valleyrat_s2 | 5ba583585e4fe56cdee37569ffd4702d908035c8bf9b8991c69143cc7a665f63

Resubmissions

06/11/2026, 08:56

261106-kwc86swt2p10

02/11/2026, 02:17

261102-cq4vyadh7710

30/10/2026, 09:29

261030-lgc6asa17s10

30/10/2026, 08:15

261030-j5m93aax2x10

Analysis

user interaction
yes
max time kernel
469s
max time network
675s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/11/2026, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Financial Statistical Reports_1435.iso
Size 984KB
Sample261106-kwc86swt2p
SHA256 5ba583585e4fe56cdee37569ffd4702d908035c8bf9b8991c69143cc7a665f63
MD5 7f275c951df49d42b0ab11a73a2b6130
SHA1 061f54faa107a713c184b7322df05227ba1c7d7e
SHA512 bb450ca99dcee8a3cb226217720ab2aed2fb151bab560d4c8f1a0a0f468b399617a165e703c9c44fe76023282a65531f561db66c78348edd9ff51156ca7e12e4
SSDEEP 12288:MKTr92i/qCDrWz88MsbP0cVt0ogGVuG8FHHOrWTNEFTyEgRCzBd+fZ8OMO3J:hVyuWg8MkV+7ouBFHHXTNE1oCdd+f+p
TLSH
T14025F046F3A419F5D0ABC138C9628516E772BC9A0775CBCF33A8466A2F232D14E3D752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor defense_evasion discovery execution valleyrat_s2 persistence privilege_escalation ransomware spyware

Malware Config

Extracted

Family

valleyrat_s2

Version

47.76.170.135:443

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5032	powershell.exe
4792	powershell.exe
3944	powershell.exe
4380	powershell.exe
2104	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4888	znge58lk.exe

Loads dropped DLL 3 IoCs

pid	Process
4308	Financial Statistical Reports.exe
4104	Financial Statistical Reports.exe
4888	znge58lk.exe

Modifies system executable filetype association 2 TTPs 6 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command\ = "\"C:\\Users\\Admin\\Downloads\\snapshot_2026-05-27_12-11\\release\\x96dbg.exe\" \"%1\""	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\snapshot_2026-05-27_12-11\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\ = "Debug with x64dbg"	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Command	x96dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	x96dbg.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	Process not Found
File opened (read-only)	\??\O:	Process not Found
File opened (read-only)	\??\P:	Process not Found
File opened (read-only)	\??\Q:	Process not Found
File opened (read-only)	\??\S:	Process not Found
File opened (read-only)	\??\W:	Process not Found
File opened (read-only)	\??\L:	Process not Found
File opened (read-only)	\??\N:	Process not Found
File opened (read-only)	\??\X:	Process not Found
File opened (read-only)	\??\E:	x64dbg.exe
File opened (read-only)	\??\J:	Process not Found
File opened (read-only)	\??\Y:	Process not Found
File opened (read-only)	\??\Z:	Process not Found
File opened (read-only)	\??\F:	x64dbg.exe
File opened (read-only)	\??\H:	Process not Found
File opened (read-only)	\??\I:	Process not Found
File opened (read-only)	\??\K:	Process not Found
File opened (read-only)	\??\R:	Process not Found
File opened (read-only)	\??\T:	Process not Found
File opened (read-only)	\??\U:	Process not Found
File opened (read-only)	\??\V:	Process not Found
File opened (read-only)	\??\B:	Process not Found
File opened (read-only)	\??\G:	Process not Found

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	132	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a562e6927a1b4eab	5

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 2716 set thread context of 4308	2716	x64dbg.exe	137
PID 2716 set thread context of 4308	2716	x64dbg.exe	137
PID 2716 set thread context of 4308	2716	x64dbg.exe	137
PID 2716 set thread context of 4308	2716	x64dbg.exe	137
PID 2716 set thread context of 4104	2716	x64dbg.exe	141
PID 2716 set thread context of 4104	2716	x64dbg.exe	141
PID 2716 set thread context of 4104	2716	x64dbg.exe	141
PID 2716 set thread context of 4104	2716	x64dbg.exe	141
PID 2716 set thread context of 4104	2716	x64dbg.exe	141

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	regedit.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	regedit.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2856	chrome.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202020202020202	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	x96dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202020202020202020202	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\21\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\Shell	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\24	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	x64dbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\Debug with x64dbg\Icon = "\"C:\\Users\\Admin\\Downloads\\snapshot_2026-05-27_12-11\\release\\x96dbg.exe\",0"	x96dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 03000000000000000200000001000000ffffffff	x64dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg\Command	x96dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\3	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\Shell	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000004000000030000000000000002000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202020202020202020202	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\shell\Debug with x64dbg	x96dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\18\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd64\ = "x64dbg_db"	x96dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202020202020202	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\20\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32\DefaultIcon	x96dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\22\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202020202020202020202	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\2\NodeSlot = "24"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dd32	x96dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\16\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x64dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\21\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\Shell\SniffedFolderType = "Generic"	x64dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	x64dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	x64dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3 = 14001f80cb859f6720028040b29b5540cc05aab60000	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\23\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\21\Shell	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\21\Shell\SniffedFolderType = "Generic"	Process not Found

Runs regedit.exe 1 IoCs

pid	Process
5640	regedit.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2716	x64dbg.exe
3248	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
4432	chrome.exe
4432	chrome.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
2716	x64dbg.exe
3248	Process not Found
2984	mmc.exe
5640	regedit.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4888	znge58lk.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1132	cmd.exe
Token: SeManageVolumePrivilege	1132	cmd.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe
Token: SeShutdownPrivilege	4644	chrome.exe
Token: SeCreatePagefilePrivilege	4644	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
2716	x64dbg.exe
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
2984	mmc.exe
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
4644	chrome.exe
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
2716	x64dbg.exe
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
3248	Process not Found
2984	mmc.exe
2984	mmc.exe
3248	Process not Found

