a0fbadcca295f0
SHA512 41370d40ca141bf2b2de75fce61df37e51e9af7fb4a6b2a4a7a463845044d0e26768830bb53ccf8350e9394b6e9b039bd5ff30fffabc6925c25d2c2f5e1e6007
TLSH
T159A0026A05C98D376154A212157957C841540A316A20EF17D5905A04B3215795F59503
MD5 SHA1 SHA512 TLSH

Submit Download

original_sample.bat

Path C:\Users\Admin\AppData\Local\Temp\LabSample_20261102_182533\original_sample.bat
Size 2.0MB
SHA256 c1d17c170c71cc0cab61b975fc23ec1dd06281cae730ce4f7f04ed45670663a4
MD5 7dfa95c5cb24e7460e3b48ed0cd8d4c7
SHA1 1fdf66829653f9075dc20c74a6f4fd48041c6703
SHA512 a08d037ae403c90a971787d91d8bcf5b06a80d0497a1e11409ccaac2f015378a9326a3d2d289cdcb2523f7e362c1b4142f63f781cc2f265636b65af61a422d26
SSDEEP 24576:24sTWlX8qOhSwF5BgRWIPizvlyU8yR1UfALW9VmSfqshXMf5NE0wVVDa0fWefvjb:248qNClyU8lDmStYkvjR3dbLIF9Bu1
TLSH
T1D8A5CF3789A37DEF772C2858980C2C430D5C676746A5496CED89477E3CC9222EB6C9BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VWRJGUMCHOEEOVMLOJIW.EXE

Path C:\Users\Admin\AppData\Local\Temp\VWRJGUMCHOEEOVMLOJIW.EXE
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VWRJGUMCHOEEOVMLOJIW.ini

Path C:\Users\Admin\AppData\Local\Temp\VWRJGUMCHOEEOVMLOJIW.ini
Size 3KB
SHA256 c72a53aac610267bd35cba0a71e1fbd3ab1caeab12c8713321cdf125d30bf8bd
MD5 7480b12b5426b4b8709054b41c18d59a
SHA1 91b156e34a015ad72d4d37d23ea3df91967c7a9f
SHA512 71ec8f4162aa40d83fe99e9249c56048d2ef5a9cdf1e8a7851b68995efc38c20f1e55bb9d6f7965a8fc228d62c3d6e6fd408578d32b7496a27555bb56842a908
TLSH
T1B761DFA9AE5356EF3889811B8815C55FE2BC27B5C2EE44C2F5172F6F400C36DDA92232
MD5 SHA1 SHA512 TLSH

Submit Download

VWRJGUMCHOEEOVMLOJIW.zip

Path C:\Users\Admin\AppData\Local\Temp\VWRJGUMCHOEEOVMLOJIW.zip
Size 470KB
SHA256 61fc30d652e25090b09a64f53679d42d8fe3337f6be8ef7290a9c5a797937604
MD5 080dd2f89fdb77e33a96ce99fc7a5697
SHA1 ea073c9980754a86ddd21b7b72d9703809f643c8
SHA512 53dd2803a84acbfbfb71fc0089631ef51c88979054d06113321b4f23e7555a8ff1b52efa0f191ee6fcea64531b386fcd0a74e30c3bc8108b68d1d53f7c69d708
SSDEEP 12288:cA4/N1dmN8Lz0EClGA/dBawdb/Sh5s3q0O2DFR:cAMToBawMh5sndD7
TLSH
T1D9A423136C410BFBD4E7187466A2CA85C5AD9DA354AE7C977D01E05838E067FFBA20CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_uz1agyng.ak3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uz1agyng.ak3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

environment.ini

Path C:\Users\Admin\AppData\Local\Temp\environment.ini
Size 381KB
SHA256 5c1c5335f3e4dbd25c36f0695a74d5d77d363f52895b4a4d161b729fed9f4657
MD5 351fa54391fba05a683749974881887a
SHA1 a62a9856cd5cbc1d0d5a1a02753dd2807c199979
SHA512 83bb7c11c5b62ec85b10393c12eb02b08d849adb0f57fbaad76540c697d0cf3b492263110e67f3ad81a90f0345d24f40a2e0ffe107843653c1365a7a7b16af16
SSDEEP 6144:knq/xq/C8plV4rl722JJ21nYCI8j004+UfotOdf/Bjy212FZNLbBid4W83MVDQS+:oqOQ5TyS4GfSOfM212FZtbQrVDcF
TLSH
T1BD840286F98D18B40BA8C1B98D5B6BCF50F8DEDE0704A3971FACD8D513542798DCA827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp1.txt

