5a768dc4ad8d869e57c1be1a2b9a0d50852321f7553c566b140bc9dabc47a1ea

Analysis

user interaction
yes
max time kernel
106s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 39B
Sample261102-zedwpsc17w
SHA256 5a768dc4ad8d869e57c1be1a2b9a0d50852321f7553c566b140bc9dabc47a1ea
MD5 30c62700d68340c9ca029c08f91c7491
SHA1 835e6b8910bb1cb8a330ecfb909adc55e267e6c9
SHA512 a810de47eaa14888b12393a8245516b8db48079dc4bf2b7cd7286fd2e5a8897278ba9c5ed7d6587a8fd07329cdab2c45d23f08422a058316360289b2871b354a
MD5 SHA1 SHA512

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4012	PowerShell.exe

Executes dropped EXE 7 IoCs

pid	Process
3296	vgh4d57.exe
1036	d847fsoja2.exe
3344	d847fsoja2.exe
3592	d847fsoja2.exe
2236	d847fsoja2.exe
992	d847fsoja2.exe
3260	d847fsoja2.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 3344	1036	d847fsoja2.exe	87
PID 3592 set thread context of 2236	3592	d847fsoja2.exe	89
PID 992 set thread context of 3260	992	d847fsoja2.exe	100

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4012	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
72	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4012	PowerShell.exe
4012	PowerShell.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4012	PowerShell.exe
Token: SeSecurityPrivilege	4012	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4012	PowerShell.exe
Token: SeLoadDriverPrivilege	4012	PowerShell.exe
Token: SeSystemProfilePrivilege	4012	PowerShell.exe
Token: SeSystemtimePrivilege	4012	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4012	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4012	PowerShell.exe
Token: SeCreatePagefilePrivilege	4012	PowerShell.exe
Token: SeBackupPrivilege	4012	PowerShell.exe
Token: SeRestorePrivilege	4012	PowerShell.exe
Token: SeShutdownPrivilege	4012	PowerShell.exe
Token: SeDebugPrivilege	4012	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4012	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4012	PowerShell.exe
Token: SeUndockPrivilege	4012	PowerShell.exe
Token: SeManageVolumePrivilege	4012	PowerShell.exe
Token: 33	4012	PowerShell.exe
Token: 34	4012	PowerShell.exe
Token: 35	4012	PowerShell.exe
Token: 36	4012	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4012	PowerShell.exe
Token: SeSecurityPrivilege	4012	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4012	PowerShell.exe
Token: SeLoadDriverPrivilege	4012	PowerShell.exe
Token: SeSystemProfilePrivilege	4012	PowerShell.exe
Token: SeSystemtimePrivilege	4012	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4012	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4012	PowerShell.exe
Token: SeCreatePagefilePrivilege	4012	PowerShell.exe
Token: SeBackupPrivilege	4012	PowerShell.exe
Token: SeRestorePrivilege	4012	PowerShell.exe
Token: SeShutdownPrivilege	4012	PowerShell.exe
Token: SeDebugPrivilege	4012	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4012	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4012	PowerShell.exe
Token: SeUndockPrivilege	4012	PowerShell.exe
Token: SeManageVolumePrivilege	4012	PowerShell.exe
Token: 33	4012	PowerShell.exe
Token: 34	4012	PowerShell.exe
Token: 35	4012	PowerShell.exe
Token: 36	4012	PowerShell.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeCreatePagefilePrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeCreatePagefilePrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeCreatePagefilePrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeCreatePagefilePrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeCreatePagefilePrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeCreatePagefilePrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeCreatePagefilePrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeCreatePagefilePrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeCreatePagefilePrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeCreatePagefilePrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 3296	4012	PowerShell.exe	83
PID 4012 wrote to memory of 1036	4012	PowerShell.exe	85
PID 1036 wrote to memory of 3344	1036	d847fsoja2.exe	87
PID 1036 wrote to memory of 3344	1036	d847fsoja2.exe	87
PID 1036 wrote to memory of 3344	1036	d847fsoja2.exe	87
PID 1036 wrote to memory of 3344	1036	d847fsoja2.exe	87
PID 1036 wrote to memory of 3344	1036	d847fsoja2.exe	87
PID 1036 wrote to memory of 3344	1036	d847fsoja2.exe	87
PID 3592 wrote to memory of 2236	3592	d847fsoja2.exe	89
PID 3592 wrote to memory of 2236	3592	d847fsoja2.exe	89
PID 3592 wrote to memory of 2236	3592	d847fsoja2.exe	89
PID 3592 wrote to memory of 2236	3592	d847fsoja2.exe	89
PID 3592 wrote to memory of 2236	3592	d847fsoja2.exe	89
PID 3592 wrote to memory of 2236	3592	d847fsoja2.exe	89
PID 2628 wrote to memory of 2468	2628	chrome.exe	92
PID 2628 wrote to memory of 72	2628	chrome.exe	93
PID 2628 wrote to memory of 2776	2628	chrome.exe	94
PID 2628 wrote to memory of 2776	2628	chrome.exe	94
PID 2628 wrote to memory of 2912	2628	chrome.exe	95
PID 2628 wrote to memory of 2912	2628	chrome.exe	95
PID 2628 wrote to memory of 4512	2628	chrome.exe	96
PID 2628 wrote to memory of 3684	2628	chrome.exe	97
PID 2628 wrote to memory of 4512	2628	chrome.exe	96
PID 2628 wrote to memory of 3684	2628	chrome.exe	97
PID 2628 wrote to memory of 848	2628	chrome.exe	99
PID 2628 wrote to memory of 848	2628	chrome.exe	99
PID 992 wrote to memory of 3260	992	d847fsoja2.exe	100
PID 992 wrote to memory of 3260	992	d847fsoja2.exe	100
PID 992 wrote to memory of 3260	992	d847fsoja2.exe	100
PID 992 wrote to memory of 3260	992	d847fsoja2.exe	100
PID 992 wrote to memory of 3260	992	d847fsoja2.exe	100
PID 992 wrote to memory of 3260	992	d847fsoja2.exe	100
PID 2628 wrote to memory of 1620	2628	chrome.exe	101
PID 2628 wrote to memory of 1472	2628	chrome.exe	103
PID 2628 wrote to memory of 1472	2628	chrome.exe	103
PID 2628 wrote to memory of 400	2628	chrome.exe	104
PID 2628 wrote to memory of 400	2628	chrome.exe	104
PID 2628 wrote to memory of 1624	2628	chrome.exe	105
PID 2628 wrote to memory of 1624	2628	chrome.exe	105
PID 2628 wrote to memory of 3308	2628	chrome.exe	106
PID 2628 wrote to memory of 3308	2628	chrome.exe	106
PID 2628 wrote to memory of 2180	2628	chrome.exe	108
PID 2628 wrote to memory of 1528	2628	chrome.exe	109
PID 2628 wrote to memory of 3208	2628	chrome.exe	110

