7b679a520a543299f7690098878395870cb111ed8cdd7c828abdf6394ad3656d

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pre-Alert# 44722 Booking# RICG395300.js
Size 989KB
Sample260527-n5cksae131
SHA256 7b679a520a543299f7690098878395870cb111ed8cdd7c828abdf6394ad3656d
MD5 557c4efdba3a0b4d677b88c8a439bab1
SHA1 e92eaccecdeeaf70ac7e56097dd98fb2dfce102d
SHA512 8ba088aff3f04d2647214af6504ad5fab469d32a627ca9176774702e29d55ec88d3e4700a931e68073702a2010e16998ce258a5b12d73ebf42e5e6bcf30b1209
SSDEEP 6144:uDdHtopkSeLqEy3z1GK3ei6NATwMnf6xa7:uJHgesNnf9
TLSH
T170254E51A7EA5208F2F75F886AB55415597FBD6A2C39E2DD1208219F0BB3E00C8F1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 11 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
15	5420	powershell.exe
16	5420	powershell.exe
17	5420	powershell.exe
18	5420	powershell.exe
24	5420	powershell.exe
25	5420	powershell.exe
53	5420	powershell.exe
54	5420	powershell.exe
62	5420	powershell.exe
66	5420	powershell.exe
67	5420	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	wscript.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\DeclarationsOfferedAbnormalEpidemiology\\OxidationAttendingPakistaniDifferent.js\""	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 39 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5420	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5208	chrome.exe
5328	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5572	chrome.exe
5572	chrome.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5704	chrome.exe
5704	chrome.exe
5704	chrome.exe
5704	chrome.exe
5704	chrome.exe
5704	chrome.exe
5704	chrome.exe
5704	chrome.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe
5420	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5420	powershell.exe
Token: SeShutdownPrivilege	5572	chrome.exe
Token: SeCreatePagefilePrivilege	5572	chrome.exe
Token: SeShutdownPrivilege	5572	chrome.exe
Token: SeCreatePagefilePrivilege	5572	chrome.exe
Token: SeDebugPrivilege	5704	chrome.exe
Token: SeDebugPrivilege	2748	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5572	chrome.exe
5572	chrome.exe
4824	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4848	2296	wscript.exe	87
PID 4848 wrote to memory of 5420	4848	conhost.exe	88
PID 5420 wrote to memory of 5572	5420	powershell.exe	103
PID 5572 wrote to memory of 5612	5572	chrome.exe	104
PID 5572 wrote to memory of 5144	5572	chrome.exe	106
PID 5572 wrote to memory of 5208	5572	chrome.exe	107
PID 5572 wrote to memory of 5704	5572	chrome.exe	108
PID 5572 wrote to memory of 592	5572	chrome.exe	109
PID 5572 wrote to memory of 4504	5572	chrome.exe	110
PID 5572 wrote to memory of 5600	5572	chrome.exe	111
PID 5572 wrote to memory of 4544	5572	chrome.exe	112
PID 5572 wrote to memory of 5352	5572	chrome.exe	113
PID 5572 wrote to memory of 2124	5572	chrome.exe	114
PID 5572 wrote to memory of 5548	5572	chrome.exe	115
PID 5420 wrote to memory of 5704	5420	powershell.exe	108
PID 5420 wrote to memory of 5704	5420	powershell.exe	108
PID 5420 wrote to memory of 4824	5420	powershell.exe	117
PID 4824 wrote to memory of 2936	4824	msedge.exe	118
PID 4824 wrote to memory of 4492	4824	msedge.exe	119
PID 4824 wrote to memory of 5328	4824	msedge.exe	120
PID 4824 wrote to memory of 2700	4824	msedge.exe	121
PID 4824 wrote to memory of 2104	4824	msedge.exe	122
PID 4824 wrote to memory of 3512	4824	msedge.exe	123
PID 4824 wrote to memory of 4344	4824	msedge.exe	124
PID 4824 wrote to memory of 808	4824	msedge.exe	125
PID 4824 wrote to memory of 5720	4824	msedge.exe	126
PID 4824 wrote to memory of 2248	4824	msedge.exe	127
PID 4824 wrote to memory of 4884	4824	msedge.exe	128
PID 4824 wrote to memory of 4244	4824	msedge.exe	129
PID 4824 wrote to memory of 5584	4824	msedge.exe	130
PID 4824 wrote to memory of 5860	4824	msedge.exe	131
PID 4824 wrote to memory of 2304	4824	msedge.exe	132
PID 4824 wrote to memory of 2748	4824	msedge.exe	133
PID 4824 wrote to memory of 2448	4824	msedge.exe	136
PID 5420 wrote to memory of 2748	5420	powershell.exe	133
PID 5420 wrote to memory of 2748	5420	powershell.exe	133

