dc91e962be7b41d32d831d6da40740fcae7684d990110f4bfe47cc581209c558

Analysis

max time kernel
149s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/04/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PRE-ALERT 876-415130768.js
Size 382KB
Sample260409-hs3csabw2l
SHA256 dc91e962be7b41d32d831d6da40740fcae7684d990110f4bfe47cc581209c558
MD5 69441972e7c138f1e55170bc7de9d435
SHA1 9f0d46d224878745af258e1a609c308337476439
SHA512 37ab01524d7978b28e03c347058bb1397f30eb8e4ce7eb688a1f46bd9f0777ef5fe6804390a71ff3e846fa127cdfe24c7accc73d3ddc36a482f24cd0b4697004
SSDEEP 6144:Ix4PEMvJ5H3HbMMi98jNPHN7RlE1hq94spmySGSs8gsDt+FZFucOgJe6hM:IxQEWp698JtVlaq6wJR6DIZvbe6hM
TLSH
T17284E634DD5C843A92F6A50FCB80964BFC4E5923371EEC47349726CA006A2C766FB96D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2440	powershell.exe
3	2440	powershell.exe
4	2440	powershell.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\WellingtonCyclingDispatched\\FabulousThrottlePitching.js\""	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2440	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
760	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2440	powershell.exe
2440	powershell.exe
2440	powershell.exe
2356	chrome.exe
2356	chrome.exe
2440	powershell.exe
3136	chrome.exe
3136	chrome.exe
2440	powershell.exe
2440	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeShutdownPrivilege	2356	chrome.exe
Token: SeCreatePagefilePrivilege	2356	chrome.exe
Token: SeDebugPrivilege	3136	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2356	chrome.exe
2356	chrome.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 4764	1304	wscript.exe	79
PID 4764 wrote to memory of 2440	4764	conhost.exe	80
PID 2440 wrote to memory of 2356	2440	powershell.exe	82
PID 2356 wrote to memory of 2912	2356	chrome.exe	83
PID 2356 wrote to memory of 5000	2356	chrome.exe	84
PID 2356 wrote to memory of 760	2356	chrome.exe	85
PID 2356 wrote to memory of 3192	2356	chrome.exe	86
PID 2356 wrote to memory of 1204	2356	chrome.exe	87
PID 2356 wrote to memory of 3980	2356	chrome.exe	88
PID 2356 wrote to memory of 1100	2356	chrome.exe	89
PID 2356 wrote to memory of 3136	2356	chrome.exe	90
PID 2356 wrote to memory of 1588	2356	chrome.exe	91
PID 2356 wrote to memory of 484	2356	chrome.exe	92
PID 2356 wrote to memory of 4004	2356	chrome.exe	93
PID 2440 wrote to memory of 3136	2440	powershell.exe	90
PID 2440 wrote to memory of 3136	2440	powershell.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PRE-ALERT 876-415130768.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless powershell.exe -w H -Nop -NOnI -EP BYPaSs -Command "iex $env:X3v9dt4HJh"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -w H -Nop -NOnI -EP BYPaSs -Command "iex $env:X3v9dt4HJh"
    3⤵
    - Badlisted process makes network request
    - Registers new Windows logon scripts automatically executed at logon.
    - Accesses Microsoft Outlook profiles
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:2440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd2200c728,0x7ffd2200c734,0x7ffd2200c740
        5⤵
        
        PID:2912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,8356934873552841415,1204714247886751820,262144 --field-trial-handle=1932,i,2952352925692480721,2239742571963596622,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
        5⤵
        
        PID:5000
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq" --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,14347090344378500467,254730432071624903,524288 --field-trial-handle=1932,i,2952352925692480721,2239742571963596622,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:760
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq" --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,10743763525453089872,15169140003953528911,524288 --field-trial-handle=1932,i,2952352925692480721,2239742571963596622,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:13
        5⤵
        
        PID:3192
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2880,i,11525377864061466900,1733865920511690916,2097152 --field-trial-handle=1932,i,2952352925692480721,2239742571963596622,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
        5⤵
        
        PID:1204
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2564,i,16391299376089930592,12858498961557398782,2097152 --field-trial-handle=1932,i,2952352925692480721,2239742571963596622,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:1
        5⤵
        