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 1768	4644	chrome.exe	103
PID 4644 wrote to memory of 4588	4644	chrome.exe	104
PID 4644 wrote to memory of 4588	4644	chrome.exe	104
PID 4644 wrote to memory of 2856	4644	chrome.exe	105
PID 4644 wrote to memory of 2364	4644	chrome.exe	106
PID 4644 wrote to memory of 2364	4644	chrome.exe	106
PID 4644 wrote to memory of 1096	4644	chrome.exe	108
PID 4644 wrote to memory of 1096	4644	chrome.exe	108
PID 4644 wrote to memory of 3880	4644	chrome.exe	109
PID 4644 wrote to memory of 3880	4644	chrome.exe	109
PID 4644 wrote to memory of 2892	4644	chrome.exe	110
PID 4644 wrote to memory of 2892	4644	chrome.exe	110
PID 4644 wrote to memory of 5052	4644	chrome.exe	111
PID 4644 wrote to memory of 5052	4644	chrome.exe	111
PID 4644 wrote to memory of 3964	4644	chrome.exe	112
PID 4644 wrote to memory of 2480	4644	chrome.exe	115
PID 4644 wrote to memory of 2480	4644	chrome.exe	115
PID 4644 wrote to memory of 3964	4644	chrome.exe	116
PID 4644 wrote to memory of 3964	4644	chrome.exe	116
PID 4644 wrote to memory of 1772	4644	chrome.exe	117
PID 4644 wrote to memory of 1288	4644	chrome.exe	118
PID 4644 wrote to memory of 1772	4644	chrome.exe	117
PID 4644 wrote to memory of 3168	4644	chrome.exe	119
PID 4644 wrote to memory of 3168	4644	chrome.exe	119
PID 4644 wrote to memory of 4460	4644	chrome.exe	120
PID 4644 wrote to memory of 4460	4644	chrome.exe	120
PID 4644 wrote to memory of 4184	4644	chrome.exe	121
PID 4644 wrote to memory of 4184	4644	chrome.exe	121
PID 4644 wrote to memory of 932	4644	chrome.exe	122
PID 4644 wrote to memory of 932	4644	chrome.exe	122
PID 4644 wrote to memory of 1832	4644	chrome.exe	123
PID 4644 wrote to memory of 1832	4644	chrome.exe	123
PID 4644 wrote to memory of 3824	4644	chrome.exe	124
PID 4644 wrote to memory of 4064	4644	chrome.exe	125
PID 4644 wrote to memory of 3120	4644	chrome.exe	126
PID 4644 wrote to memory of 220	4644	chrome.exe	127
PID 4644 wrote to memory of 220	4644	chrome.exe	127
PID 4644 wrote to memory of 3468	4644	chrome.exe	128
PID 4644 wrote to memory of 3468	4644	chrome.exe	128
PID 4644 wrote to memory of 3288	4644	chrome.exe	129
PID 4676 wrote to memory of 672	4676	x96dbg.exe	132
PID 4676 wrote to memory of 2716	4676	x96dbg.exe	134
PID 2716 wrote to memory of 4308	2716	x64dbg.exe	137
PID 4644 wrote to memory of 4432	4644	chrome.exe	139
PID 4644 wrote to memory of 3520	4644	chrome.exe	140
PID 4644 wrote to memory of 3520	4644	chrome.exe	140
PID 2716 wrote to memory of 4104	2716	x64dbg.exe	141
PID 3248 wrote to memory of 2852	3248	Process not Found
PID 3248 wrote to memory of 4792	3248	Process not Found	144
PID 3248 wrote to memory of 3944	3248	Process not Found	147
PID 3248 wrote to memory of 4380	3248	Process not Found	149
PID 3248 wrote to memory of 2104	3248	Process not Found	151
PID 3248 wrote to memory of 5032	3248	Process not Found	153
PID 3248 wrote to memory of 2984	3248	Process not Found	163
PID 3248 wrote to memory of 5640	3248	Process not Found	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Financial Statistical Reports_1435.iso"
1⤵
- Executes a command shell one-liner
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe46abc728,0x7ffe46abc734,0x7ffe46abc740
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,3180570949715805507,8493068746721853813,262144 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,2286918392599206542,6364018892172609497,524288 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,12437024542672103849,16215883799276049683,524288 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,6533224549037414453,10362489054264777857,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3480,i,18057448701544401598,13482600276517711287,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3972,i,12128762595366533128,9656649286440184928,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4516 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,11742596914845336627,15056172630427929041,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,13328496315742479331,9067912826161658598,524288 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5784,i,11976621125284731887,3319897637940913215,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3600,i,4515661121281659499,11226468185966882201,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3508,i,13190734420767668193,12283410555540971953,524288 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3536,i,14313222589603649908,6682529059574720702,524288 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5848,i,15674605756972831885,9168175855749717847,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6148,i,810863345370463215,13779094321771103600,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6264,i,1338314757252475309,11575319143297750574,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6140,i,16507258892229324905,2171320828375612264,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6392,i,3432187659898445028,17966264995719228636,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6244,i,14067485544761061944,15002602464869374880,524288 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6284,i,2507098695936405226,11973405330054721918,524288 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6864,i,3414640554415967133,17620095935804909327,524288 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6776 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4496,i,14100405000696264672,7879357453470113289,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5960,i,3946474810669184113,926224267742379450,2097152 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,5972807127119693279,4170503208237305612,524288 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6948,i,18095501238129948926,6838139705721617078,262144 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1160,i,11782709455926941643,17920813926943327868,524288 --field-trial-handle=2028,i,8312653177615380318,8352998588235838938,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:3520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4260

C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe
"C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe
  "C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.exe" ::install
  2⤵
  - Modifies system executable filetype association
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:672
- C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe
  "C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - \??\E:\Financial Statistical Reports.exe
    "E:\Financial Statistical Reports.exe"
    3⤵
    - Loads dropped DLL
    PID:4308
- - \??\E:\Financial Statistical Reports.exe
    "E:\Financial Statistical Reports.exe"
    3⤵
    - Loads dropped DLL
    PID:4104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4792