Path C:\Users\Admin\AppData\Local\Temp\temp1.txt
Size 1.3MB
SHA256 f2ad6da88c74ce99186d6fa84e844e8d7a8f57262efd85dd41f7a122756f8f88
MD5 7381051ebd47fdd632f6599efb73a090
SHA1 349cd63489564b0127a65d4fbe69b109d7f40d59
SHA512 381934af7b09b64b09c2c11a8733006166c1542fd2b088404e474af39f7ee9b4e208ad353c706047c175c3deae66cb525bc76149edf9d81936d76497f74ed778
SSDEEP 24576:XX8qOhSwF5BgRWIPizvlyU8yR1UfALW9VmSfqshXMf5NE0wVVDa0fWefve:XNClyU8lDmStYkve
TLSH
T17C55AE3A89B3BDEE772C2858940C2D430D5C375347A5496CED4A477E6CC9222DBAC9BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp2.txt

Path C:\Users\Admin\AppData\Local\Temp\temp2.txt
Size 4KB
SHA256 5140e55a3f95070df5f06dabe125b9dd3553c302a2c53cc6a55383c9a643ff89
MD5 bb6da2a8975668c687ba172f2563af55
SHA1 ac7903940868c7fc5e7d15b94e4400db73436004
SHA512 295419abc9eb61555e5ed0591b4381182c739df5eb2ae69133c31f7f0c363ac3a427f11962eb2f90123b425fd2ca77add53bf1c5927cc33f80daad8c457b1f2b
SSDEEP 96:LrvecHDDprHI8pyeJQ3dvfAAwkXx1I3dv17FtQPteJhrDx:HvhnprHI8pyeJQ3FfDwkXx23F17FtQlw
TLSH
T183A131E124024419BB1369DB47BAD0D10D3DB13EB61AE4A25DCC61E85077D73A17D8CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp3.txt

Path C:\Users\Admin\AppData\Local\Temp\temp3.txt
Size 647KB
SHA256 5ff96f535362d593374b1ab550b163214d63eaa2472528f6a45d96082c674847
MD5 07f2dd782bb49f5497f13775ed060aa9
SHA1 2015124e1c06551baf927e67efe3c40c737d04a9
SHA512 1d27149df7b599db9467b9a8cd36b6fea9043b0d8cd0567bbf4565718713c9f299b27e9a402a7a3f6d167e41580c69b72ad92aead5c8bfc2d5f928b86c64bbad
SSDEEP 12288:gVrLvZ8YN0GdiZIaUT9RKR77t2KTlPR98VOmDuo86uA7oVnuxwP:IXh820Gdb3707hlpR9MYBM0uGP
TLSH
T15EE4236595423AE10C52F27AB611F8C6229F93870D4B26460374D7BB70FA1E8A7A7CF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
Size 524KB
SHA256 e1a946cb639775802a457bd35f4c3fa7cfe0b1e20f1db1c3648b6a4d4d3de013
MD5 a95974d53a3322a09516b84dd6f3db0e
SHA1 a1a9fcc77463c000bbbb38bf79f9fb4f462e03d3
SHA512 cbd68f18d11e251262d54acad477f7c571735fc67901933771119a9f03232d29453b3a21731e26f56bb27e4541e6727362b3664970f58fd27aa214cff4b9d81c
SSDEEP 6144:OblaXMYq62lyMRvfW4RSyG80SEmecPO++gqHmK91fHT7J2D:8a5HYy0vfWfyGRnCWnjZT70
TLSH
T1B8B4D63BD20391B6C4473733064BA09F31685719C4217F6F9E9C2D98F73AE50EA692A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~run.vbs