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Users\Admin\AppData\Local\Temp\PkgCache852\vgh4d57.exe
  "C:\Users\Admin\AppData\Local\Temp\PkgCache852\vgh4d57.exe" x -y -idq -p8KRivOi0 "C:\Users\Admin\AppData\Local\Temp\PkgCache852\07v7x4jw9d.rar" "C:\Users\Admin\AppData\Local\PkgCache852\"
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe
  "C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe
    "C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe"
    3⤵
    - Executes dropped EXE
    PID:3344

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3660

C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe
"C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe
  "C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe"
  2⤵
  - Executes dropped EXE
  PID:2236

C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe
"C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe
  "C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe"
  2⤵
  - Executes dropped EXE
  PID:3260

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fff55b8c728,0x7fff55b8c734,0x7fff55b8c740
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,279586616851128026,17443291338004489046,524288 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:72
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,10945445299708664377,17098496136796192171,262144 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,964108168401374362,2821702595840572687,524288 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,6943721520855189454,5391043611781891063,2097152 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,12791812860326014850,16879889080308424396,2097152 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3912,i,8064702008668455771,16674353729433309100,2097152 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,9520661128964132441,16125670999915846521,524288 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5608,i,16137414210510140578,17988774485377517280,2097152 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4480,i,4514426362815552140,4973175720837898014,2097152 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4260,i,11846938962984994298,18375570333278943876,2097152 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4264,i,16410153717163583733,2531577456911713680,524288 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4644 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3568,i,7192509534191922994,16654306955821218315,524288 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4484 /prefetch:14
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4428,i,11658229268143385349,10486476341395569014,524288 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,14363487115646557841,1092853891966745942,524288 --field-trial-handle=2112,i,8368031204479789578,13195739303582276917,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3204 /prefetch:14
  2⤵
  PID:3208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