C:\ProgramData\EdgeUpdate\oq9efd3b\znge58lk.exe
C:\ProgramData\EdgeUpdate\oq9efd3b\znge58lk.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
PID:4888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:5032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:4392

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2984

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Event Triggered Execution: Netsh Helper DLL
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Netsh Helper DLL

T1546.007

Process Injection

T1055

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.log

Path C:\ProgramData\EdgeUpdate\oq9efd3b\config.log
Size 185KB
SHA256 f745086049fef5d3912f5c15ad94fa96214e81eee02f4f748a718a03bb46ba71
MD5 2e2f30638bb0d734bb19806458ccb7ae
SHA1 65189daa26cd1a6c893145c4907adc0366bc8218
SHA512 c20db14c20dfbc0f75778a651880e0ad89b886ec725f18941396f31326b9b8b02d3923ae93cfb8c43977e29365cf129e539021fdceb8127338c28fcb7915e346
SSDEEP 3072:aU5DsqZ/jNozWPf2tOlTTqNr0j9xqnN76WyOYe1xOZ+RBfXupwpFYqdr/a/d:75HNozWH5TTXoN7R5YeKc+bd
TLSH
T1A7045A46B3A500BAED6381788D638A46F77274554370ABCF576083BADF2B7D07A39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

znge58lk.exe

Path C:\ProgramData\EdgeUpdate\oq9efd3b\znge58lk.exe
Size 367KB
SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
MD5 d455b3b0529d73929fb2f2ecd43b4f75
SHA1 934549d96c0d836579d0ffd0d8c580ecbcd87b65
SHA512 b490795b2bf54e1edb0d1f7075cf9c58fc7255e0ecef0ebce499ad42945700e2237421196f57880b92f7e3d036ee9b95354c9157d3f3b3a9a7fd65ff7d9c0952
SSDEEP 6144:UK0CMcoPY19CebAiwu6B36NDrd8zzJ6aFMMkxGbP0cw:UKTr92i/qCDrWz88MsbP0cw
TLSH
T1EC849D46F7A418F5E0A7C139C9628906E7727C9A0770CBCF23A4466B2F272E15D3D762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d356939-4cab-4bee-abb1-cd753ba72695.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1d356939-4cab-4bee-abb1-cd753ba72695.tmp
Size 274KB
SHA256 2cb4fd641e17a9752e49c32e2582e30595088bcf07fb597a141ec09343385027
MD5 e65339b968285398dbb9a9341b3306f9
SHA1 73da427bb3d4239fb27ea44066b6e4fbac98195d
SHA512 40970a933380d22c99b3e78292b9476d53000a11ddc0dcf0290a8a4baedbeb1bbbf19fbe3bfa6c07dc7d53bb8d8e5165bfcf4af621b11553c42c79333375c5da
SSDEEP 6144:nHMLXrL/EH/vL7C6VCYJBoQyal56lA90cK+hFD+7t56OD9ZfSAppr1:sPLMHHCGqaf6lNyFSXD9ZfS4f
TLSH
T1335423376AE07D2AC6BCF9837217E7156DB469DAC7093A4D84021D4E71AFC5807B3E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d96cfe5-f0b9-4cc9-be38-43f12e1f0475.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8d96cfe5-f0b9-4cc9-be38-43f12e1f0475.tmp
Size 273KB
SHA256 9d6780efd9dbd543bf190b9411b8fc2400eab6491ac4f82aa14f69b01c67eb12
MD5 fe3ca49b8b5ae4c063c5cc1059ca47f4
SHA1 465dcc495d0a882897cdb3d2e04f836a1d7b38fa
SHA512 169330f85e65be48853c26c33b23adc0673a5212ac4514278f7c241d95d984e074d4661e8e8edd5fe59f081ae94e5350f5c1d53937c2b5becc19a15db5c46654
SSDEEP 6144:hpMLXrL/EH/vL7C6VCYJBoQyal56lA90cK+hFD+7t56OD9ZfSAppr1:hOPLMHHCGqaf6lNyFSXD9ZfS4f
TLSH
T18F54233767E17E2EC6ACF543B217D6156E7469D982093B4D80434D8EB2AFC5807B3A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cc6a03f-b5bf-4a9a-a193-ba789b328275.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0cc6a03f-b5bf-4a9a-a193-ba789b328275.tmp
Size 12KB
SHA256 7247fce61840879977f8213d0e7044b3ba3705eab1501dd6bc4b9681a3a2b595
MD5 529f7426e87970ec0d18d3cbbc5d8332
SHA1 fd348a73f74730ecf1c73cede94380ecfe3c601d