Path C:\Users\Admin\AppData\Local\Temp\~run.vbs
Size 146B
SHA256 e70eaec125458651817521e44147605df73c5f4cdc13133f95b871817bab24ba
MD5 dc6edfe811fbcf869a563fba75b4ebab
SHA1 4ecffd9dfac499a2e45cd94cd7ed596a0c05c913
SHA512 3657ea39645b8a92c49b1d36d78c43c0555cb972cad78a3035c89153d70e0fce21a10c922ca7dfead7aa806a9ebe08ab3ca0038f64cc81c9d0d165d230c30017
TLSH
T108C02B04D18CE239002EE2720134C90CC490CCA42BE1EB45BF20C74C5136C81F68A39A
MD5 SHA1 SHA512 TLSH

Submit Download

452b791f-0b84-457b-9f12-967a14169104.tmp

Path C:\Users\Admin\Downloads\452b791f-0b84-457b-9f12-967a14169104.tmp
Size 4KB
SHA256 59d3e845525f165f8b42b9bb843b88ffdba4d2f7ec17f4db81498c16381809c1
MD5 85cc15b239f766fe43d626afda3d58ba
SHA1 9d63141e58add6caddc2e9953f63d9488d787117
SHA512 a24773ead2d5ce3a3e37c2c5b3c7fa239704a79a6c74f9f69df76de36e131d72cb7fd0028a0362bd4daf67b009743882792ed104bbecdb6e74c5b4ff0836b903
SSDEEP 96:Lr7UO0HfvY4W5V6sgT8eC/vlwiLTNRoaDMnDFbqgH0Ta:Y/H44W58KbdwiHNRFDfgoa
TLSH
T119916E294F32C611943AC498704A535EA55F82C8F8E1A4F805032BCBBFDE1E765F5E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ANYRUN_Analysis_20261102_182533.txt

Path C:\Users\Admin\Downloads\ANYRUN_Analysis_20261102_182533.txt
Size 16KB
SHA256 139ea5f16eb3488afc9cdadb16687c222e84a14786e69b0596dc6c005a062f33
MD5 28910343045b0224f59576bb0237508a
SHA1 61a8fb8fd192cb0c9d1207f0e0abf65d5d49cf06
SHA512 5679ab1e8b0dfe380c5d665958cbecb444219064ec5d66926b7a4650e0065ce4574c3dfeb0b88f38427e1546b59c2540f906c4ce649007d14d1c99332340382c
SSDEEP 192:lgNa2lYjHDnKIbWQPBgFOn396JJ/PeOks12c0qcd006uywJOre2/1HVVQmgJFrh2:yNblqKuQ2rKG5iUnEjB
TLSH
T18D72CDC0998EC2F77941542725B96EDF91F825A72F981FCC3B02E81C7282C7BAAD7541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ANYRUN_Sandbox_Analyzer.zip.crdownload

Path C:\Users\Admin\Downloads\ANYRUN_Sandbox_Analyzer.zip.crdownload
Size 1.2MB
SHA256 1aa204715a8adb6a4f385da20692dd29a3b1664aa2cc4afae643807cc74647af
MD5 bcd71be561c8af6be9c8c3b2aafe4c9d
SHA1 0a0fb53c4f60e3f55e58dc1b249762235b7ac28c
SHA512 4a4dfbd7f03c134d5b6fef75280f9b76b385ade45e46f4aa5ef2c19294ff9d3f8759063f77cee150031224a8814ad96e0aac2eff12a20e75f3f2b2346d83bf55
SSDEEP 24576:d6k4htcp2G7+wBHCPw9lshgc/BL7IojPQdaZu7PL7Xks25RG9fgyVyoyBBm1W97:r4Dcp2Q+wBHMwo7/BfIKQdao7PL7U16M
TLSH
T1CE4533629B48FE90D47201BECAD59253D6E9B48134EF12FF27013BCE681DE4D1AB6523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ANYRUN_Sandbox_Analyzer.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\ANYRUN_Sandbox_Analyzer.zip:Zone.Identifier
Size 170B
SHA256 d53fda1c49c323a4d61b535956fefdc519dbc68a328dc2ca900e7410cb252fc3
MD5 ce4caa90aa3dd868fdeef9c39f6c08a4
SHA1 d2714f493336df7f29d6f65633aa089fcc2ca03b
SHA512 8bc461917a460af41f51c6cb2ba3b544abfd63bf7e100001d25944d0ddbc91b5a484c64dec5c5677394a63e33a7df8841834c903fadccab651f48b7eb265706f
TLSH
T12FC08057484884E2630C67C411ED418CB60F5744CC79CF28DC50458F94C6DA5DBE4957
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2168-781-0x0000000009D80000-0x0000000009D8A000-memory.dmp