        PID:3980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3180,i,14101332329056212694,16743209770605805566,2097152 --field-trial-handle=1932,i,2952352925692480721,2239742571963596622,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
        5⤵
        
        PID:1100
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3192,i,445438400904197328,11417245472960068876,2097152 --field-trial-handle=1932,i,2952352925692480721,2239742571963596622,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:9
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3136
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3784,i,7367606642156260165,13684748898251832127,2097152 --field-trial-handle=1932,i,2952352925692480721,2239742571963596622,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:9
        5⤵
        
        PID:1588
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4152,i,5414740252574788180,13602197161709028556,2097152 --field-trial-handle=1932,i,2952352925692480721,2239742571963596622,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
        5⤵
        
        PID:484
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq" --force-high-res-timeticks=disabled --metrics-shmem-handle=4220,i,3389822595040148099,8368491114037922098,524288 --field-trial-handle=1932,i,2952352925692480721,2239742571963596622,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:14
        5⤵
        
        PID:4004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_niwnypbb.2k3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_niwnypbb.2k3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Crashpad\settings.dat
Size 40B
SHA256 33338479eea7aa716c7446aadb3386967b999cc991abf3b507404f58af2f1371
MD5 684ed1e243c6a2f5f69dabc7787d4e93
SHA1 26ee27a0a7deab1e9e25a2f074882bbb161d1b53
SHA512 540b335708f3b2ecd746f162e9ec9d3c33ad1c34f3cda42bb75db7fd8123c2ba78fb6a830b9a0533af4eb35bb31c9684e2dc3b054e679a2c9bd22e3813a9ad76
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 20e290b0b0805b37d21ea5563d3301a9fd3104dc83dc8c71fcd68ee5851dea4d
MD5 cba675a25d09c325dd06324a127cacbb
SHA1 7d50d2eb7724d123557a0f1ae9c504189309ebc8
SHA512 0f90d376cbea0d9d001ba3f30156e88fe2a5411a4b7cf0fc163783eb00641b9a92c0d8c1a675efee44a13d2948f7bb32c81a126824d3a24d06d314a73aed520e
SSDEEP 6:/FoEXEdTMkNWIKbMjud4xlE+i+st5gQyuIckEXa8skllEURlgDR/:d7XeNWIKbMjuOlEBLtVIckE1/1Rla
TLSH
T19E131C3C89A22EC7C3B420FC288B2F7583738A0AA21ACB5309B9303920C8B61546E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 f8121fb7859df6f16809bbd30664be68e6d622b9d45f66dc6ac438e87322aeb6
MD5 7e0742b7bc34bbdc4b1f6955b89c908c
SHA1 b2f21768395bc83978cf6d9306d3f3b87ef29328
SHA512 be240aa77453b1d97880c739c8257f94847db369cc4f24f0094c9e65dd3c1d77bb0d48b23324952c93d2e1d789270d15bba938e1e6a8dd7090881e11f3d5978c
SSDEEP 48:elKPZYwtfKHoEesM1XgwebXLO7MmXlAudVEPLVBKWwtl:6pwtiH4sugbLLO7jl9VOLHKWol
TLSH
T19A4487F71C04DEC7E729CBF46C85933C8D3347212C99ED7AF66844A20690AE7312C6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 a513ecd52155f7f427eb7875bbae8c56e2210a124240d4eb96862bc90600c993
MD5 ccdb870015f72a37d1b18219166d8ff5
SHA1 59bb367d91904b664e6066d48c1ab1aa686825da
SHA512 6e3603460734aa94f53c01b96bd0d5d63766c77518ed1c12db2fda1fca89d3924543c5c57572e11f75580f5797cdd0c4ce005ad99742c7575377b700eb01f97a
SSDEEP 48:pT1X0abWnBZLqayqg+uwyIR6//tWa1TBP6BMQowzw4DlNp3PwVps:J15YZma98wyIs/1nTBMMQol66Vu
TLSH
T133252940C2B4F9B2C21F77764A656F91E6BBF3A9F0990D50E628859C2A8584E2D006F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 6bf251e76a2252e99f0407c2206127c0dc7a83064b392831627e672b3b4190e8
MD5 370990ff166fc39846745d69136dd02d
SHA1 c358e52951faac0c1e7115a22d80fd0faedd80b0
SHA512 8fd94b6483f26826d91578d07372e2af272f432df9560dd1ded1d5c084c14146fef41cc0320ee4ae0a1fa4d5aa88072d4fc2358db9f3f8500bf3f5943943f8cf
SSDEEP 768:9UfDPLSgcRUv+rNts4+UfDPLSgcRUv+jNts4RfDPLSgcRUv+eNts4zUfDPLSgcR2:sWfsNBHAvHEZH
TLSH
T167162AB60F74B582E682EBF0BBCDDD187C7022D5D8D66892F52282798AE0FC44BC515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 74d4887df838fab4179a04136b48f1ff07b569ffa9b90d4c775a2fce8eca89fd
MD5 1c934ef67a16548e856d73dcb267b1f9
SHA1 8917505830c7efc35754eb991b5b385bbf90b70b
SHA512 a7e18908caeb710074802177bce22a6b458f1b03ee343b207f5227670f5b51721f03bac227e0fcc4e25e6c9305369ae76eeb79299286accfaca29eec804aa79a
SSDEEP 768:RWxBmf+RVdt+OSl8cPL/n0homb691zmqBnAt+8qV7cAj2:gBmf+RV2O2eomb6rzA34S
TLSH
