ef2655df2baff62f909e3d4241f0ecbcdad71e791fa352d8c5b049a19b316e68

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Outlook_AutoRecovery_Package.js
Size 334KB
Sample260422-gpmbqady2x
SHA256 ef2655df2baff62f909e3d4241f0ecbcdad71e791fa352d8c5b049a19b316e68
MD5 0d61e9b87f32ec508191f927e9d86bbd
SHA1 7efa682f281c36068ba66c3662d757cf69ad6479
SHA512 81d4d53b210bfb3138311c7ac3944afcc6b42815c77aee901690e0634adf97d1de866126f40ce4538796331e22c926445b33bae361c937e1c3e6427fc324d4f8
SSDEEP 6144:dsIckB7qFA/+U7J1LfjH5LEDo5bISS/42tkmea7m3biv4OLNJF2ONP9d0lLOlvjO:dskB7n/+U7fjHlwo1Intzeaq3bivhF3e
TLSH
T137743338AAFA4019B1B3EF14AFF47493D96FBB633B0E985C1091034A4623945EDD563E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1596	powershell.exe
3	1596	powershell.exe
4	1596	powershell.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\GlobalizationSignalsBahamasBookmarkCitysearch\\CrackingBroaderTreasuresDrainage.js\""	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1596	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3720	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
4304	chrome.exe
4304	chrome.exe
1596	powershell.exe
2948	chrome.exe
1596	powershell.exe
1596	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeDebugPrivilege	2948	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4304	chrome.exe
4304	chrome.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 2388	8	wscript.exe	79
PID 2388 wrote to memory of 1596	2388	conhost.exe	80
PID 1596 wrote to memory of 4304	1596	powershell.exe	82
PID 4304 wrote to memory of 1980	4304	chrome.exe	83
PID 4304 wrote to memory of 5040	4304	chrome.exe	84
PID 4304 wrote to memory of 3720	4304	chrome.exe	85
PID 4304 wrote to memory of 2364	4304	chrome.exe	86
PID 4304 wrote to memory of 2424	4304	chrome.exe	87
PID 4304 wrote to memory of 4924	4304	chrome.exe	88
PID 4304 wrote to memory of 1504	4304	chrome.exe	89
PID 4304 wrote to memory of 5096	4304	chrome.exe	90
PID 4304 wrote to memory of 2948	4304	chrome.exe	91
PID 4304 wrote to memory of 5064	4304	chrome.exe	92
PID 4304 wrote to memory of 2172	4304	chrome.exe	93
PID 4304 wrote to memory of 4408	4304	chrome.exe	94
PID 4304 wrote to memory of 2176	4304	chrome.exe	95
PID 1596 wrote to memory of 2948	1596	powershell.exe	91
PID 1596 wrote to memory of 2948	1596	powershell.exe	91

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Outlook_AutoRecovery_Package.js
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless powershell.exe -w h -nOP -noNI -EP bypaSS -Command "iex $env:6MYz5PzYE6jUehA"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -w h -nOP -noNI -EP bypaSS -Command "iex $env:6MYz5PzYE6jUehA"
    3⤵
    - Badlisted process makes network request
    - Registers new Windows logon scripts automatically executed at logon.
    - Accesses Microsoft Outlook profiles
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:1596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4304
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffaff09c728,0x7ffaff09c734,0x7ffaff09c740
        5⤵
        
        PID:1980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1644,i,1071144768207580019,9708671368306414198,262144 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
        5⤵
        
        PID:5040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --force-high-res-timeticks=disabled --metrics-shmem-handle=1940,i,9034501272059424551,7301775335219357416,524288 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,9645284099253111992,9946323721310290661,524288 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
        5⤵
        
        PID:2364
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2960,i,14592029086089214201,3391397889378168674,2097152 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
        5⤵
        
        PID:2424
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2964,i,3384653801781909929,2644563193080719944,2097152 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
        5⤵
        
        PID:4924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3092,i,1593073359956103510,10108987711475210393,2097152 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        5⤵
        
        PID:1504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3112,i,15012782480550104309,15203990299164627870,2097152 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:9
        5⤵
        
        PID:5096
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3840,i,6274091688985472566,564306858336205857,2097152 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:9
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --force-high-res-timeticks=disabled --metrics-shmem-handle=3808,i,16742196633054750412,3053088271104655851,524288 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:14
        5⤵
        