Download

memory/2168-623-0x00000000FF3C0000-0x00000000FF3D0000-memory.dmp

Download

memory/2168-774-0x0000000004910000-0x0000000004952000-memory.dmp

Download

memory/2168-775-0x0000000007740000-0x0000000007CE6000-memory.dmp

Download

memory/2168-776-0x0000000007370000-0x00000000073D6000-memory.dmp

Download

memory/2168-453-0x00000000FF3C0000-0x00000000FF3D0000-memory.dmp

Download

memory/2168-778-0x0000000009DD0000-0x0000000009E62000-memory.dmp

Download

memory/2168-779-0x00000000FF3C0000-0x00000000FF3D0000-memory.dmp

Download

memory/2168-780-0x0000000009E70000-0x0000000009EC0000-memory.dmp

Download

memory/2168-455-0x0000000004110000-0x0000000004154000-memory.dmp

Download

memory/2168-782-0x0000000066D80000-0x0000000066E09000-memory.dmp

Download

memory/2168-452-0x00000000FF3C0000-0x00000000FF3D0000-memory.dmp

Download

memory/2168-451-0x0000000003FA0000-0x0000000003FA1000-memory.dmp

Download

memory/2168-454-0x00000000FF3C0000-0x00000000FF3D0000-memory.dmp

Download

memory/2168-676-0x00000000FF3C0000-0x00000000FF3D0000-memory.dmp

Download

memory/2168-691-0x00000000FF3C0000-0x00000000FF3D0000-memory.dmp

Download

memory/2168-603-0x00000000FF3C0000-0x00000000FF3D0000-memory.dmp

Download

memory/2168-477-0x00000000FF3C0000-0x00000000FF3D0000-memory.dmp

Download

memory/2168-456-0x00000000FF3C0000-0x00000000FF3D0000-memory.dmp

Download

memory/4600-431-0x000001DA7E0F0000-0x000001DA7EBB2000-memory.dmp

Download

memory/4600-395-0x000001DA7FAA0000-0x000001DA7FACA000-memory.dmp

Download

memory/4600-394-0x000001DA7F650000-0x000001DA7F66C000-memory.dmp

Download

memory/4600-387-0x000001DA7F100000-0x000001DA7F11A000-memory.dmp

Download

memory/4600-386-0x000001DA7F0D0000-0x000001DA7F0E0000-memory.dmp

Download

memory/4600-385-0x000001DA7F0C0000-0x000001DA7F0CA000-memory.dmp

Download

memory/4600-384-0x000001DA7F440000-0x000001DA7F4F3000-memory.dmp

Download

memory/4600-383-0x000001DA7F0A0000-0x000001DA7F0BC000-memory.dmp

Download

memory/4600-396-0x000001DA7FAA0000-0x000001DA7FAC4000-memory.dmp

Download

memory/4600-367-0x000001DA7EF40000-0x000001DA7EF62000-memory.dmp

Download

memory/4600-791-0x000001DA7E0F0000-0x000001DA7EBB2000-memory.dmp

Download

memory/4600-785-0x000001DA7E0F0000-0x000001DA7EBB2000-memory.dmp

Download

memory/4600-783-0x000001DA7E0F0000-0x000001DA7EBB2000-memory.dmp

Download

memory/4600-777-0x000001DA7E0F0000-0x000001DA7EBB2000-memory.dmp

Download