f9a09c060710d256b3e689327181441c4cf0648877301ea41d6be8b463f49ee7

Analysis

max time kernel
300s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO-O129867-0720.js
Size 1.4MB
Sample260720-qb5etaa16p
SHA256 f9a09c060710d256b3e689327181441c4cf0648877301ea41d6be8b463f49ee7
MD5 dc570235080bad4ded70bfe64a3b6077
SHA1 6f8483ec4a2083813ff09ea49f27e982afd69513
SHA512 083f4ef7ecb400593d68c496fa66925fef9a34a5338651aa7b23b3197fcdbecedcc2049276635351448ea69355bd26083e8d74e4429e09975828aebc5a52ce67
SSDEEP 6144:k6xyfCVQkY2ySnGFrN6xXa92VE1ycWG7jHthzPbjWFu4GGD2NESwm10Y5zlkkbdr:qakgjKwCWqmE
TLSH
T13065978DA0D98800A5645A15899F285CF77F49CA601D3CD0317DB00AF5E37FAEDEAE4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3352	powershell.exe
8	3352	powershell.exe
9	3352	powershell.exe
10	3352	powershell.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\v5690\\v3754.js\""	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2224	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6056	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
1648	chrome.exe
1648	chrome.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeShutdownPrivilege	1648	chrome.exe
Token: SeCreatePagefilePrivilege	1648	chrome.exe
Token: SeDebugPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	1648	chrome.exe
Token: SeCreatePagefilePrivilege	1648	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1648	chrome.exe
1648	chrome.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 4248	2496	wscript.exe	89
PID 4248 wrote to memory of 2224	4248	conhost.exe	90
PID 2224 wrote to memory of 2716	2224	cmd.exe	91
PID 2224 wrote to memory of 3352	2224	cmd.exe	92
PID 3352 wrote to memory of 1648	3352	powershell.exe	95
PID 1648 wrote to memory of 4084	1648	chrome.exe	96
PID 1648 wrote to memory of 2068	1648	chrome.exe	97
PID 1648 wrote to memory of 6056	1648	chrome.exe	98
PID 1648 wrote to memory of 3040	1648	chrome.exe	99
PID 1648 wrote to memory of 716	1648	chrome.exe	100
PID 1648 wrote to memory of 3812	1648	chrome.exe	101
PID 1648 wrote to memory of 3232	1648	chrome.exe	102
PID 1648 wrote to memory of 4580	1648	chrome.exe	103
PID 1648 wrote to memory of 3852	1648	chrome.exe	104
PID 1648 wrote to memory of 4784	1648	chrome.exe	105
PID 1648 wrote to memory of 4468	1648	chrome.exe	106
PID 3352 wrote to memory of 3040	3352	powershell.exe	99
PID 3352 wrote to memory of 3040	3352	powershell.exe	99

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO-O129867-0720.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "echo iex([Environment]::GetEnvironmentVariable('f9wLUXdlNK6O02k','Process'))| powershell.exe -W H -nOP -NONi -"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\System32\cmd.exe
    cmd.exe /c "echo iex([Environment]::GetEnvironmentVariable('f9wLUXdlNK6O02k','Process'))| powershell.exe -W H -nOP -NONi -"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo iex([Environment]::GetEnvironmentVariable('f9wLUXdlNK6O02k','Process'))"
      4⤵
      PID:2716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -W H -nOP -NONi -
      4⤵
      Badlisted process makes network request
      Registers new Windows logon scripts automatically executed at logon.
      Accesses Microsoft Outlook profiles
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:3352
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny"
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1648
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd5f49c728,0x7ffd5f49c734,0x7ffd5f49c740
        6⤵
        
        PID:4084
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,12850077538083263260,9616936591233941468,262144 --field-trial-handle=2060,i,4648367387778161375,17366737450633828950,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
        6⤵
        
        PID:2068
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1824,i,8804551728075519542,484591558037015376,524288 --field-trial-handle=2060,i,4648367387778161375,17366737450633828950,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:6056
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny" --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,16574472715210300763,567786551937068033,524288 --field-trial-handle=2060,i,4648367387778161375,17366737450633828950,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2960,i,1549649586137276094,5033217646232775125,2097152 --field-trial-handle=2060,i,4648367387778161375,17366737450633828950,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:1
        6⤵
        