        PID:5064
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4160,i,9923852598719934657,4502669680036248715,2097152 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
        5⤵
        
        PID:2172
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --force-high-res-timeticks=disabled --metrics-shmem-handle=4156,i,7739594534923611935,3599366899681614558,524288 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
        5⤵
        
        PID:4408
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb" --force-high-res-timeticks=disabled --metrics-shmem-handle=4268,i,2578805391086268956,1136800261248244192,524288 --field-trial-handle=2032,i,4826529811233104188,174277351031049371,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
        5⤵
        
        PID:2176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Crashpad\settings.dat
Size 40B
SHA256 0e6c65348dbd262b2e2331f6b16e05ad69f89c7b6e7fc0948b732d80e731242f
MD5 c284e2dadd5767b37b203e04f3b32c56
SHA1 6e2bb442cb874fb1028169a1619b6b99341443d8
SHA512 815ac5ca19b619933c6ef6dc197db9e60b2369ddf5540ea92a35d394fed943e67ca494780f7b833716a306f9e61a7bcb8f8a49b7535055c7dfcbf460f044e29e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 671da4aba4aa970bcb5eb046b5ef4db4699a0fed41d1845a19f9ee74bdf17c8f
MD5 a3b9a042eb2c4f2bd094c5db1ae17c4d
SHA1 052bed35ca89161205a8233f52a1b5db9000ae8e
SHA512 31ebd5adf8bf01f7f49d1c827f14810bea53cd6aa0a6be9ee4c51859e3bf176ed9cbc472b09371a69231a7c4469d8467c346447b80698901b2c2ce680707e81d
SSDEEP 6:/FoEXEjwN6bSamElhaDkKhLwDO+C1gK5ltDFVg5Je5mpFeXg:d7XXk1oxwOyKlDF6amrI
TLSH
T146135E2C8351CD2AC7D247BCCB5F1BB26BF9C2849061868351E03036650AB22440F105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 3f7772360b72f8eec9c2bf7ce9e2667e6e44397459b57f305c8d153596512d75
MD5 31d7d4323c642da19b8938a888c76bf1
SHA1 b8e346f1a3b73e61bf6e08962fd8d675acf3cb41
SHA512 ed7c2d458ddeb05b389d49723d68ce416f381b3e9327cfeddb0e1bcd83154c8c477e657479bdca8ae8c3c368e20bcdc14cf4fbd1b29fc66f50164898e8dcb0fb
SSDEEP 48:BGlgYB2qHoERqM1Xg7H1kMmXFXidVEPLVBKWwtl:BydB2qHqugb1kjV4VOLHKWol
TLSH
T1094487F71E01DEC7DB28CBB55D51923CCD3297222CA6ED76F27844A20590AE731286B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d1f05aa583bc1dd7cbf739282cdbfc22267e584b938f9f4e365b86b0d3ae60cd
MD5 54d25a74e00cf3ba9b22b6e2479493df
SHA1 1c0b9037130a784a825d6168a5745a6ea893494c
SHA512 f6d5ae6b7f09824c7635b1e1f5502ddf9e7b29ab2fe41a95166330e60cea6392f8e3d8e8935da723497c94907c9b16361889e2d42db9f022449ad57043cbd99d
SSDEEP 48:pz8im3RmT06ach+qdRh30BIH2MM85zjo7ZwkB7SG9J6KKpP6VyoP:h8YT06ach+Ok+2MM8JMeK7SGb6KKpSV
TLSH
T1CD252CE1E6794616E1AD58BB0CF2E1302764347B78435C00A55C367E58AF9F29D01685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 56d1ae877e91c8fb3794be929c3a4774d6f7ea52b959baefdaa0c00db80f98d4
MD5 0dcceda09cd8c0927af3ee452f1747b0
SHA1 ae64ee8e927ccdaa2ee7d0afafe52011db045f3e
SHA512 2bad546a3e5d935439d21379250dacd265db2069799a5e0f5c0a84f3c769d957b040e111626e4c3ee91dc73fda574c785a37209070d66aadeba3ff3067170701
SSDEEP 768:dx84gxB4oxi4AfDPLSgcRUv+l4pI4r4n4:chKCrSa
TLSH
T199165BA70F28B542EB86EF70BBCDED0C7CB02391ACC79492951292B946E1FC857C515E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 983dc6c543dcf24465e5976c87ad21d0c5d1a2bc8505392fa9d4ce442d954120
MD5 0ad96329bfa3eafcd7c92de5ae107587
SHA1 00db9d72833d3762a6ac53a6411a5aa4dee733a6
SHA512 7cc6daff1e1ef00667e82106f1446d11165197b10be393f4bb5ab69c051c484eadba21fc19cbfd44be219f13c7634cff1a88a5b3c3db7f7cf3475aee65d5e9ec