SHA512 56937828fae5338526210f211419e4a6fef5e44a8cc498d588841cdef3a6cbaec0dbfcc8b4051db7d302091a5f0733d997c760baa7771c6fb428687b7b60fc17
SSDEEP 192:vRFcBzVbskDi4T57MzPGv7+pAPRp2hxPD9THsb+WNnXI246U27wUmqmVyIsnAUg8:vRFmzVQB4iyaUXS9wbe2NQ8
TLSH
T18F52C52DFA50753BACEBD22AF922BB5BD7F2103164941E84E6FC892C14EB5CC211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2376d400-54a5-431f-9f6d-d79132429b97.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2376d400-54a5-431f-9f6d-d79132429b97.tmp
Size 13KB
SHA256 8e9e554addb1ba0c971a8a954a41cb492c15ccbddf58366904a16241629c9d02
MD5 85e5c6842c1f071c8ce3bcb1caa10928
SHA1 9a59eefc63f04e8d122585b47792fadaa8d4368b
SHA512 2e5f21c35898a5bc0b21e649af544041b2c8450052e96070275c9ca2575960c2e3f6bb037607379755a2b2da14552918ea773d55729401031ccd08de11eff516
SSDEEP 192:vRHdcBzVbskDi4T57MzPxv7kpAPRp2/NxPKg99THsb+WNItLXI24TXeSwUmqZVyr:vRHdmzVQB4ihwUXs9wS/aeKVe
TLSH
T1AB52B52EF9507A7BACEBD22AF912BB5BD7F5103164941E84E6FC892C14EB5CC210741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29e478c8-5ef3-4d27-904e-f14114520452.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\29e478c8-5ef3-4d27-904e-f14114520452.tmp
Size 14KB
SHA256 b4a88dbc381bfdb953478487593ab70eaee54b16466dbd8b5d83f7d071267f91
MD5 8844162ee1ee73db3369d40ad1f88589
SHA1 d07bc6857f7369d19167de869af489fa9c9c6e96
SHA512 4d67696b4066439d1e5ccbfc171b20df1f89ad83450d2e2e62214b1d6b232830b891a944559b51f3132255383cc11b290529b7f271e3cda91906efe6114ff9fb
SSDEEP 192:vRCcBzJbskDi4T57MzPav7kptPRph/NxPKe99THsb+WNItLXI24TXe4wUmqTVyI6:vRCmzJQB4i2wHXL9wS/aecje
TLSH
T1E662C71EF9507A7BACEBD22AF912BB5BD7F5103164941E84E6FC892C14EB6CC211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b909ea4-bcdf-4eea-b12c-f8cf05264293.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2b909ea4-bcdf-4eea-b12c-f8cf05264293.tmp
Size 14KB
SHA256 370317a737994be10cb42e8d46a3f54920114b30273cf169783406c77dd07408
MD5 689fd629a5e61a9e7b8163a2451aed25
SHA1 627b158c1df25d0858999ee91926d6e262c61d08
SHA512 ce80a5dd59237b07f5b702ee1f5bcdce42788396acccf5f3f536bc81ea028359d6d81aee71f718d4cd0cf7bd124d49cf2cc8399ed98578ad2e5a25116f34ec06
SSDEEP 192:vRCcBzJ0skDi4T57MzPav7kptPRph/NxPK899THsb+WNItLXI24TXe4wUmqTVyI6:vRCmzJnB4i2wHXR9wS/aecje
TLSH
T1D362C61EF9507A7BACEBD22AF912BB5BD7F5103164941E84E6FC892C14EB6CC211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e716674-497d-45bd-9cfa-09b8f4e47a5f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6e716674-497d-45bd-9cfa-09b8f4e47a5f.tmp
Size 13KB
SHA256 cd536d96cc4551c540151d837353e3ffd150ac4ce49cf40eb02c6e5f64d24b5a
MD5 e9b1eaae31203e2077268352c507e823
SHA1 9c12efe8f2f997fe78e49df753262608efe9a7db
SHA512 d83175887586f02bda2b2a1d9b4b6cba5a0e73545b601f9ef0fb8115a034dcde0b5f95f43f6276f146d112fe1fbfead06530f976a0f81390121e1842b14193ab
SSDEEP 192:vRHdcBzVbskDi4T57MzPav7kpAPRp2/NxPK+99THsb+WNItLXI24TXeSwUmqZVyr:vRHdmzVQB4i2wUXu9wS/aeKVe
TLSH
T1BD52B52EF9507A7BACEBD22AF912BB5BD7F5103164941E84E6FC892C14EB5CC210741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99e9b168-fd41-4dc0-ac9d-2bbb2dac8d1c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\99e9b168-fd41-4dc0-ac9d-2bbb2dac8d1c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 641KB
SHA256 212a3fb97b62e7fab7692b7d2342999cf895eea086a483ca8d2b1b10310277ba
MD5 001582431881bd0d3c71f6d7096aace3
SHA1 5670ce967c06107be7cd1962eec3fa69066df8b7
SHA512 bf211d4929d02145aea92e19ff862e80768233d87e384d4cbc64f7566a5789d981fa8f73c0004bcd99165a5f09edefaca0bf06dbc2ef1a058cec4784c286b92b