        PID:716
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2976,i,1515810856181249929,8749274894190548915,2097152 --field-trial-handle=2060,i,4648367387778161375,17366737450633828950,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:1
        6⤵
        
        PID:3812
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3160,i,12355634538744158858,15399520781937649394,2097152 --field-trial-handle=2060,i,4648367387778161375,17366737450633828950,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
        6⤵
        
        PID:3232
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3172,i,1889108632780372588,12853145872879671866,2097152 --field-trial-handle=2060,i,4648367387778161375,17366737450633828950,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:9
        6⤵
        
        PID:4580
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3916,i,3934855456168069800,16015437179307641501,2097152 --field-trial-handle=2060,i,4648367387778161375,17366737450633828950,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:9
        6⤵
        
        PID:3852
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4216,i,4183049778584693625,3018257218893629094,2097152 --field-trial-handle=2060,i,4648367387778161375,17366737450633828950,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
        6⤵
        
        PID:4784
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny" --force-high-res-timeticks=disabled --metrics-shmem-handle=4336,i,7973459245116190889,7952435140528980370,524288 --field-trial-handle=2060,i,4648367387778161375,17366737450633828950,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
        6⤵
        
        PID:4468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Crashpad\settings.dat
Size 40B
SHA256 3011f2c32616a5af412360b76d83c6591d66c5999e3281c5b973d645be190450
MD5 9121ee06fdc54060b2b1eb46e4ee5cb0
SHA1 44cabed36d4fed72dbc84d398cf03314d0688e72
SHA512 fe96d98ecd73ea58487de6fd1aa11d88333f588edc7457ab0eb9de71553c891113bf848bf72896964e92efa51468864ae80a074794bb5da8a389b92204793983
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 0adaa5d5b252a907c1df38b1fd35cf5a8fb21b5a445d2ef16c6a3c69af46fd6d
MD5 473b76728ba62569d093551ed7827213
SHA1 4f19dcca21944a68dc83559773f5fee45d430232
SHA512 b22863d93f69cd113a8cfb853eab0f8a62fe570fcd6db72808e852ba3d7e99366a101cadeda66a00ab57e5a9b565f067dc9d6189c727fa1198faac902448b477
SSDEEP 6:/FoEXEaQutOikNFutOiSttKefflNJ/qzdBEtENEst8xtVhxKiPl:d7X/QaOHNFaO1yyflnqBapXP
TLSH
T1E31317BF86AA1E07D48FB23CA697AB793374CC14DA51868B213071253E577922C4C120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 077b6b21af522493fa466117e5356847c1a58debb7614866f1704baa676d14ba
MD5 7198e8edf545156b23c3d1c112e102ec
SHA1 9256d29277d91fd5dfb771204bdf5910f0bd4c9b
SHA512 0bd7d38eb449491c68866b3431915174375fa231a37d78ffed4b303ad9e6713378a0661b4809d526e6863ca6534d77bb5d9d5f4fb7cf98d932471af717ede0ad
SSDEEP 48:pfltoYgsmJO5eD0HCNaiM1XgrXJBMmXW:pNrgsGO5eRNfugbJBjW
TLSH
T1164464F71900E5CBDB19CFF11C01923CDE3392261D9ADD76F22904729396BE730285A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 1179562621e4a84caedd7ca4dd607cb4f701a6485bb80709d51114cc7bf79291
MD5 e45c82208169ad9b591289e71c9015ab
SHA1 d97e223dc76de86371b0401ae54309b763ff3259
SHA512 42af1a72ad4ddd77d642dcffd4a962faaff52955bfee7c223ef766b880b08f863710209e13e1b68b3c5fb86ea9874f0bb2359ac357d3f4a2f11464e9b0cad1a7