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Pre-Alert# 44722 Booking# RICG395300.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless powershell.exe -w H -NOP -noNi -Command "iex $env:LhvtSYyyassb"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -w H -NOP -noNi -Command "iex $env:LhvtSYyyassb"
    3⤵
    - Badlisted process makes network request
    - Registers new Windows logon scripts automatically executed at logon.
    - Accesses Microsoft Outlook profiles
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:5420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5572
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe3303c728,0x7ffe3303c734,0x7ffe3303c740
        5⤵
        
        PID:5612
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1648,i,4934225650538335394,16219266976332592311,262144 --field-trial-handle=1956,i,15507664958806308143,117966660459698851,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
        5⤵
        
        PID:5144
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy" --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,15142973957743149695,14596354509744843421,524288 --field-trial-handle=1956,i,15507664958806308143,117966660459698851,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5208
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy" --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,1255926583044654049,6275108828945315152,524288 --field-trial-handle=1956,i,15507664958806308143,117966660459698851,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2896,i,7013551296964207442,12385849674340572415,2097152 --field-trial-handle=1956,i,15507664958806308143,117966660459698851,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:1
        5⤵
        
        PID:592
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2912,i,6443114330041614776,17268383863062576109,2097152 --field-trial-handle=1956,i,15507664958806308143,117966660459698851,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
        5⤵
        
        PID:4504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3280,i,10291831442149444896,2067585113619408876,2097152 --field-trial-handle=1956,i,15507664958806308143,117966660459698851,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
        5⤵
        
        PID:5600
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3300,i,12209668588267607060,8129199581631011979,2097152 --field-trial-handle=1956,i,15507664958806308143,117966660459698851,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:2
        5⤵
        
        PID:4544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4080,i,6430410627614100837,8168985526620207197,2097152 --field-trial-handle=1956,i,15507664958806308143,117966660459698851,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
        5⤵
        
        PID:5352
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4172,i,2070004565404265873,8503390635945296370,2097152 --field-trial-handle=1956,i,15507664958806308143,117966660459698851,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
        5⤵
        
        PID:2124
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy" --force-high-res-timeticks=disabled --metrics-shmem-handle=4112,i,1952786086206578186,15884348938459905406,524288 --field-trial-handle=1956,i,15507664958806308143,117966660459698851,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
        5⤵
        
        PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc"
      4⤵
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffe2f41c188,0x7ffe2f41c194,0x7ffe2f41c1a0
        5⤵
        
        PID:2936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1728,i,13398177475982746477,11336937892299723024,262144 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
        5⤵
        
        PID:4492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,10500761060854715043,13447668982956697884,524288 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,14434331274203443391,1944436466310834895,524288 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
        5⤵
        
        PID:2700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3084,i,16087952789295181075,7079992873113876083,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
        5⤵
        
        PID:2104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3088,i,18073320399593413624,13684201728608222725,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
        5⤵
        
        PID:3512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3560,i,5145845361690326691,11008804789061502939,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
        5⤵
        
        PID:4344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3524,i,15465174943073411605,7112718260223855421,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:2
        5⤵
        
        PID:808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3576,i,2670097375500859272,15823153815214543351,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
        5⤵
        
        PID:5720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3600,i,12103390439459612848,12678657357734580074,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:2
        5⤵
        
        PID:2248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3616,i,17108307555899456294,2548308173648210078,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
        5⤵
        
        PID:4884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3700,i,3228370318912098355,10062982605861445617,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
        5⤵
        
        PID:4244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3720,i,7745398022592666705,12374376632190844032,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
        5⤵
        
        PID:5584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3744,i,9657325796224342227,8150481722592790654,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
        5⤵
        