129de004-15e1-4d69-99f7-efb8798f23f8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\129de004-15e1-4d69-99f7-efb8798f23f8.tmp
Size 270KB
SHA256 11849bd979002cdb45dbf39ad86f2e6a22a9e0b1ae5e973afdeaaffe357c0ec5
MD5 dd774b7aff6c4b65ffc551c8d349f4c1
SHA1 21a07aaecbf81b16e9175760abad6170cb699e61
SHA512 4ebb95d98fa387ac49f8b60849fd784ae25bab09360e38c32704be3828b19c6194d175639dc41d2d55b77d4ded1a65cef08dcc45abc90338579d57c33fc5c5f2
SSDEEP 6144:utvHWe40m3otUf+8Wp53EX9pxsNTdzAMQjmvaFezXEmLOMzexH:K493obX3ETxs3n2FezpOxxH
TLSH
T1EA44237848DE9C7FE778912FB80ABE073DE847976194C6653C9036CF2517EEE09921A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44fb62d0-553b-454e-b7c6-04907a7f18ed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\44fb62d0-553b-454e-b7c6-04907a7f18ed.tmp
Size 130KB
SHA256 b02e52569ba1d04d49fbdf824a04da6c904c2ceeb9f5e9971008316f42b246f4
MD5 424d0dbfef8cb550cd217e533126a15f
SHA1 63a72290c63afa5425c3dd3bd58b51d5aa3042ff
SHA512 5a0d85eff565ee73129a7a7939a88f12b5017329d4d34bdfc669e54136c78c52e785e8ba9483d8376383edb9a9658174181213252a7d6960f5bbd5d641591cb4
SSDEEP 3072:CxKif3RLelUpM3AjGFIuj3Oj+AeiMHXHkm+q4E2ksAzexY:dzAMQjmvaFezXEmLOMzexY
TLSH
T1CAD313B4657EDCAEE334E51EF9D95B4A3DE165E724D453EE3880A2CD88B37E801C0590
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14d8aba2-f982-4f67-9397-efddf95ac63e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\14d8aba2-f982-4f67-9397-efddf95ac63e.tmp
Size 414B
SHA256 d7a2e7781df3727d4403a49241e859554a702b5e5137534ba41293abb5672d64
MD5 a6459cb568970ab19b9d904088d6fdd5
SHA1 aabbebb7e309af570166cd799e57dd5a80435c94
SHA512 ab464d29efa6433011f229cb25daa01dd35c1c85f16b68ade16063181a7d53f289b6f325ed5b251e722ae492e6255ff55159a4fd5497435b13fe740d64b6a7d2
TLSH
T14AE022AED934EC272DFD07A86559478AF64513473A808A4F3B3CC1188FB063B459A8AC
MD5 SHA1 SHA512 TLSH

