Overview

overview

8

Static

static

1

Scanned_RF...968.js

windows10-2004-x64

8

Scanned_RF...968.js

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Scanned_RFQ -PO1400008 3968.js
  • Size 1.7MB
  • Sample260706-e7wa8sdv9n
  • SHA256 15baa89a82c5c6055d80915ccec1c4362950ea9ea3748fe8065b6b81dd105bd5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecollectiondefense_evasiondiscoveryexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
    persistence
  • Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs
    collection
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Scanned_RFQ -PO1400008 3968.js"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5748
    • C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless powershell.exe -WindowStyle Hidden -W H -nOp -nONI -W H -nOp -nONI -Command "&([scriptblock]::Create($env:F0IPgQjPAyTV52N))"
      2⤵
      • Hide Artifacts: Hidden Window
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -WindowStyle Hidden -W H -nOp -nONI -W H -nOp -nONI -Command &([scriptblock]::Create($env:F0IPgQjPAyTV52N))
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Registers new Windows logon scripts automatically executed at logon.
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:2512
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz"
          4⤵
          • Drops file in Windows directory
          • Enumerates system info in registry
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3144
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd21c2c728,0x7ffd21c2c734,0x7ffd21c2c740
            5⤵
              PID:3372
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1704,i,11954051815154204360,1431922562346084017,262144 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
              5⤵
                PID:4060
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1884,i,3349312206566063873,16101738629706041337,524288 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
                5⤵
                • System Time Discovery
                PID:3036
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2116,i,12364550398030414624,10802464879959302428,524288 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:13
                5⤵
                  PID:4760
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3020,i,16638297311187647326,12659357705402456706,2097152 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:1
                  5⤵
                    PID:2540
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3028,i,7164761937633685627,8505735555029309443,2097152 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
                    5⤵
                      PID:2936
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3192,i,16172999369644826518,5367362096717287962,2097152 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
                      5⤵
                        PID:2520
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3208,i,14219858093555271031,1935030216339891754,2097152 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:9
                        5⤵
                          PID:5480
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3768,i,9865830057043622146,1992531734174686722,2097152 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:9
                          5⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3320
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4292,i,3739432091807097482,5149085508431604791,2097152 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
                          5⤵
                            PID:4380
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4400,i,5685192337797969439,42444932364710328,524288 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
                            5⤵
                              PID:712
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4444,i,4085240199831750642,6621754346223435332,524288 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
                              5⤵
                                PID:6024
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4504,i,12960882883183108305,14768909460729598966,524288 --field-trial-handle=2012,i,9786406803996162832,9891780023703334421,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
                                5⤵
                                  PID:1400
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:4120
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:1752
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:2500
                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:3912
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                          1⤵
                            PID:4696
                          • C:\Windows\System32\sihclient.exe
                            C:\Windows\System32\sihclient.exe /cv flIh/4/H202Z4E2BiudACg.0.1
                            1⤵
                              PID:712

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Command and Scripting Interpreter

                                  2
                                  T1059

                                  JavaScript

                                  1
                                  T1059.007

                                  PowerShell

                                  1
                                  T1059.001

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Active Setup

                                  1
                                  T1547.014

                                  Boot or Logon Initialization Scripts

                                  1
                                  T1037

                                  Logon Script (Windows)

                                  1
                                  T1037.001

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Active Setup

                                  1
                                  T1547.014

                                  Boot or Logon Initialization Scripts

                                  1
                                  T1037

                                  Logon Script (Windows)