SSDEEP 768:8Id0onj7u3r+TTnJMDz++TnV0W3I+TEp5oKn1G4KAtAh8bOkJ2HbiTO4sej:LHn/u3raTJMfbmn+w7A4KAti8akJaK/j
TLSH
T1D7F2F177E9CCB1CD779C14E2E2862F43AC7CF53D84F9A6A95CC12F4E581D412B8201AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Cache\Cache_Data\f_000002
Size 53KB
SHA256 e0dd88109d313464a7234c4e55f9ecf2b38749a922855c8005ebb379840d881f
MD5 eebb2e925c267b24c44a59ebfb22c9e9
SHA1 4c7b425a41ea0475b339c6dfa54c2823fc384e97
SHA512 295aabca40888db8839d63cfdbd8518e684e6e6539c1019f92366f54f435b4a842d4f3ad805bacc2b4176aecd15281600740f08d274e3740c6d6003c4894a850
SSDEEP 1536:y8UxBDExSRiOye7twM6Jg3XcKC61DggmoeqwypyN/maSe:orDExSRiOOJj8DgYhwya/dSe
TLSH
T17643020919C76B758D420F2E85794A83472FF8E4C2DAA8CBB9D650CDE9490EB13187C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Cache\Cache_Data\f_000003
Size 66KB
SHA256 398d2b08a7b49d285fe53ee0339e49113c125ee67c4a6fe51de27bcf138a2337
MD5 44334eab6971cbf5bda184b100196d0b
SHA1 5cb9b2a90f18ee997115f15666b75bc8ff4d054a
SHA512 fa7e3b85c0df77557d2efd5dc6336c7ff481e59d21c59b4412910c1d96e0515211fa04e8a8a64624897664f922c7792458dca81cc3886b75d5545490c1377cfd
SSDEEP 1536:oLz/FOUDvzeagJ1o+gH88rKWfSvawAzTmmQYku8q7z+6GqK97zln:oPFO2qagIH9tKvaw8mJYyq5Lg7l
TLSH
T15263026F4083DD104A7B0DF89927BC256687437A896E1773CC0BA0F97D29418AE94E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Cache\Cache_Data\index
Size 256KB
SHA256 f9539c8eaf24dcfa2690283546b1c79432b59a2d06b3acf31bb54de803581d3b
MD5 ae2d4bfbefda886392d2031d1131d867
SHA1 e244ce680fde3c79ba14e5448ed605cfba161175
SHA512 c373436fdb87d9d9dc78c5d2cf5b595d51d60daae997dde9b4400159f9e43f91627688734da587d122ddbb6d4b0838ccd77b8cdcdb2c42dbed5ffd8bf0255feb
SSDEEP 3:LsLllNlNllklkXlKkKP7llLll/nWE/L/JNtlmNtlYlXlglNlXl:LsRt3lPvqh4ETRkNI
TLSH
T1CD44016E87868E1AC6C645FD898BCB606339D61ADAAFC743134535202CC9BA11E1F5A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 6d072d57c9138e15c957fda05d82f62d6d6196eb15b24d724177f22a71a4e426
MD5 8490b11260f351040cfe4ea53f00e2d6
SHA1 91a120cc07eb1fe03483c05fb02a36aef51684f0
SHA512 ecdfe1f2d1ef2214ab9984c2b62467ba792e6847177331bb79f448f2c55c657c29a90ffb8939b598d975ca699959cd32cd57e2ac31e03c2d1223e624388f444a
TLSH
T146E02B81C24C0F1DD32DD6F7CEB703044A0B42C42ABE3603A880C2C133624341258122
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8fba300fda89034e1bc3d8f8f927d6af95df7956f6b78c661f606e8f196274bc
MD5 f714148d46459c4fa6898d8927b6d878
SHA1 05317f31a89acf29b8eef9ba9a2075ddf67330c8
SHA512 821932caa0f4b15216cdd9d231efbc3d319790167a31c038b1b18526a82c2d6677e8c846aa2e75e1ad48fc5efd09f4e1a5474a94ff86a7d0b84d35ab9e47a46e
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 a5e86a62135e7bb85f0a0041b2f70a6e88f34e07191767ece3948630272bf293
MD5 732cf23a184f075ed499c83731bad5b4
SHA1 c53571e13a6bfc28c520341b603f6a5993378175
SHA512 75f8ff70462d058985fa6a126e64d4de4a98e9a3fa1dbef178f6c403a0cf6b024cb9950148d46d64f0ba93667364b88b943b24e3cd9943585de1334faaab52dd
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\DawnGraphiteCache\index
Size 256KB
SHA256 5c38e7ab55d2cd24116c5dc4f39871a8aace28b8f6cb8dcafd91aa71a3f9cd57
MD5 62e194ce6d538569cedfd7eb3856fbb3
SHA1 4e5ad278fcbe84ecae3fb28841cfba0a695ff4eb
SHA512 8f727e0af79f9f9860944a8657a172f2ae2bad570f7053f257a83683c925852bf09642fdc8abf576908fed9fcfdcd3e3a9a06adedd27ee220a0ea012880ab528
SSDEEP 3:LstlNllklkXlRg:LsX3lPRg
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\DawnWebGPUCache\index
Size 256KB
SHA256 5a128dfa9bfcec48ed3f2e70947b270c77ed5084d7c6f18be7885d4ccf897a78
MD5 a7169f924c0780d7e9984b81499fa818
SHA1 0aca45a8cf3fa3dcfd70561549113fa36c749b03