Submit Download

582b0c30-dbf1-4043-9e3d-c1d44ba91a25.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\582b0c30-dbf1-4043-9e3d-c1d44ba91a25.tmp
Size 12KB
SHA256 306b81c817157a4a1307da641cf5bb1f6463ec5dbbee7e0accd89896c41052ec
MD5 e14cfd3c03b1eb16d3ca9067eea279f0
SHA1 fc13d648ffc4e8c451abcc204f4eea165e0053dd
SHA512 1340568a3b8be41dee0c8c7f822aee50429bb26d2bcedf0055f43badf6967c4379a6c7f6b0b1ead39ab972c48108b5241da03149d7f8cf06c119e3e700a278de
SSDEEP 192:uKR1gBV72hv74pAPRp29PiQ93Hsb+WNn5uOV6YkkuVTnQg0VyIsnAUgraJ:JR1gBVixUUX8HxwENYFuUe
TLSH
T16A42B62EA950797BACDBC26AF951BB1BE7F2102124D42E84EAFCCD2C14E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65ebe7e6-bf24-45f9-9c3c-99e11828faf0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\65ebe7e6-bf24-45f9-9c3c-99e11828faf0.tmp
Size 12KB
SHA256 301c8c817afbb34e14afbf3074b0112986a8c71ff65bb29cc5ac5b295bd32446
MD5 f5026f6a6e28aba9c3ab4ffa6d8690c1
SHA1 0c7c219f8dd73a97b4ba7cdf91321e9bdadd5b03
SHA512 25d2fccb42d647800c59c5695290a7a95a199903f251cf917dff2c036c3c897591eb23179cde7700d2ceb0747d78bd9736a019c7a632d42f1458f76cc4aafb0d
SSDEEP 192:uKR1sBV722v74pAPRp29PiQ93Hsb+WNn5uOpO2fkuVTnQghVyIsnAUgtaJ:JR1sBViCUUX8HxwEl2cu78
TLSH
T10442B62EB950B97BACDBC25AFD55BB1BD3F2102524982D84EAFC8D2C18E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c188865-ca6c-4c77-9a13-409758ee45a8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6c188865-ca6c-4c77-9a13-409758ee45a8.tmp
Size 12KB
SHA256 a1149a2845a6a547f65b27f2c919e03a2a64e496ec1e89607dfd5c97531e865d
MD5 56d1305626d3a6ba6f4a7287f0c58dac
SHA1 cfe745bf413c9de0effb130c7728184bd5404911
SHA512 1f3a6cbb964d0caddbf7802a4ebfbb0fa2fa4f3b41ac0a1a93c6d1479eaa7ecc31072d573721595edb973e6a4d3b005ed91d04cde95fe02c44f4d0fb972faf05
SSDEEP 192:uKR1gBV727v74pAPRp29PiQ93Hsb+WNn5uOpO20kuVTnQg0VyIsnAUgraJ:JR1gBViDUUX8HxwEl21uUe
TLSH
T10242B62EB950B97BACDBC25AF955BB1BE3F2102124942E84EAFCCD2C14E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e9451a4-574d-4d4a-b930-310a9e49736b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9e9451a4-574d-4d4a-b930-310a9e49736b.tmp
Size 13KB
SHA256 a60e41c05d2eb8620276a58502f3aa4635caafd2a467bf3748ff9c7a504e2a62
MD5 6e5b8967467b722e26e38b01ad7f67c4
SHA1 63ca421b1efee83febcdc89d147266648149d1e2
SHA512 899cf104c6e8e4085c313f53dee6295a6b47f595dd8c89115c13e6fa91c47f1d4c1f26a39bb57595403ea813d1459665941ad511af1feabfe25745acce008a14
SSDEEP 192:uKR1gBV72hv74pZPRpR9PiQ93Hsb+WNn5uOCZE9kuVTnQgoVyIsnAUgraJ:JR1gBVixU3XPHxwEhE+uge
TLSH
T13252B62AB950797BACD7C26AF951BB5BE3F6102124942E84EAFCCD3C18E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 346KB
SHA256 0f8a0722302d1b8e1050f1c7882af2c0feb056752c3feddcc0b4316891d60d44
MD5 cffe89fe76f974f10f591767becdc8ea
SHA1 63d099b0fca6062bb726f3c8bbbc704a1611182d
SHA512 69a6672dde71770eef237d7bedfb1a82317a68339abd399505acf995dc2132b0ef4e4fbd36b8453c8b9556877ba778722662b901166c77ef2c38a8d88a0a8a3d
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqL:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEa
TLSH
T1E774230B2E1DCA322357475B503E382845454A294BCF27921B689BE8853C9FBBEF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 41KB
SHA256 504dae855be151f01ff5f0c36f628d136a3c742200a48c662f2af5bba1b8e6ce
MD5 24969bf67bf2d80cc21e9f5576384261
SHA1 735f4170613250382641d7beaacaafee63bf2c9a
SHA512 b3a4f2b77bffa695d536bb9b322d7152c85e2ce12ae9b37cf0fcf95b889d05bbb9e837ae91403340dd20a020541ffc46dd3a6d0f1ec58fa8d8937103bf8320de
SSDEEP 768:umYcJbJbpd3ek5xS+dOLJdsFo04VBdf1Cn0pAZVJvJV/o8nKHucmR0k6:uw9Tewo+dyJuFo0mtT2ZLJ9o8nCucmS9
TLSH
T1F6130242B1C3070B1C6E082489F995ED885E790AD11A72D34BB6EB7D5DCF313B285CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 2265117310d138cb888d2e81171684ac6f41b28ce634a6178db7f458cb1d4ab9
MD5 287be1a70dfe8f1deae5e6e10c9a63dc
SHA1 d46441d9dd67c5be7d3e29691de3cd4b3e1260e8
SHA512 620a1a017d4a80c7f2bbf3c6a1dc0c5423653a83f83668cabb37dafff1f119a5337bc694f5a579548cdd32fc4ed3205e5e17ccb5a790ffe489b8c35132154ff2
TLSH
T1AC31FA218CBD81FECB542A7DB5DD3B3471346411C34B4E826C19ACF151F238BA23B0A6
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 864B
SHA256 0e65b6095df277525c57ea3205e65c207150f4997124244cb497852427453d37
MD5 d20b1b720d2b30ef80c77a4a4c9bf770
SHA1 d7c665e89c413e810edf742fe8464cbc3c9c9174
SHA512 c53a0062217d798450e1090df60fce6d94eeba95bc1e90618f522c95ab3eb244c23d5a5be560a0ef351e9fe0fae8a1060c34fc76b4a747c029746c68c97fcf1d
TLSH
T13411224590FDC131CF5409BC99D50F08723A9802D25B6FA73C69ACF066E37D5A1330B2
MD5 SHA1 SHA512 TLSH