SSDEEP 12288:PVCC/qOUEN7q6TBKrJEvehxez8sN6tAOrhEWbCe6msVW3uc2tBlS:PKOUI7q69KrGvcCfN6JhVsDQ
TLSH
T193D4231F0B92E9711EDBA18A8FC6EA39119D63389E830C5CFD76116C16D112BD91EF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 24KB
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2
SSDEEP 768:ZfRLYs8uBykIQZ6yXBeQOS9JUmBgKYTbgVec:vsbmrDXwEfUmBgKYTc4c
TLSH
T18DB2D004F02ACA26E53655B371E82BD54CB6C4CAABA9935C113520AF3ED3F48C991673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d
Size 24KB
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62
SSDEEP 768:RMxowxdaCb0WaY4P8keYUej86bykBRWIsna:RM1r0NY4P80j86bHtqa
TLSH
T1EEB2E0EEEE552E4CE2F059B4962B734B8A46F022191F947832E7844E8F494C24EDE477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 41KB
SHA256 c892a2cd5062dec8cf055d72bdb6875b9bea6c6ce9f61c6d57391b86dce572b4
MD5 10ebe5133ca04b2ac658e9ff5d762d12
SHA1 c186daf5fd97b9f6beed5712a1ba38bd932e927b
SHA512 c8c9d07610000dcd778fb3dd13f0be60fb5cb0b213d141a00bccc8d6dea6f0a11ec507c66875784c8dc54bfac2af08a014a49947ba0938694ff5bc1789d9184a
SSDEEP 768:9cOK1YXkjmFlLenrQ49Y0JfK6qHr57Qx84EMnyGFg16lYe537V1iL6:9cOKBOlYs49YSqtG616am3p1iO
TLSH
T18F13025DF8DBF2760B50224153478C09D6891B8A55E05B3AFE24232DD8D9E33D5EC8D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Size 77KB
SHA256 1b5ab66508beef2266bf7f3ae250d452fba062494b389b31a6567011f43c9483
MD5 f2f3dd7fda462a02803977c34a3998ff
SHA1 37ded099dc0b94c45b46983f1f9463b2aa5907fb
SHA512 d1889bf1dd6bea93ff051fc4e96bb7c21ab8d077f28c424d01ab94617f1ea211bf54205db50dde82293fbc16caa324f764de10ff9c1fbb87372641089d87890c
SSDEEP 1536:NP2s592NDeBSjm4phUbEOX+lRFt/yX6Jw3AqJ+FAbD9HJ4Kyfpgl:N9592ND5BUbEyUR7qEQiA3ZAo
TLSH
T16E730214AF7584289473D9E4AE98831E96A4217429B7BC86F0DFCAF696082FFD931508
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 789cbb0fb4a6f54db1e2d4e8a3e860991a9d2c4e0d82a3eba561d72adfe482d3
MD5 0d6d904ae4adc68bb5e71ff306eef0b1
SHA1 0dae6fb2c5e7fcdd05c4f06d5904f64ecd16bb0b
SHA512 0e999461d71970b99c89c8472448d62c25748312579f08531e70c9f70aa4efb8016a69e5b43cf416ecbdf70115bf1400f6087f2603e0748c779b09fc4a7b810b
TLSH
T16341DB12DB5F4C03EB253779C98DEFC5BC29E25A16168BCE5D945870644F674313C907
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 e85bc739e58be6dc12a5a86f59928dd2283388d54330d2d64b1a2b2db0657387
MD5 a786c80ae7f86b1f3aaa3963f10f8371
SHA1 4ca78e22057692eea0ed75d92d3dbe20b933c321
SHA512 2592870cc8d015dac05e090e1a1d6874012acefadbdccc82e6692ac1a8503a31e350bec9429db4abd5394c7cdc84ee1c92d7904105e33ad084a0c10e2eaeb406
SSDEEP 768:fmSOsOWAB64idkqR94+AVq2LEscMEUlvXgt/y:rOJWAid94Hq2LMMEUw/y
TLSH
T169F3C9DF5F24D516CFAAD1B50861E709B87BE82E8786E1F5FC300121CDE2663605CB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16cb66e8-1de6-43db-8668-d1bb9d863aab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\16cb66e8-1de6-43db-8668-d1bb9d863aab.tmp
Size 12KB
SHA256 a2808cd9a3004306a0bdee24e31f17988617ba09597a6f1ecfd62e23705f19e0
MD5 46da358348d617f314a00b440ec44873
SHA1 060cf81132365e551b3c0d97dc3c1881d41b9a00
SHA512 5deaea255fc05fe75f4ec33373b17118ae812c2fe2a5cd6688f61c481a066f7feea16d9998c154aa4d752eb8bcf8472d4ec3e419d82c076c70fb13e19d79c57d
SSDEEP 384:DIpMd4QvJyJPOn/mZmTaI8E3IYPPcsI81IdIjatnfjUXNTObuRVwysUGRjfQBHXO:ZcDfu+ZmdTSh
TLSH
T1A652A9F3C3D8C62D891116F5AB246E1ECE191A28832D3C67C8E5BE4F93F2571E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