SHA512 202c0d8d2d9ca041ef21f76c25a7af817e0afc30be6b40d721f3ca0f38cc7bdc87a2360fed8e06ce5fedbd87b15987eadcd2fbd890b3f12076de783b0ee9159c
SSDEEP 3:LstlNllklkXlqg:LsX3lPP
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Extension Rules\000003.log
Size 76B
SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
MD5 cc4a8cff19abf3dd35d63cff1503aa5f
SHA1 52af41b0d9c78afcc8e308db846c2b52a636be38
SHA512 0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Extension Rules\LOG
Size 265B
SHA256 633fe954a4377b2580ba8483120101d263fb3503c9308c2fcb125232b5638340
MD5 71fae59b88f5fae08bda4f2016a8cbdf
SHA1 9cf9950ef6a5afb9ec07774a86092c37e467a95d
SHA512 84c5cd80ae5bb9a818d761c8049e1cf3888d3118bf7aaccbdd0f1a5ef0b57cb0ca4e8c85c82903d6174f57d22c7042811a55be1f06346d278d3f29b9f1079619
TLSH
T14DD0C2175496C5A91119E0A7EFF1534CC254A80DB79837190E5DC8C8308780EE195B80
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Extension Scripts\LOG
Size 269B
SHA256 409b98a0e29815b93bfd064bb75c0b2d367b59da3734af3443b2e67023945964
MD5 5013310e5900d25d7eab37eafe0ef12f
SHA1 f5bc52c2aa92afae3655f483ef1fdd6786e2fc5e
SHA512 b42404d0117edbfb667dc99fd3a06ebce1ba7ab2917b793efecc12f04d6be8806b8eec245c4fdcfe0889dcb350b7b92984ebcaa73ddd1108183cc6734b3501da
TLSH
T133D02B1A5CABC5B9011DC4E3DFF2634CC2D47409B794B7190F5DCCC8208B90AD991F80
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\GPUCache\index
Size 256KB
SHA256 07a7988c80c6bd41e2efe26c39cb3af76ca5735a4ff9a200d219ca585308f42a
MD5 de822b716044665e43f858bae94a6c6f
SHA1 bf66314edca006da5556041ff9bfbb49262f55e6
SHA512 720c817ebe6e5b0f82ce6a10d76d60cbbd07cbed78c2f6b555a3cbbe3b7a3995f969eb2c14128f8d9fa8b1a0e6e07b978dcf7bdc3f4de86cb4ee41ead5ee177e
SSDEEP 3:LstlNllklkXlR:LsX3lPR
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Local Storage\leveldb\LOG
Size 277B
SHA256 6565cad5fbc58085b21770a0058dc135b600ac9852257049960ad6e8f1d4f5ae
MD5 dc401608bfee6a6f60ac9da08e2c2fca
SHA1 d33eba25d92ee58e8d738b6eeb0c10c9790a1c19
SHA512 a8ed8df7b93babc3f328d84c1bd1b4c9ad8f97e6a08ce33e9355fb8ddb96017ef84d6cc2e63d37d85ea7aba561cfc268ffbcecdd79cff1fcfcdb9724ce73c229
TLSH
T1A2D07D328467C19D0309C12B976E734CC7305409F6992B090D59D8843047408D3816C2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Network\Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Network\Reporting and NEL
Size 36KB
SHA256 473cee21f162f3a7a25635fadf8a9264238ac53cf89f7bb67ede9fbcdc676cfc
MD5 56e8276cedbc027359e31311dd2f91ed
SHA1 5aead8213b1fdeb895b9d51975126c5527ed8949
SHA512 c6ae5450f3ec31cb87fe6deb33b79c9c7919f637343e93cd0866d52c9fdaf674ab82eec261d77aeb0da4a5ed9f2960431657474cde55067a8b49c58c5a12888b
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:uIEumQv8m1ccnvS6
TLSH
T195F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\Default\Network\Trust Tokens
Size 36KB
SHA256 61747eae344a1ed6b1bea06522e094eba6879049db5f918e55423dbd8981a881
MD5 f2a84020dd3bf7c981b9b69dc6b8951e
SHA1 362b54cbf3c0ad6473ca595d4b72930ad9268890
SHA512 75ef07c38033b51286eb208d494d3856e7238bf0b1e928c8c35b5ececa05e8b591fc908ff83f89a1695ba74ed2bd155e49d35222a8cfdf8dbe936daeed7ae1f9
SSDEEP 24:TLn3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T731DtX5nDOvyKDhU1cSB
TLSH
T1A5F2469BA93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\ShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\4fijif4u.xdb\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_cwrocksc.cyr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cwrocksc.cyr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-1-0x000002653F870000-0x000002653F87C000-memory.dmp