        PID:5860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3760,i,9369472476829723555,9629440279294727830,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
        5⤵
        
        PID:2304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3772,i,4497502223038126,16492085565463465405,2097152 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:2
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,13269835619622871936,14904087346614886383,524288 --field-trial-handle=2180,i,10414522013944155110,9039996425768358758,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
        5⤵
        
        PID:2448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc\Crashpad\settings.dat
Size 280B
SHA256 e993bdf47dcd0eaecececacc81cdd447ef83dfce721b4a3bb5bc36e74d078f08
MD5 98498e3e960f37e3c0e425b68fa45c4d
SHA1 58ddfa7cdd030fdbc22b74c98d6dca80bc462e9c
SHA512 e6cfe86737ab6001857356f36efa63670f66812b40eec4fc9644debcbdf2d9f1b21b343ed4bc254a1b0917b1be4caf5ec0d90c609e51fdc71055266cad0d3ea8
TLSH
T1A6D01130AA82AE00C02C20B00022828ACA00A880022200A080E08FEC88028A8220E088
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc\Local State
Size 4KB
SHA256 39120e7102f672becf968fb55fe16a11eaab523fc24e1cb260ee43e37ac9a9ea
MD5 0d01a3625ec0d8f5cb3807bcd75f3e85
SHA1 4b5e42843830857553df458ee7f45f9461a25c1b
SHA512 7c75795b34c6233b2fe3fee5476dbeb1fe9208ef735da9f88a837cda3e5de6c31631eefb6330a2b613db954e985e1b8a69e86a5f23d7d87872421fe975c9bd82
SSDEEP 96:VqGNkvsIMf1BO1b/D/BzPqKvVM+G4NCy50x4UOEPlq4a:sGN8HwWXJDqn4H5XEm
TLSH
T1DB91D7717824EC2319E56648B59A36939F7830B7DD55AF98F6D8531C04EB34C3B0E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc\Local State
Size 5KB
SHA256 4d9f30ad94cf45117d5c17b22b4a371614d3ac0e5649aa9836f78cfd4ed71cdc
MD5 40f3d407db97182d2a006fd27763b444
SHA1 77ffc9a1076ec9f82aa4339408ed7f0914e65257
SHA512 3d3c63c1ff95a73a0558c8a1b432e343d265e076924b30b44838d8de494814566713574fcb34afde866bdd8dc974a090293305fc78a6efd191d44df0cda0de9b
SSDEEP 96:VqGNkAQsjpf1BO58Frh/cInURoDotovGuDoBzPqKvVM+G4NCy50x4UOEPlq4a:sGNI6P7ooDUw1cDqn4H5XEm
TLSH
T172B1D7756834EC231DF5AA44B4CA3753AFA82177DD85BF99E6EC0B1C04DB388274A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5926b8.TMP