                                  1
                                  T1037.001

                                  Defense Evasion

                                  Hide Artifacts

                                  1
                                  T1564

                                  Hidden Window

                                  1
                                  T1564.003

                                  Modify Registry

                                  2
                                  T1112

                                  Credential Access

                                  Discovery

                                  Browser Information Discovery

                                  1
                                  T1217

                                  Peripheral Device Discovery

                                  2
                                  T1120

                                  Query Registry

                                  4
                                  T1012

                                  System Information Discovery

                                  4
                                  T1082

                                  System Time Discovery

                                  1
                                  T1124

                                  Lateral Movement

                                  Collection

                                  Email Collection

                                  1
                                  T1114

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  prep_Activatable Class_Hermes_perf.cache
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                  • Size 599B
                                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  settings.dat
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Crashpad\settings.dat
                                  • Size 40B
                                  • SHA256 e3de61b94dd84143b133d5321599046e0e97f125c895b759ee58d1c1d3aaadbc
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  data_0
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Cache\Cache_Data\data_0
                                  • Size 44KB
                                  • SHA256 4c0ecea6db257fbcae019358458007b8847c10f85b6fe4ab567ba1aa30044203
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  data_1
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Cache\Cache_Data\data_1
                                  • Size 264KB
                                  • SHA256 7872d9d82bc3eb0d68b75ebcdfa79ac67ca7728c49dc56463ec81cabbbd39d2b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  data_2
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Cache\Cache_Data\data_2
                                  • Size 1.0MB
                                  • SHA256 7b5b2bd8bfdaf7d08aab7b3d0e364b34fc8494cc893936feb6347ae5f1e4ee90
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  data_3
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Cache\Cache_Data\data_3
                                  • Size 4.0MB
                                  • SHA256 882a10fbf0c02d9b7d83e96de0d82a1c9bf530af9cbbc8d279125375cdbf70c3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  f_000001
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Cache\Cache_Data\f_000001
                                  • Size 37KB
                                  • SHA256 8ab30e05ab18a9bce364ae6bb1737935863164e72a997b443ea84cade1bfd7f1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  f_000002
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Cache\Cache_Data\f_000002
                                  • Size 109KB
                                  • SHA256 5cb06073f036be3ad5211a0f3731188ad106ebe78badff88ad7e4077d314e9c1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  f_000003
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Cache\Cache_Data\f_000003
                                  • Size 68KB
                                  • SHA256 b2a301d2f32e9d219b227b30603aeadd7a8be1a52e97a08118082e01b9deba53
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  index
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Cache\Cache_Data\index
                                  • Size 256KB
                                  • SHA256 5af7c80c48520486a169128045546aa6c272d6e1cb166c0fe4a64e5aa1fdd4ba
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ba678a2fbd8c358c_0
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Code Cache\js\ba678a2fbd8c358c_0
                                  • Size 298B
                                  • SHA256 75da96559b79e377e562c890d69efed9ec5a76f3951f631299839ec69bcaab4d
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  the-real-index
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Code Cache\js\index-dir\the-real-index
                                  • Size 48B
                                  • SHA256 0c304e2c9c6185a645401342fc26c59f58f7eeb76a16e82523b2c62cd34a9709
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  index
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Code Cache\wasm\index
                                  • Size 24B
                                  • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  the-real-index
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Code Cache\wasm\index-dir\the-real-index
                                  • Size 48B
                                  • SHA256 c3242f455387d789ac7bff91972c54fd44889808f8d1bf0e3bd082bab7820595
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  index
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\DawnGraphiteCache\index
                                  • Size 256KB
                                  • SHA256 3841e30465a7aad972f03b4863c98e95bc8c71e969d15f9cd68c8e48c74290fb
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  index
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\DawnWebGPUCache\index
                                  • Size 256KB
                                  • SHA256 f26b65880b4bca7175df1149288afcdbeb6c68161bf6bb8d0005173bffb34e71
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  000001.dbtmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Extension Rules\000001.dbtmp
                                  • Size 16B
                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  LOG
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Extension Rules\LOG
                                  • Size 265B
                                  • SHA256 2abda5d2225326df13d0620affba2592095110b7613db5994daa35d1228a749e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  000003.log
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Extension Scripts\000003.log
                                  • Size 76B
                                  • SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  LOG
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Extension Scripts\LOG
                                  • Size 269B
                                  • SHA256 cef71dfcb37752ea863cd9601a54b464a7835163fedd5a11def7a9399b1087fa
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  000003.log
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Extension State\000003.log
                                  • Size 228B
                                  • SHA256 48d535bb330519c00d150578734c6cecb056c4b5cdd2a45c70590bc896d27d9f
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  LOG
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Extension State\LOG
                                  • Size 267B
                                  • SHA256 a03c8d594e04f2e2df22002b861c89a5577d2e78219eb5138de5b975c0182851
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Favicons
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Favicons
                                  • Size 20KB
                                  • SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  index
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\GPUCache\index
                                  • Size 256KB
                                  • SHA256 530f027550d22d38a296aa9fb08b9b789ecc371652632d4a6e3295575d0181f0
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  History
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\History
                                  • Size 160KB
                                  • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  LOG
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Local Storage\leveldb\LOG
                                  • Size 277B
                                  • SHA256 a120a1331230075814ccd187eff06387a4f0d15f0bc3d2d835773cd0ba0cfb9e
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  Login Data For Account
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Login Data For Account
                                  • Size 40KB
                                  • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Cookies
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Network\Cookies
                                  • Size 20KB
                                  • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  f4e7e421-7d26-4030-a651-2b0dc0242a87.tmp
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Network\f4e7e421-7d26-4030-a651-2b0dc0242a87.tmp
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  MANIFEST-000001
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\Default\Site Characteristics Database\MANIFEST-000001
                                  • Size 41B
                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  data_0
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\GrShaderCache\data_0
                                  • Size 8KB
                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_1
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\GrShaderCache\data_1
                                  • Size 264KB
                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_2
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\GrShaderCache\data_2
                                  • Size 8KB
                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_3
                                  • Path C:\Users\Admin\AppData\Local\Temp\zm1leyjy.ciz\GrShaderCache\data_3
                                  • Size 8KB
                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  memory/2500-390-0x0000026A18000000-0x0000026A18691000-memory.dmp
                                  Download