T195F2F1067E59CD1FFED2E4160667DF0E64C089DAEBB33CD81D576E883824392971AA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Cache\Cache_Data\f_000002
Size 65KB
SHA256 462e16042ab45a503a5563355704593f45c1caefc7d220301253aab523d44439
MD5 345e5b9ec6d2aaeca6b903ee451249b0
SHA1 1a783e5a4a23ffa53e32f60cd7998732b402d3d2
SHA512 8eb38a9dfaab5a1578fa17fd7682e875c3d20bdbdf35ead389edf52507a0debe62cbf0000460c25aa407f505824b04ba6057b5714970c19a226bfe261633996b
SSDEEP 1536:tLl+pYsreZ5hZ4jTYMeDbRCMT07UvQUNGYjt7/T6:tApYseVlXRCMA7vUNGYjt7/m
TLSH
T13F63015E9D5477A2D2EBF774499056F980E3C22ED45180D77E0B2CFC2E9AED82023C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Cache\Cache_Data\index
Size 256KB
SHA256 4e0528802cc9c83b68b444c969e0dea990a21223f146f8d1379a8252758c4de1
MD5 5d1cc86b3c1be69307145479a69ed415
SHA1 0013436a5cde43afab5da7d2bda77311e4eaf4fe
SHA512 f5f8c0b746320963aa43fc45caed74fafdd983a87cbbc167ed2abf0cced1c133e77876daa745a74a3307e4597c4e47d01f7921dc7a98799b61f2574077ac92f7
SSDEEP 3:LsLllFlklNllklkXlVaV+lillLll/nsll//JNtlmNtl3Nl/lZllll/QlNlXl:LsRa3lPQslGSltRkNHNlll
TLSH
T1CA44025E97455E17C3C401FD844B4B50B374C545DA4F8747574429102CC17551D0F164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 f6e4bbaf067147096b374c8871c5b57807bf911d11122692f50fd7c96ec83f23
MD5 65ef2140bc616b1d6f9405c763a45825
SHA1 6e375d9299acdba748b7220b0ed5a607139e271a
SHA512 a6863b7e99fd4fe132f12ce8a07502f606a5d6a6f1a5f4cf6f9f631344b090a94b9fbf1a33c3005944450ceb08c52c7d2055a704e754d5840f68658e32b08855
TLSH
T145E02B91824C0F0DD32D96F7CDB603044A0E42C42ABE3A03A881C7C133125641258522
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 13f4fa9f7a91b7c03ece8b116bd633c8510f270f0ebb8636432c7622fe4af8e4
MD5 fd87c5101b1332c74f64227add911ba7
SHA1 8c5ec99c7e7f01a756f6dbe540eea541f6de0d87
SHA512 54e2e83aeb7286ebaabbaa8625db01c85dd3bf8e670c0b90bfde21ed8294945b1c75e894826206040abd0de454484885a33cd73467ea2384a8183d496eb4b195
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\DawnGraphiteCache\index
Size 256KB
SHA256 c7c96807f853541ae6a1d5f0b4f51658dde8b3d5c89203b34eebd3852c6e05f1
MD5 3dc8d73aef05283c637bb3e06c11d51d
SHA1 4053f70b0cd6a97a2b1084cdf9cac25a71b3244f
SHA512 1619bacaa5d4b4769acc66191c7373ce7b18dea6f2ec13bbea2d4bf19aac655cf260865addc2ebbe6dc1511b049540aedf74f084ad55bc3cc2fece308cc0c1bc
SSDEEP 3:LstlNllklkXlN6/l:LsX3lPE/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\DawnWebGPUCache\index
Size 256KB
SHA256 dad8c367a0eeb6e493cdd0715bba911488d29f4d3bd009c21cf8abda23e57724
MD5 069811beab5a691170cf4208e69e9a23
SHA1 b9f3d2fcf4ee229e12ec85dddc624b39dd33413e
SHA512 725a3bd443fda4652db5f90ec36ebafbeb1de244b1d818ebbdedcdaeb8f5bb097b77b6e05e5eae99b3230a553f98cfe3d453007dad3b95567377e0a382ea9145
SSDEEP 3:LstlNllklkXlOTyPl:LsX3lPOTyP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\GPUCache\index
Size 256KB
SHA256 ad6a9cc2b0ca3c50dc140050e621a31bfc71b862901088ad75c108df92c8cecf
MD5 ee58d4e4d22e735fe12a4f5a43d09c74
SHA1 e2545f6d16ca2da5f5d8678ab62ba8d71b91b822
SHA512 b45d370d407443e2962452eb361e62506d4b42bb4f8cf3edfdbf75179418de9776971f304b7d19059e38fa9b58fe141fd1feb4f571ec1335f0c0c0fbee6b99bb
SSDEEP 3:LstlNllklkXli5bKlll:LsX3lPaba
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c3eee95bb9508ac2fd76c2390db5309335ce1b63c846ee0a93d25022782b47cd
MD5 7026f40dc59b31f8fc94faf72364de70
SHA1 aa9182d45bb457af90f3fb56f67632054ba9b779
SHA512 86697ec4548079979f9e023742fe92fc298c83e7a0c502c47e4781bbff80f67db752c1102c960048e8dc44e3eedf0c3a6fc4918a048d5be2902ea0f9230ca028
TLSH
T142A0021542849516C31002F038038BCD1340B9258800471376D043869CE40584915554
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 04a297c85fcdb1ce343be472634b008f23f7946defe1ca5bed7f34a9ab942e85
MD5 b4788a305cdafa53fe9dca015e881d7b
SHA1 f0c03fb0922ef0038fa3cd3a118b1d235c7f9e7d
SHA512 980b049166b2e8dc0eb69bc14508740f950b1968bc98c4c4f5347acf7c8b4f06f529f50f68533fc97d8bacab106efae4ab64f217618c8762c7b8e25474cde2ee
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Shared Dictionary\db
Size 44KB
SHA256 b08af7745c49533422c5afb2e683b61ab1b025a2ef13f892321a2cd1383fba79
MD5 ad4b0d21f32cbccefd98c28e33a59a6e
SHA1 1850a90ed7ec61efca181fcc35927a2888549e6e
SHA512 0bc8a37f441ce5cbb0fe4ea3f766f741cc6424ac4274ffa42fcf507c8fc7154115375bc669449da02d8b57a19227483814357367cc8611cbecdf247d7b65706b
SSDEEP 24:TL6BgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:T1OIy4m1b3fbUdeqSB
TLSH
T16B13BB0F1E187551D1BD0236E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedStorage

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\SharedStorage
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\shared_proto_db\000003.log
Size 6KB
SHA256 357d9c45cbe9bbfdd4c7d486b5e6e2251b164090d0917d45c620d744a30880ff
MD5 d3debf9139c9fbc4bc181c498c422d0e
SHA1 6d1b6d81451a1d286d3a5b975822c221b1076d97
SHA512 0749ebdf7074099d6481413a191b766c8e64b6421c7d45fb89bb50a37e8dc083c234556f402ba21b59cb5857d184e6edca6de98a6fa6c06f851c5f7117542c1c
SSDEEP 96:wjK2jy51t5Q1Iak0AtFhpmSMy8BVSQeGGmo6pjSoPNf4IbTFITFy5TFyiTFyhn:et61boUpmHVSdGGQ9NgIb2c5cichn
TLSH
T10AD12091AFB31E91CC8ABEFBE4D5ED3B5362ACC5B166304297158FBB2D02F064444319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\shared_proto_db\LOG
Size 267B
SHA256 dbac6700e7e3306db1fa028f48e32042958af964094bb13a8133e7f010a715fb
MD5 905778ad3f1961c0739fe86b0c1c68fb
SHA1 2b0c5664b650e3c2c9fd74d5a018581e130d156b
SHA512 30ea5233c1232e958ecf4a4c6afdb4bbd184ee91094cce3edfd8bc8dc7dc5a79ec0224ac1e71e561fef8d8a8eaf99bf278d55f2fef15c1e0f473d4b45cb63cc4
TLSH
T111D0C235D4DBC7DE0164808761229349C255AC0AFFAC3A194E21C448210A50F6691A03
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\shared_proto_db\metadata\000003.log
Size 706B
SHA256 4180d9d4868fff801aad68bcb0dd2473442dc78f3151596d281cbf9b8ed423bd
MD5 b1aa32cc0f37506e914f63e60dac2e80
SHA1 bc342113fbac45be0ff73f00ba03b8faae749305
SHA512 605a974456544453d490a19204a0568cd304b5de5ae49784d064dde85b22ba3d3205a431f52aa9e7ca9f0e236c75a987ec5d48bd204c085194c2dfa2660fb897
TLSH
T1F5012016F730C510C05A4237B47AAB162364C0A28FB8FD0F087270683E72E000D4B2E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\Default\shared_proto_db\metadata\LOG
Size 285B
SHA256 369e7c97dda89279c6ca8f53e1115f3a70b476e09179eb669e72cd23f014c176
MD5 f9e6e47a0397c44ffc0928c24815aaff
SHA1 8322b97a9faa44bb927b3e01bd03e72c760f27f7
SHA512 067ca0cbce96330e8468eb609eb5b81d0e6aa69969fb630b6e735ffb8fdead0efde2d7718add4305835c8feab2bcf7a175b68e0e095ecedc8d21e2f82db5a4a9
TLSH
T1FED0C224E4ABC7DE0152809750229389C266BC0EFB683F194E51C848251A94F7696B03
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\wpzt12mh.yiq\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1304-0-0x000001A2E2D30000-0x000001A2E2D3C000-memory.dmp