879038a4-bc4f-4f78-b0b3-0b2ae57491bf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\879038a4-bc4f-4f78-b0b3-0b2ae57491bf.tmp
Size 12KB
SHA256 6359a96bdb724739407fa0e65755dacbfadf125018e695b707810df84cddfd88
MD5 cdd661cb64bc13c4e6c643eaab06178a
SHA1 f919664171ba4f8ac88f38a8ca028e31d7315e99
SHA512 376d29e790c0d42e5dca2d09cfbb0f09d0142d460dc6fed19ba0ba5bf9677aa53d983f28dddb4f552aa0cea5bdaff4675c3690ea515b14c9e08746bc804b2776
SSDEEP 384:DIpMd4QvJyJPOn/mZuaI8E3IYPPcsI81IdIjatnfjUXNTObuRVwysUGRgEfQBJix:ZcNfu+Zmd4x
TLSH
T17242A7F3C3D8C62D891116F5AB242E1ECE191A18822D3C67C8E5BE4FA3F2571E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

954c245c-3697-4bc3-8d1c-fdca5b8fabd7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\954c245c-3697-4bc3-8d1c-fdca5b8fabd7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bd0eac8c-e3d3-4a76-901b-6ca4eda17d17.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bd0eac8c-e3d3-4a76-901b-6ca4eda17d17.tmp
Size 11KB
SHA256 290411859cbcbfde57bc5d68465074459855482c1129228c03519af179e390b0
MD5 696a6ed2dc658cc9e6d66e406083e4c7
SHA1 e7eb26294049abc6438de15368ea5bee3652d943
SHA512 b22668313b7b2f3e9382eb4b8230ba13b2530c1e6d5c108178848078077fb72a54e30140ebcdb4352740591db547aef802a78b7643b5a0b408a4f0888458c2b1
SSDEEP 192:D0u4itqJJ5J0t9wEc8EGaI8EEdYPScsI81IdIjaPlvqfPiZmNPiObu9VwysUGRg9:D0u4itqJJ5J0t9wEc8EGaI8EEdYPScs0
TLSH
T18932BCF7C3E8C52D891156F4AB156E1ECE690628432C3877C9E5BE0B93F2472E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7669587-f77f-48f8-9d01-04200cd7c5a5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c7669587-f77f-48f8-9d01-04200cd7c5a5.tmp
Size 11KB
SHA256 11bf40a70d41002dfc7da401885f9cd44a60b62b2536e6b9db9487a81040d5f6
MD5 3b2a875116dcf5e153a1d98d0234f681
SHA1 8575d6ea8dddfb35f27fd60993436f1cdd51d966
SHA512 e0d30138fa7da0e8f9ff1a7de04534141b5af39fa8f26a81914d90eb523290f8c4077a311b13e70accb270cbdd085033ea2c2d22038da476371f632cc2d665f6
SSDEEP 192:D0u4itqJJ5J0t9wEc8vGaI8EEdYPScsI81IdIjaPlvqfPiZmNPiObu9VwysUGRgQ:D0u4itqJJ5J0t9wEc8vGaI8EEdYPScsf
TLSH
T15832ABF7C3E8C62D891156F49B156E1ECE690628432C3877C9E5BE0B93E2472E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 0c77fa00851fd10051f940de1750632a2bbd626e65746223805edfb78d2f30e8
MD5 48b362977a55b98a2745fcd4d59709a9
SHA1 42dbe82634a604839fac59d7c93aacd1c620ea9d
SHA512 6c494f0b6ad688eda5a2abf346464db0e022b06adeaf06f278eb8b9d052e634bab112cf9c60a66925a2eeedba1fb13c1976ec82326e7261b82fba356069fe4e8
TLSH
T1C3B0120480426301C05603F02174548C32549F35B609138189F00D05D87A162811B06D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 ecde6d87b2501921c30e5292c29bcbe8b79dadbdbe70504bb4b6abd74f3e88a8
MD5 82bbda17445244672245eda825c5e209
SHA1 eecbdc77670a06071221ce10ad71bce4f5c2c99e
SHA512 b9a444fc00cbbca13e873c5e3c07661950c5b576cdc79d2076168f3feee52eceaa64697d01a250a324afdf2d167cea3d6710bec28b4c751ab0ecdd662f1f49cb
TLSH
T1FDB02280C2033202C00203F02380C0CC32A8CF38C203030283E00A2ECC302338020030
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 e1e4fcd9efaa93ce8c7ffbd80a7913fef95ec09100af912105f3e824ccb668ba
MD5 c10003e8f38e7891c144109b306c441c
SHA1 67119f8672ccfaf4fafb87a89cf236fbf3493f89
SHA512 0a2be7fb50fe994aea011ef8c8e4d263c1d1a1412d849c0e8f6bfbfe30b1cad40b444982ccb43fafd881ac38059a45034b0323d3792526efe3e358646efeda27
TLSH
T150A0029013C68F91D44003F1A29302C5232C7A1023634FA559B18158A850147E541300
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a727cfe6-d7c9-4d11-b499-0447484058fb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a727cfe6-d7c9-4d11-b499-0447484058fb.tmp
Size 13KB
SHA256 bf2ee823ac48bdeb5e3c2f859c90c80170232d2fce7d4e29c929a6024512a331
MD5 bf97ca343bb04f79d694283cf0c3d20c
SHA1 c8bae017c77ecf67df09073c868308ca3ec9c7d3
SHA512 344fc15a710b0e9cf1fa6e4c93f3eb90eb74139057d5ab2826c27775ca04b3c1f389e60e3df099e2cad10280dc190353e5d3cbc87e29dd43069cbd2263a4d370
SSDEEP 192:vRFcBzVbskDi4T57MzPxv7kpAPRp2/NxPKo99THsb+WNItLXI24TXeAwUmqmVyII:vRFmzVQB4ihwUXk9wS/ae0Q8
TLSH
T12652C52EF950767BACEBD22AF912BB5BD7F5103164981E84E6FC882C14EB5CC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d84c584b-2fe1-40be-9e75-b2a9034935fa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d84c584b-2fe1-40be-9e75-b2a9034935fa.tmp
Size 414B
SHA256 360eeb11c5c2aad8676b76f79b5a89269362359af496660fba96b59a2d7032e7
MD5 230c2bcc59f64109f785ed4e10dfcd64
SHA1 c9a1f1ea113fff2a829e7f61625d64f282064dde
SHA512 77fd0b94c154814dd945bb027f65d6ac3cbca0b2310c25a3b492b60bc92bf379e0ff5ba0059beb514dc1702bf9de96977cec4a5d4a624e9438654087e6e670cc
TLSH
T112E02BEED922ED2718FE0B5954940789FB4013572A41894F3B3D450DCFF063606C591C
MD5 SHA1 SHA512 TLSH