Submit Download

1cf6d717-369b-45ce-9738-911be00e1f7a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1cf6d717-369b-45ce-9738-911be00e1f7a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

5b3af8b0-bfb4-444c-a23f-8749c4a442d7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5b3af8b0-bfb4-444c-a23f-8749c4a442d7.tmp
Size 7KB
SHA256 1527a24f07dd0501311ffee70baf2e3323609bbdbfbc8efd4235fe8848a5fe8e
MD5 4ecfe8e51ee86684157f9eaac6a0a8bc
SHA1 ec17e791c154726ca6997177389d37f76e5b3e94
SHA512 7bac3981ddd88c0be28a7a6d6b096adb4ad77cc28f8592f7f05652b24c2a387edac1b1377b7a42c1607470a742ce5deb8fab75a9721f4824b0e3dbfa6a088c00
SSDEEP 192:D3YPtuU4lB5QaaksQ2aAlxUhVygqb+T4EawvLt:D3YPtuU4lB5QaaksQ2aAlxUhVygqb+TF
TLSH
T17DF16CB3C3D4C62DC81162F55F247D2FCE29096862683D6789E4DE8BA3E6472E34024F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 134KB
SHA256 38de7270606d72e3cdd3c4056be7e4677e9a58f676f0226c07e81749f5d0aef2
MD5 11dee0148fb6204e096dc1a6c2bc8bce
SHA1 064d0b56617c2785bdc34cbe7c15eceb394dc157
SHA512 5fa68bd5e5df1ac50ae4dc89960ca0080db1a552de1519144b28c882d6c49878be9a54a67db90fd8118e2c49ec0691388b854040762984a15b858d42eca20c77
SSDEEP 3072:I2egbeWM9sRxPCa17S69wKzorZ1JUfC1BTU:IcbeW/S69wKzorldDU
TLSH
T1B0D35157D1F8D963BF6B4453E4852A82B32C3007F619DAE1F987BBE0101E62A35B5C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 d5bc4c972ca34f47f0db161ce95a5df9e021316a5807b0dd3187515e060b3d09
MD5 527bd869197d6f8e8fdc8640072874ae
SHA1 8daf6abc66b87a171150a5f83197c807951de3ef
SHA512 dc20ddf492252526bce3c383c56bab84dc849e0093986b8252f7f5c38200391c1d0e259e679931c26ecd50c2d6d7982cab9e9aa6149004ab693d3b7011418a5b
TLSH
T136B01210C147A610C9C0C5F02114604621519EBD81011A4AC6E056DD98831F00291201
MD5 SHA1 SHA512 TLSH