Download

memory/2440-11-0x0000029B74DC0000-0x0000029B74DCE000-memory.dmp

Download

memory/2440-212-0x0000029B74420000-0x0000029B7442C000-memory.dmp

Download

memory/2440-1-0x0000029B74940000-0x0000029B74950000-memory.dmp

Download

memory/2440-2-0x0000029B74940000-0x0000029B74950000-memory.dmp

Download

memory/2440-10-0x0000029B74E20000-0x0000029B74E4A000-memory.dmp

Download

memory/2440-151-0x0000029B74940000-0x0000029B74950000-memory.dmp

Download

memory/2440-213-0x0000029B74950000-0x0000029B74962000-memory.dmp

Download

memory/2440-9-0x0000029B74DD0000-0x0000029B74DF2000-memory.dmp

Download

memory/2440-14-0x0000029B753F0000-0x0000029B75492000-memory.dmp

Download

memory/2440-15-0x0000029B755D0000-0x0000029B75698000-memory.dmp

Download

memory/2440-16-0x0000029B756A0000-0x0000029B7580A000-memory.dmp

Download

memory/2440-17-0x0000029B759C0000-0x0000029B75A10000-memory.dmp

Download

memory/2440-150-0x0000029B74940000-0x0000029B74950000-memory.dmp

Download

memory/2440-217-0x0000029B74420000-0x0000029B7442C000-memory.dmp

Download

memory/2440-214-0x0000029B75990000-0x0000029B759A2000-memory.dmp

Download

memory/3136-156-0x0000029F6C400000-0x0000029F6C56A000-memory.dmp

Download