Path C:\Users\Admin\AppData\Local\Temp\5gdu0jng.wwc\Local State~RFe5926b8.TMP
Size 1KB
SHA256 73dc8bbf49ee86453e1a2c1c873805f50c4fc500882e5a212b73d7903044e6b0
MD5 09c0aa83aa6647a09946ba530bac2175
SHA1 30d2a295531c6a36329b957cbe27c029e34c5976
SHA512 caa08b86ec30b6e925c29ec3a728622937c3f03f46ab43da2fef641c556dae051b7008189c092f108fcf901929b24c8d47bda122fde620db4f7f5ef359e4ff0c
TLSH
T1AB31A9756C642C736CA14289B34EFA539B342579C2965E98A6FC0B2C04E76CC120FD3A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xwr1t2xe.hkv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xwr1t2xe.hkv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Crashpad\settings.dat
Size 40B
SHA256 0c8155da64dae1c48a4729bbd384029f8db14840313d0689bad1e1b35fc9dc19
MD5 0b3acb780b1ad08882528400a550693a
SHA1 8d3db42c245a57115d7ef58474c37f7c21d42a37
SHA512 a33348463fe519521857c6fa864abfd7da41077ad4b4a63b4a5e0937324b787e6d5183fdc3635ca18a3eec126f3995fbad71b0da66bd003b538714743cf0acbc
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 4b9cce204369ebecc6679686922e5bf28e285060a8561683185b4a0aee0d3b59
MD5 99bfaf407284e1d10f3cba0dca2047f1
SHA1 6bd4067f62ef872f4b3145c211f6f65ea7fde06b
SHA512 3d31332f608f497d54e5bd37c2c7c3f511782df706763901c9fb5325c6ebd19a858077957f59d97c9309e8643678aac428713aa271415cc4dd86b5a76b2f050b
SSDEEP 6:/FoEXEgo1N2AAUMpDOF/QdYYp/QryccekEX3Vus1mkll2t+g:d7XwNfAtBddewekEx/2t+
TLSH
T109135E2DC6905F4AF294117C184B1BB823F583048662AB8381B13272374A701543D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 53d3a6fb76eaac8b740aef412cf9f84dc4afd8916afef54f898b41c9950f2126
MD5 ff6ca9d859bf01dfba4e87f2ee402945
SHA1 0a59f27fd7a5c6e648589ea96fccf2f2b7e89701
SHA512 23a29e1431c114215f1af41d8df9924cfcf5de13ee78a21c6fb32fb774f5a66f9c888694d41c3d9d2859a59ef6a5507ccdebdbaba96eefb6933d728cd34a9920
SSDEEP 48:2lAUQYGAfiDM1XghUXTqMmXodVEPLVBKWwtl:CAUNbUughUTqjGVOLHKWol
TLSH
T18F4465FB5C00DFC7F716DAB96C419228CD7247221C9AEE79F27844B211609E7316C6B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 c51a4ce88c2eea81bc6b420105af62e40b679d9b7493b72653a419e26641f3cc
MD5 ddefcd3efac38902bee7978b557b40fc
SHA1 0bfa92f006180e5bd7905e060bdb2d7d526a0231
SHA512 c5d0804b247b7875814da6a2d780ffe7c08d1e6d994d61161ea70beae6847a1c722f70605302ede6157dfeaadc39e42cb853cfbd7d700774f0d5cbf5360ee52d
SSDEEP 48:pmsxoZkYK22u1xWF5g8dKeuvx1GUrGafgo0xHrDFv99X0lZH9/Aufwjj0wf5:M40zJXq5dIvx1GUrbmLDFvDX0Vxwj4A
TLSH
T138252BE5FD08193BC08751BA8BD07D8BCFE58350C18D54538A785A18FE18981C4513EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e60d874b5311fa1371284d5f85d37206752a94d35596d0cdaadb214881c9afda
MD5 21547c1297491e277a5a9decdaa550d8
SHA1 5554506ec06c5d142553026412a93f8a2294ec1d
SHA512 6c41ec3b0fd788ec22e14d2f4ef3d6bea1d34a1e514601c407a49a8e3979f7da47ce28af99352a6e20e41c6a315089d76067c62d73637f183db12506024ea784
SSDEEP 768:SUfDPLSgcRUv+/ahv44fDPLSgcRUv+Yahv42UfDPLSgcRUv+9ahv4PUfDPLSgcRx:oaNXaN3aNlaNi8O
TLSH
T1C1164BB24F286E46E645EBB0BBCDDD1C3CB12395AC935C82E52292791DF0FC41B8516E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 0ba1bdbe453b878791f4016760085a98e26d5859e35d46a27b30553b720bf688
MD5 c547af5d5ac3ef42386890db1b6bc341
SHA1 88809a99b55ced554bd8f901d5e1b2bbdc1765a6
SHA512 5fb1fee3662fcb5a12f4ea35cba21523593f9573e87a14c02244301fde551224eea5988191a0e4dbfd056e2075846926f56159691a8d90883396ebcce47c5fdc
SSDEEP 768:+aJAFQBbeQTeZhanlnBO7Vhfmh5pZj8L0owit87z81r:+aJNyYeZhanRwmh5pZM0Tiqzw
TLSH
T1B4F201EBCCA8F3B557FF1A38D28D2E73921C4F64D8675C795A3140281DCDE5CAA10A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 33326412eb59d8b627914d73563450df1652da439a70ba7f1ff987e7e380f672
MD5 27975a943f1881628ae4d513ec69b106
SHA1 08f44d3c6636f20a76c209eabf7fbf5b16a3314a
SHA512 6447881eeec0d4652e3f9dae4a1c296fe78f14504904324af9b398634b27d6553dab680daba8418dc90d5511aa84ac47bb840cc6ad36b1aaa2bec17bdd862c0e
SSDEEP 1536:eGGxWO6mBwuCAbuA67AMods/M23xfY9yep+JwyFfjvBQB:eGKZ67QqAEATdsMafXepewy9LBQB
TLSH
T1EC6301FB6B00B78E1E2EDE93460F1841143DF71EE1A64FE37B5745181A54BEE0963889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Cache\Cache_Data\index
Size 256KB
SHA256 0bdb7b259fa057efa86aca36fd1cd054b8adba2d4366d94fdc682e5b93b58bde
MD5 8462a33945903a021e7bcdd05f422294
SHA1 4e89b7bfc6a3ad6af13d9e2cf25fba5d289a98dd