Submit Download

a3733fdd-eab0-4ef0-aceb-8fed9e3803cf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a3733fdd-eab0-4ef0-aceb-8fed9e3803cf.tmp
Size 13KB
SHA256 4293a59890851f6e157ab8ae5d1bcfa32e9c8e86e8820ca8d97edd39c0eec14e
MD5 b095f945ef2cce789e3b6347a243c8c7
SHA1 4a4e9f541ff9bc315232762b75c0554dd9ab5597
SHA512 e652c40c29006b441d70aa4fe7cbf2019aef78d8b1d5ca8939ccdca76e9a3ae2e108e46ac265424f91fc8f6b7b0f472a69308ef864ae9988ab754c2ba60e17ec
SSDEEP 384:k6jA/7KxkXqKf/pUZNCgVLH2HfgsleLXODAj+ErU3luHGCUbvTiY:kqA/7KxkXqKf/pUZNCgVLH2HfgsoTOsw
TLSH
T1E0520967688C9A3F4FC8D94CDC26BF4FACF601566168482453FA9C1903E5BDB014A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dab082dc-bacf-41ef-8335-e1423643be5b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dab082dc-bacf-41ef-8335-e1423643be5b.tmp
Size 12KB
SHA256 cb98c8f751e1cb4e38bd8e5517805fd50ea3614d6debbd0e08e9d2829445a9d4
MD5 52dc89539ed2991b99dec0ad6cc5e31f
SHA1 adffd22b2f1bd40550ffd83055e11401b69b7c2a
SHA512 2e28cfddee0b31f309c4a6efd9ca23eaf6887e74d63e01fb226d78050ea9f8b639846bd66b505ad84f54d2279d2cdc88051230e297188eb631ff0846b3daaef1
SSDEEP 192:uKR1zBV722v74pAPRp29PiQ93Hsb+WNn5uOpO2fkuVTnQghVyIsnAUgtaJ:JR1zBViCUUX8HxwEl2cu78
TLSH
T1F942B62EA950B97BACDBC25AFD55BB1BD3F2102124982D84EAFC8D2C18E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e01838c2-801c-45fd-97fe-b550c1a320f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e01838c2-801c-45fd-97fe-b550c1a320f1.tmp
Size 269KB
SHA256 97cdceb742a16daa14f22bcedc0dcd25637902b7477acd9507c1dce2a24531e1
MD5 cea55967739c62bbc69d1db08d24836d
SHA1 bda1be99295a0bb3951ffc9c94470099a77e85d9
SHA512 5ef8c936f9360f3a1bb4698988a53cb98973fb40646f1ab978a4b96c207475ba06777584b21ef0fba59ce72e68e809df6671f5473a0576c8f4113d853a7665c3
SSDEEP 6144:GevHWe40m3otUf+8Wp53EX9pxsNTdzAMQjmvaFezXEmLOMzexH:G+493obX3ETxs3n2FezpOxxH
TLSH
T11B44237849DE9C7FE338922FB84ABF073EA846926194C7653C9136CF2513FEE0592160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2c7e7fa-4bfe-4d73-8d7b-d4b28b370d1e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e2c7e7fa-4bfe-4d73-8d7b-d4b28b370d1e.tmp
Size 269KB
SHA256 a9b90fdc701ce1189d3a0ab09b2f65389decd5f28569037a525caabe4ae358fe
MD5 efe015507b06038f54aadf6c901e8952
SHA1 3ce0452e58d655563e61bf121bc6521144625ceb
SHA512 77119001c58c82620a84eb18cc3a51ad0c92a074f0c7aedd2cb7af4874b4a88a1aafbc1bda958d1be9bfbfb03e18b8ec6c234e9ac86dc74b50f86b7e230b34c1
SSDEEP 6144:JevHWe40m3otUf+8Wp53EX9pxsNTdzAMQjmvaFezXEmLOMzexH:J+493obX3ETxs3n2FezpOxxH
TLSH
T19844237849DE9C7FE338922FB84ABF073EA846966194C7653C9136CF2513FEE0591160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d847fsoja2.exe