Download

memory/8-0-0x000002653DAD0000-0x000002653DC6A000-memory.dmp

Download

memory/1596-19-0x000001D9BDCC0000-0x000001D9BDE5A000-memory.dmp

Download

memory/1596-11-0x000001D9D8130000-0x000001D9D813E000-memory.dmp

Download

memory/1596-18-0x000001D9D81C0000-0x000001D9D81D0000-memory.dmp

Download

memory/1596-22-0x000001D9D81C0000-0x000001D9D81D0000-memory.dmp

Download

memory/1596-21-0x000001D9BFEF0000-0x000001D9BFF02000-memory.dmp

Download

memory/1596-20-0x000001D9BF910000-0x000001D9BF91C000-memory.dmp

Download

memory/1596-16-0x000001D9D8730000-0x000001D9D87FA000-memory.dmp

Download

memory/1596-15-0x000001D9D86D0000-0x000001D9D8728000-memory.dmp

Download

memory/1596-14-0x000001D9D8520000-0x000001D9D858C000-memory.dmp

Download

memory/1596-17-0x000001D9D8800000-0x000001D9D896A000-memory.dmp

Download

memory/1596-10-0x000001D9D80F0000-0x000001D9D8132000-memory.dmp

Download

memory/1596-23-0x000001D9D8EF0000-0x000001D9D8F40000-memory.dmp

Download

memory/1596-9-0x000001D9D8080000-0x000001D9D80A2000-memory.dmp

Download

memory/1596-2-0x000001D9D81C0000-0x000001D9D81D0000-memory.dmp

Download

memory/1596-224-0x000001D9BF910000-0x000001D9BF91C000-memory.dmp

Download

memory/1596-220-0x000001D9D8EB0000-0x000001D9D8EC2000-memory.dmp

Download

memory/1596-223-0x000001D9BDCC0000-0x000001D9BDE5A000-memory.dmp

Download

memory/2948-165-0x0000026122F00000-0x000002612306A000-memory.dmp

Download

memory/4412-226-0x0000026FD3610000-0x0000026FD37AA000-memory.dmp

Download

memory/4412-238-0x0000026FD3610000-0x0000026FD37AA000-memory.dmp

Download