SHA512 832ff217da6d903cef82719fcdbcfc651b6d9d50fb976ddbf05d1551fa61304f3dfc41bc4f5a8d0e2a866831612a0f29a8be6d6397e9f7cdf57266242499a3d7
SSDEEP 3:LsLllFlklNllklkXlVdltollLll/nsll//JNtlmNtl3Nl/lglNlXlZllll/:LsRa3lPL4SltRkNHqlll
TLSH
T1CC4401AF93866F5BD2D402FD84478B6067F8C95ADB8F9B83270436242CC17A02E1F1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 bda4ff3e0c949ff7261c6d3d6a9ec9b3362e01ab89579f9cfdb130e145309969
MD5 5e60970a3459e23a39d46292a1aa170e
SHA1 40a449f977864a6a746943f8a05c9ab9c660b8c0
SHA512 767a1c0a3a7aefb1c1e48c85d876b9ebb0964897f536a93fff9ecf5305785925b5a8ae07a0172797bcb6c8e5a76177b73a3a89640cb2045691b9264ebdb93fab
TLSH
T148E02B81C24C1F1ED36DA6F7CEAA03448B0A82C429BE3603A880C6C233124281258123
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 ebc69ebef75f4d6f981320ff4b30c942b68dd0b4ff655135bffe83a1fdf2ea5f
MD5 d9b7e55d6be260f9ca9c1e33b4050090
SHA1 cab46898ce934df9773bff006d99ebd15f26b7e0
SHA512 081a76916f53f488a4cbffc2d499688fec9de1bc3000fc7dabc36e1cfc414c8c32c35fcd61f316fa773b7cc9f9bb040d4f6a6966401f1bb2046dadeca82c639f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\DawnWebGPUCache\index
Size 256KB
SHA256 2515c300b583af4f10d67034398585373606bea9d6819004136afdf206a8adae
MD5 05ed92c48a0c9b6a0fc275d41c887673
SHA1 793d60d2229dc58ccedcdeaed52e619a4670a044
SHA512 de93ff8cde07b1fb056f47f8ba8b05ef1c0f71ec2d47aee5c2e5a37df828ff400d4095b7ef4aa61cecfa3e324b0f4ab7be7f70cd45dc68e21cc22ee28beffe9e
SSDEEP 3:LstlNllklkXlQ6UK/:LsX3lPQ6Ua
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Local Storage\leveldb\LOG
Size 277B
SHA256 60abfce1b5a8c964aaff1fc512c2ede6008f586a43e0a72e0090f293e55c6904
MD5 46c8aafe8d105fb8449fb5be243aa493
SHA1 7519acd46cce399ad4716dd914fef84ab493b869
SHA512 18e7c16dd8ccde7c1c36b22700dc1a56ebab601feb4b506c39ec58df088bf25b65256d3bb673b4ae397c29ff7f5d02299c05631da4098db0ac365eec134075be
TLSH
T154D0C251D4DBC22F020840DA922A7329DF742808EB883F5D5E89E404355B40CEA61AC7
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Network\Reporting and NEL
Size 36KB
SHA256 473cee21f162f3a7a25635fadf8a9264238ac53cf89f7bb67ede9fbcdc676cfc
MD5 56e8276cedbc027359e31311dd2f91ed
SHA1 5aead8213b1fdeb895b9d51975126c5527ed8949
SHA512 c6ae5450f3ec31cb87fe6deb33b79c9c7919f637343e93cd0866d52c9fdaf674ab82eec261d77aeb0da4a5ed9f2960431657474cde55067a8b49c58c5a12888b
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:uIEumQv8m1ccnvS6
TLSH
T195F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Network\Trust Tokens
Size 36KB
SHA256 61747eae344a1ed6b1bea06522e094eba6879049db5f918e55423dbd8981a881
MD5 f2a84020dd3bf7c981b9b69dc6b8951e
SHA1 362b54cbf3c0ad6473ca595d4b72930ad9268890
SHA512 75ef07c38033b51286eb208d494d3856e7238bf0b1e928c8c35b5ececa05e8b591fc908ff83f89a1695ba74ed2bd155e49d35222a8cfdf8dbe936daeed7ae1f9
SSDEEP 24:TLn3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T731DtX5nDOvyKDhU1cSB
TLSH
T1A5F2469BA93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1dfe1fa370ff0b16808463f597248ec0869e2459869c6eb44d416fbc7fefcc94
MD5 cba499c6a09f4ffbbbd2caeed1840540
SHA1 0a54bb0e193e11ca9276400b02679f1fab55ddc1
SHA512 39b07393613050fd775b782eb849d94d0711899e28e973bfe2532aa3f7cdbfa047068d6b1cd55f2a3cbbdef78bf61043eaac2e7000093b4c85d033c765217564
TLSH
T16EA00212034283A4D1001AB06901839C1380BA2684040263B6D413468C704558922554
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Session Storage\000003.log
Size 61B
SHA256 5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923
MD5 9f7eadc15e13d0608b4e4d590499ae2e
SHA1 afb27f5c20b117031328e12dd3111a7681ff8db5
SHA512 88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f
TLSH
T1C4A0041C1341D037FC1DC730054533303731DCDD1F111543444D15D00717F751401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Session Storage\LOG
Size 267B
SHA256 43380a9fa8d6c4b71c4e4020dc8465d46f6e568c84c391a4e31cdc985cd68e40
MD5 bfa30c466c7a74aaeb0a857bcf97be24
SHA1 2e9fc75c3f1fe5be019ae85d30298562c8ef4299
SHA512 0cf6e5506e5758b4a87b29fe65acf0506525a6e868b933684a10f9ebf801203c2ce107dea94b35e18877ecd9ec16af3e8b7e47ecd7da21c0a9ad3fb469dac02a
TLSH
T1F9D0C25095C6C27B030490EB1626232ECBA42809F7483B180A11C004320B909B6A1A83
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\u15tn1ri.nuy\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2748-435-0x0000027AD3E00000-0x0000027AD3F2E000-memory.dmp