Submit Download

f502251c-d1da-4bab-a8e6-17caa03b28b7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f502251c-d1da-4bab-a8e6-17caa03b28b7.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf56aeae-0a20-4d37-bd7f-1152c067fc34.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bf56aeae-0a20-4d37-bd7f-1152c067fc34.tmp
Size 274KB
SHA256 50491bb2e53e3490c92191d03004b9faf580dfefd027ae40b2cf186fe049404d
MD5 faddda38115fcf300eb53ed79db17da7
SHA1 183e494819ded5e693961b0cae367b30f5718c3e
SHA512 52a2b65836e78940520d3760be133185d80619e06ecda9153a5c9a707b6f71c5e209b3903b77dd8aa44162c5d38874a77b35c30a0fbbf5236717a9241cb7b5c4
SSDEEP 6144:3pMLXrL/EH/vL7C6VCYJBoQyal56lA90cK+hFD+7t56OD9ZfSAppr1:3OPLMHHCGqaf6lNyFSXD9ZfS4f
TLSH
T16554233767E17E2EC6ACF543B217D6156E7469D9C2093A4D80434D8EB2AFC5807B3A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4e0a6a0-eb4f-4b99-9549-aa4749c45f49.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d4e0a6a0-eb4f-4b99-9549-aa4749c45f49.tmp
Size 275KB
SHA256 5348f64ee0a33a4f5a2c917870c84e73ad44950ae4c8d0304040852485ba1385
MD5 c1ddea829c2b9885037e6bd63854a9b1
SHA1 150e522fa20eb2d188361d8a14b1f23a0014a336
SHA512 f9334bf2b8b3b70d265aba889d0943d6fba7ec3ec425ae5ce7bda10b617fe8ad2e00963a26fdae45e03e04c7475853bb79a57b19c11586a304a559ab096f6f7d
SSDEEP 6144:rHMLXrL/EH/vL7C6VCYJBoQyal56lA90cK+hFD+7t56OD9ZfSAppr1:YPLMHHCGqaf6lNyFSXD9ZfS4f
TLSH
T1665423376AE07D2AC6BCF9837217E6156DB469DAC7093E4D84021D4E71AFC5807B3E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da01a27e-a370-4708-abf4-7e9bd97fd923.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\da01a27e-a370-4708-abf4-7e9bd97fd923.tmp
Size 130KB
SHA256 87a248e78fa588f405dca193cd3515ca1dc6b60d13772074203345ce0fbd3861
MD5 965748c993d60305f5ce73fa3ce453c2
SHA1 c0df081f6dec9d59e3c8adcb80cbe25cbc1c427f
SHA512 bffce68c86ddf475b9f8dff5b4a3af83f4f6b732de3bf9530a7ac04cdbf1d8109c9577dca69b9860ea7f656a4506a08fa5cca8f3a296ab9a3ca07d7360e948c1
SSDEEP 3072:K+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:K+hFD+7t56OD9ZfSAppr2
TLSH
T1E7D31232AA91D8BBC9BC6541B157A304DE726CED81DE3A09444A5F8EE09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 56KB
SHA256 e4cf775d56308e361a0071906f6c0e20dd09522b990a65d24138d58a5d90dd41
MD5 c93c727c2a2c0a308f97e55a25469613
SHA1 66133b5fa3055dc67b5549712f9da4fcd851db1c
SHA512 a32cacc7500e8bb1d5e00360e90917d626f56b9a2f4d04be4c5cb78a136af03d222aff5d04d1d168db33f3725d2be985bd8241882efeb7a18cd75b055cf27b22
SSDEEP 192:r1nVeW40iGUHDKuD7BpaSh3nu93xs5OzSOWeVsPVEqQ9r04wQ:rkPDK47nadgOLWHQ9r04
TLSH
T19C43C7A2B804DA15ED0D5D369FE6CBEC6730BD16DE6B831375C2B76F8ABB0C10909584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 7305bcde3ba246a9b5c1666079c61596cc2ed2c651a1cd9e20557dba8a78c0e4
MD5 b7e1db446e63a2aae76cd85440a08856
SHA1 c900cc81335dd3ca6337e21f5bcde80f8e8a88f3
SHA512 dd63e28017eec632868489e469dd2ba54f20a3024be44550b729a0384bd55c5aa78171f7416612cd5174047afc544e21678ca164359962312b1d853c9bff04ea
TLSH
T1A2112263F3CD8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF984CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9148effd7f6028a5b2b17c03dea1c58d26d03f16795a51689ec783c3ab316f67
MD5 a915885ee305ddedc93eb017ee452c2d
SHA1 71fa8be50adff93c37d23eaffd359c7573d0fba6
SHA512 cb29c8b2f0e033b86bf41e365bf0d934d0a844445fb52971a60579eac53d23eaad0bc776754e155b211e78c4089e31d37c96b1ab4ea5edb5480d66751d00c82d
TLSH
T173112227F78C8920CC961539509DAC5572B586CB81EFDE9F7BC0C210E1BF584CBA21D4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 57cd435c8b2bf10a2c77698301789c032e1b6b623ff1420c72e8bca0b10f1e5c
MD5 6d14ccefeb263594e60b1765e131f7a3
SHA1 4a9ebdc0dff58645406c40b7b140e1b174756721
SHA512 2013a26123f72a4106524fd9d7389ac4654f97033d22707efc084fb2a3ad01c298eb64f01bb64861ab603615022dbe7cfc97475346edb16b3ba72e905127f101
TLSH
T1FD112223F38C8920CC961539509DAC5172B586CB81AFDE9F7FC0C210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14
MD5 10890cda4b6eab618e926c4118ab0647
SHA1 1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d
SHA512 a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221
TLSH
T15F112223F38C8921CC961539509DAC5172B586CB81AFDE9F7FC0D210A1BF584CBA11D4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vsdfxczq.huc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vsdfxczq.huc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

x32dbg.lnk

Path C:\Users\Admin\Desktop\x32dbg.lnk
Size 2KB
SHA256 c89e9c30a5773719cc193b7f4d448e775d37f59d373dea283626fc2b4cc91ce6
MD5 7068c39354109649fde1253c86d31abb
SHA1 9d77a17d6b39433198a360058850159c15ed45dc
SHA512 6ca7945adfc6fc6ad80a287b6f7d4685b2401153ebd0e65e53b8babf8d2e62546a704af610ce9e2de1b83c61230508c600df9bb4ef48c6bfff537ed593a3734a
TLSH
T17A419C5C6EF20658EB7ADE725AB1F341A238B8C75E109D1F05C1028848B3B16F021F6F
MD5 SHA1 SHA512 TLSH

Submit Download

x64dbg.lnk

Path C:\Users\Admin\Desktop\x64dbg.lnk
Size 2KB
SHA256 7366b2e083274b8447155596c2739cbb726734029c57433f27597f20cf1a63e3
MD5 f26aea2fca1db5b7176e8632c9df1ee2
SHA1 bb62a0583f1dc4bb168acf78e7a4ded85c49f0d1
SHA512 256dabd890b372b5837a6caae62166b00388b985147b615ef6db7a8c84052c7187e319e877598eb991d7cd971b9281b86d5520fe09d57d0bfaa9dbb74611e07a
TLSH
T11B419E582DE2470AE77E9E765A75F342A13478C66E019B2F59C103485833A16E024F6F
MD5 SHA1 SHA512 TLSH

Submit Download

1788e595-9d1a-4d03-a826-32a2c3e6a270.tmp

Path C:\Users\Admin\Downloads\1788e595-9d1a-4d03-a826-32a2c3e6a270.tmp
Size 31KB
SHA256 50330264bd58dbaa9b703a49f6c1bad438a6d4b50ebbe62c8dbec45088df6173
MD5 6f70554cc55ce90bc5fad3d0c4d07bfd
SHA1 69c6e34b656b3fdc38ecb47dd173c7c044127889
SHA512 1a5f9bd0459ebced400ee281240524e6df7ee8f3e439b646d8d6851aeedc541adf63debfe7d814ecf38743691edc0b949d4d7d4942404644d2d482a0cee0745d
SSDEEP 768:pB/biQ/HfPfk6C3rPxyWexVoylUBQyk02DtPuM2ts7oV:pBi+/Pfk6IrPx0VSjInwsMV
TLSH
T1DEE2E153E8281DD0E23B61358599768554F152F8B5D5BA2E3E60B0231EDBFCAC9C22E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x96dbg.ini

Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.ini
Size 122B
SHA256 672875a23347e407ff4a54c6baa35090c7041fa45568437f12b86b50bc2fbebc
MD5 45c1e010baaeb6b086b93c73cbfa1433
SHA1 6570b66b77103aac30dc7cccfacde1e42413890a
SHA512 6b00d4050ad80dc575b056e40b3fdae831e57d1b035fc7500c1523c70c7f03f344e8b53b070ec3c8482fcb7c300d401260502ba4c04076ee23db66c236d3ad50
TLSH
T1E7B0022A0DD3515E3769D195C2B095A03702F4167C595B2C8DC0574958EB6096442C92
MD5 SHA1 SHA512 TLSH

Submit Download

x96dbg.ini

Path C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x96dbg.ini
Size 122B
SHA256 672875a23347e407ff4a54c6baa35090c7041fa45568437f12b86b50bc2fbebc
MD5 45c1e010baaeb6b086b93c73cbfa1433
SHA1 6570b66b77103aac30dc7cccfacde1e42413890a
SHA512 6b00d4050ad80dc575b056e40b3fdae831e57d1b035fc7500c1523c70c7f03f344e8b53b070ec3c8482fcb7c300d401260502ba4c04076ee23db66c236d3ad50
TLSH
T1E7B0022A0DD3515E3769D195C2B095A03702F4167C595B2C8DC0574958EB6096442C92
MD5 SHA1 SHA512 TLSH

Submit Download

VSPMsg.dll

Path \??\E:\VSPMsg.dll
Size 9KB
SHA256 20fed915cd893469f7b5d74b0f9d1e845b62bfbb4fdf93a8434269e87a193f10
MD5 c086f13c6381d7016a7f51d383eaf70b
SHA1 1831e420e6d64c669cd484fdf5efd04b4bcd74a8
SHA512 3715f05cec8cacfdb36ad2afbd939e7ca195b090c7dd24568e9d87bca020ee42973171c13a6917aaad112f723ce455987833918618cb67d1b2b9afd1eb2dd878
SSDEEP 192:5LjzBNDets1OmDZk8Vc+eqyf7H2M/wWZJcYXHrlnT+Qgeol:pvyq1Vdk8eqc6M/wW0yrRCQ2l
TLSH
T18512FA02F7E031FCD87AC27407976123E6B1BC499932E71FAB8257623870651EA39769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2716-448-0x000000005FDA0000-0x000000005FDB5000-memory.dmp

Download

memory/2716-435-0x00007FFE3C500000-0x00007FFE3CA55000-memory.dmp

Download

memory/3248-557-0x0000000002C00000-0x0000000002C36000-memory.dmp

Download

memory/3248-670-0x0000000009BA0000-0x0000000009BD6000-memory.dmp

Download

memory/3248-594-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/3248-558-0x0000000002C00000-0x0000000002C36000-memory.dmp

Download

memory/3248-513-0x0000000002C00000-0x0000000002C36000-memory.dmp

Download

memory/3248-515-0x0000000002C00000-0x0000000002C36000-memory.dmp

Download

memory/3248-605-0x0000000009BA0000-0x0000000009BD6000-memory.dmp

Download

memory/3248-534-0x00007FFE61F40000-0x00007FFE61F96000-memory.dmp

Download

memory/3248-533-0x0000000002C00000-0x0000000002C36000-memory.dmp

Download

memory/3248-526-0x0000000180000000-0x0000000180051000-memory.dmp

Download

memory/3248-525-0x0000000009A30000-0x0000000009A7B000-memory.dmp

Download

memory/3248-524-0x0000000002C00000-0x0000000002C36000-memory.dmp

Download

memory/3248-523-0x0000000009A30000-0x0000000009A7B000-memory.dmp

Download

memory/3248-667-0x0000000009BA0000-0x0000000009BD6000-memory.dmp

Download

memory/3248-666-0x0000000009BA0000-0x0000000009BD6000-memory.dmp

Download

memory/3248-577-0x000000000C300000-0x000000000C3D4000-memory.dmp

Download

memory/3248-672-0x000000000AF80000-0x000000000AFD1000-memory.dmp

Download

memory/3248-679-0x0000000009BA0000-0x0000000009BD6000-memory.dmp

Download

memory/3248-689-0x0000000009BA0000-0x0000000009BD6000-memory.dmp

Download

memory/3248-698-0x00000000098F0000-0x0000000009926000-memory.dmp

Download

memory/3248-712-0x00000000098F0000-0x0000000009926000-memory.dmp

Download

memory/3248-713-0x00000000098F0000-0x0000000009926000-memory.dmp

Download

memory/3248-730-0x00000000098F0000-0x0000000009926000-memory.dmp

Download

memory/3248-723-0x000000000C820000-0x000000000C871000-memory.dmp

Download

memory/3248-721-0x00000000098F0000-0x0000000009926000-memory.dmp

Download

memory/3248-738-0x00000000098F0000-0x0000000009926000-memory.dmp

Download

memory/3248-739-0x00000000098F0000-0x0000000009926000-memory.dmp

Download

memory/3248-516-0x0000000002C00000-0x0000000002C36000-memory.dmp

Download

memory/4308-511-0x0000023FFFC80000-0x0000023FFFC81000-memory.dmp

Download

memory/4308-512-0x0000023FFFCA0000-0x0000023FFFCE6000-memory.dmp

Download

memory/4792-606-0x0000020239BE0000-0x0000020239C02000-memory.dmp

Download