Path C:\Users\Admin\AppData\Local\PkgCache852\d847fsoja2.exe
Size 866KB
SHA256 42ce3244cd433b3c6e9f2a594e88b69a7ed18ab66eb983b593e855fb7fd45ca8
MD5 afa5d5719d633d76636649a34dbc26a9
SHA1 9cc21dcfcb2b6e87dc1086936d3680e2df4ef456
SHA512 bbe81b5be5c1474e93f23ff8bcca3781f07d92288fa51cc6bf3ada6df57903275fa793bb06153acd17b726b70839dfe35b1c886703d3347ddfd09b54ca436a7d
SSDEEP 12288:Veu+zcGx/ronTWoq2qR8zYuCCtJq5X+wX7apXzMeBz4dvocuL97uzCdqpviQH6nX:75Gx/I5zL/64p4+6ZCX
TLSH
T1CF151A29466AD465DCFAA938F4850513FBA1982427872C95F0EB86249BF3DCFD0787C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07v7x4jw9d.rar

Path C:\Users\Admin\AppData\Local\Temp\PkgCache852\07v7x4jw9d.rar
Size 529KB
SHA256 535f649d03cbc66aa0817d2ffc58da564b8e43ae3bac7ea4c487cd33ab6d52d3
MD5 a57bed049e8af5efe8c7fe97522ffbcb
SHA1 fde0d6bf1a6d96553e9057d1dd23ef9c619cfe20
SHA512 5b704af6db8e2ce3b953f28141f3e92ddf248611fc864b97a6182ac2aa29e89ebbc502aa4eb564465cad43ef63c6333ae110bd684d87233485cc7d700f0b4163
SSDEEP 12288:VGp+RTC9C6SmE+lJUxXeZd1eNmqnjgNUs9qq9Muz7fl7LZ:gp+RmWmBJUVeoNrjaUnq6sfl7LZ
TLSH
T15CB42362FFCDE6956043F86EC900658B67536FBF3127B3C25DB1629328E05429071EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vgh4d57.exe

Path C:\Users\Admin\AppData\Local\Temp\PkgCache852\vgh4d57.exe
Size 547KB
SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
MD5 8d4630a7958517737dba1ab88045373b
SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
TLSH
T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cw1jdues.a42.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cw1jdues.a42.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/992-84-0x00007FF7F9C50000-0x00007FF7F9C9A000-memory.dmp

Download

memory/1036-46-0x00007FF7F9C50000-0x00007FF7F9C9A000-memory.dmp

Download

memory/3344-43-0x0000000140000000-0x000000014006E000-memory.dmp

Download

memory/3344-45-0x0000000140000000-0x000000014006E000-memory.dmp

Download

memory/3592-50-0x00007FF7F9C50000-0x00007FF7F9C9A000-memory.dmp

Download

memory/4012-21-0x00000279DCF20000-0x00000279DCF4A000-memory.dmp

Download

memory/4012-23-0x00000279BF4E0000-0x00000279BF4F0000-memory.dmp

Download

memory/4012-22-0x00000279DCF20000-0x00000279DCF44000-memory.dmp

Download

memory/4012-1-0x00000279BF4E0000-0x00000279BF4F0000-memory.dmp

Download

memory/4012-20-0x00000279DCEE0000-0x00000279DCEEA000-memory.dmp

Download

memory/4012-19-0x00000279DD160000-0x00000279DD213000-memory.dmp

Download

memory/4012-18-0x00000279DCEC0000-0x00000279DCEDC000-memory.dmp

Download

memory/4012-11-0x00007FF431E60000-0x00007FF431E70000-memory.dmp

Download

memory/4012-10-0x00000279DCF90000-0x00000279DD152000-memory.dmp

Download

memory/4012-9-0x00000279BF4E0000-0x00000279BF4F0000-memory.dmp

Download

memory/4012-7-0x00000279C0FE0000-0x00000279C1002000-memory.dmp

Download

memory/4012-0-0x00000279BF4E0000-0x00000279BF4F0000-memory.dmp

Download