Download

memory/5420-19-0x0000018FA5C80000-0x0000018FA5C86000-memory.dmp

Download

memory/5420-13-0x0000018FA48C0000-0x0000018FA48D0000-memory.dmp

Download

memory/5420-0-0x0000018FA48C0000-0x0000018FA48D0000-memory.dmp

Download

memory/5420-21-0x0000018FA5D20000-0x0000018FA5D70000-memory.dmp

Download

memory/5420-18-0x0000018FA5B50000-0x0000018FA5C7E000-memory.dmp

Download

memory/5420-17-0x0000018FA5A80000-0x0000018FA5B48000-memory.dmp

Download

memory/5420-16-0x0000018FA58A0000-0x0000018FA5942000-memory.dmp

Download

memory/5420-20-0x0000018FA5C90000-0x0000018FA5C9A000-memory.dmp

Download

memory/5420-12-0x0000018FA48C0000-0x0000018FA48D0000-memory.dmp

Download

memory/5420-11-0x0000018FA56B0000-0x0000018FA56C4000-memory.dmp

Download

memory/5420-10-0x0000018FA56F0000-0x0000018FA5752000-memory.dmp

Download

memory/5420-2-0x0000018FA48D0000-0x0000018FA48F2000-memory.dmp

Download

memory/5420-1-0x0000018FA48C0000-0x0000018FA48D0000-memory.dmp

Download

memory/5420-448-0x0000018FA5D00000-0x0000018FA5D12000-memory.dmp

Download

memory/5704-158-0x0000018DA87D0000-0x0000018DA88FE000-memory.dmp

Download