                                  memory/2512-10-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-9-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-0-0x00007FFD2AB6F000-0x00007FFD2AB70000-memory.dmp
                                  Download

                                  memory/2512-223-0x0000015D6D6C0000-0x0000015D6D710000-memory.dmp
                                  Download

                                  memory/2512-423-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-421-0x0000015D6D4E0000-0x0000015D6D4F2000-memory.dmp
                                  Download

                                  memory/2512-1-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-2-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-217-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-5-0x0000015D6BEE0000-0x0000015D6BF02000-memory.dmp
                                  Download

                                  memory/2512-24-0x0000015D6C270000-0x0000015D6C2A2000-memory.dmp
                                  Download

                                  memory/2512-23-0x0000015D6D5D0000-0x0000015D6D6C2000-memory.dmp
                                  Download

                                  memory/2512-22-0x0000015D698A0000-0x0000015D698EC000-memory.dmp
                                  Download

                                  memory/2512-21-0x0000015D6D300000-0x0000015D6D3D8000-memory.dmp
                                  Download

                                  memory/2512-20-0x0000015D6D280000-0x0000015D6D2FA000-memory.dmp
                                  Download

                                  memory/2512-19-0x0000015D6D0B0000-0x0000015D6D180000-memory.dmp
                                  Download

                                  memory/2512-18-0x0000015D69810000-0x0000015D69820000-memory.dmp
                                  Download

                                  memory/2512-17-0x0000015D697B0000-0x0000015D6980A000-memory.dmp
                                  Download

                                  memory/2512-16-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-15-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-14-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-13-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-12-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-11-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-179-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-131-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-8-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-7-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/2512-6-0x00007FFD2A9E0000-0x00007FFD2B384000-memory.dmp
                                  Download

                                  memory/3320-362-0x0000028A222B0000-0x0000028A223A2000-memory.dmp
                                  Download

                                  memory/3912-27-0x000001EC801E0000-0x000001EC802E0000-memory.dmp
                                  Download

                                  memory/3912-47-0x000001EC83C30000-0x000001EC83C50000-memory.dmp
                                  Download

                                  memory/3912-36-0x000001EC838D0000-0x000001EC838F0000-memory.dmp
                                  Download

                                  memory/3912-38-0x000001EC83DF0000-0x000001EC83EF0000-memory.dmp
                                  Download

                                  memory/3912-72-0x000001EC841B0000-0x000001EC841D0000-memory.dmp
                                  Download