SSDEEP 768:nUfDPLSgcRUv+841UfDPLSgcRUv+84+UfDPLSgcRUv+q4ufDPLSgcRUv+x4:Wlcg
TLSH
T17D161BB64F647947D786EAB0ABC8EE183CB122CDEC925C91F522A25D4BD0FC41BC521D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 d332455ae905a7fda8793608138f1a0a05fef22ea2536b3901a5aeaa960443f2
MD5 f0cc3afe45ef67db4183be4202106e5b
SHA1 69391a90c8fa5d47b7d3bd48e57c137830e01738
SHA512 ea5ae86a9d45095278cf6c19953ad60cd71a170ff81f64ea7e2d24d34b6c5869133668128e2fca80e292fbeb488cc1cd769154b503630208996131e2c58a1f33
SSDEEP 768:C4af0U5+6H15rGRt5LGBAXX6FTlDYIlJc8piRgQuexw6A7ID6ULFB:C4eVCX5jXQhYic8vexw6A7afX
TLSH
T13103F163176832DEFFE3350FA042C1773B874768B6504BBA63A900B5C3A1B821AD5477
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Cache\Cache_Data\index
Size 256KB
SHA256 80271074395c34672440444a510497c167bc875cfb90165ad0fadcd0623edc74
MD5 7eed25eaf3ede3214f69f9ed98e63248
SHA1 6d7a6104292e106a3d80bb42c6246176d95eb5f6
SHA512 2dd1b93dde670ae8854846bd8c1e3b5b5fcbba41af9e9b0c95f6bab0047e4153580477efa1a98c9769de658a25a033a01242dbf98bf1e6f7802222b13df1ddb4
SSDEEP 3:LsLllfltlNllklkXl6lLS/allx/n3llll/ull//5NtlmNtl3Nl/lglNlXl:LsRt13lPDGxlll2ltBkNH
TLSH
T13C44012EA3D9AE5AD2C911FD84078B60A374D805D9CE8783170469202CC67906E0F6A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 830deaad9b1e0caec90eb0fc0940ac120f9c6eb382c82b008187742f590e7624
MD5 3cef9da0c719b4c815adb408409802a8
SHA1 fd0955a3257a71f16f0f34c06270b7683cce5d3b
SHA512 082d45810622a098b0b838c12b68dde9e072743b646d913696f568151cd1f6bd8da4d8df34d12cded800a0b61bed2e04021239ba21cda1d6d42ddc0ae5b96ae8
TLSH
T1E8E02B81838D0F0ED32DB6F7CDB643044A0E42C429BE3603A880C2C373164241248123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1ce6c53fb82f768a6e1247b9ded70ea722afdab62008db71e2f5d9c787179c7d
MD5 960f20d06f581ebdda1bd42e9fb5bf97
SHA1 7a6e65fb56c327b1776c472ec1ece754d7392a2a
SHA512 56a9b13d323f854012e3b3978b53e98365c85dbe0ed95ca1673d1de9667f13484dfd57ab6ce37078981056baefce92b065dcd7650df4c69ac50985d27b8456ff
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 7b7f902a50553e5d1ebc4d98341f620a8fe4eb95d5d6b89775877af37ee4256f
MD5 ac220973b57a07b9f1e0087c5f42ff78
SHA1 47994573f27c96dd21d5248ffcc5adb452fb219c
SHA512 1d8560dcbb42c3e0567a4203b476aa6e378611ec361da3b7dbb23238a7ab73d3576fe84398c88b46906f1a5aed8cd802d9ad62a05b48893364e15fc07fc970ea
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\DawnGraphiteCache\index
Size 256KB
SHA256 073491957ab8e3425155da5d817f045841dbbcf247baf646d1c6c560e9896a66
MD5 1b68f5986e1884c78dceae544298d67b
SHA1 54c076997b428aadc7d28e67f9304b4ee978f96c
SHA512 9ad08d75cce7823020a26349bd25cb78890f94f63a00f1cb19169cc3924cf3909297b97ce766d87864d0ec75c2066abd017db99bc3577e9e9734227ef3a5c3a2
SSDEEP 3:LstlNllklkXlf3l/:LsX3lPf3l/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\DawnWebGPUCache\index
Size 256KB
SHA256 5e532c3033de83cb06fb144c652fca6b0fa4b79564d13f2b66e8a9221668e0fe
MD5 a11e54aeabcd67d5e25f3bb8fc31af3a
SHA1 b6776db48da7542a245cba6397f513d5cefc4c81
SHA512 067a3db6384ab46a5e440d016a49335f69ee17b939388859104dc3818c044c630a2a9c137cc2882bdf1941521db45c2d0614a2090e8f00e1cb4a0291937177f1
SSDEEP 3:LstlNllklkXlH5x/l/:LsX3lPZx/l/
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Extension Rules\LOG
Size 267B
SHA256 d1555b6eafa7ec2a2b7580d5b2b24d5286aa262f84b24b874e03adb0c6fdb055
MD5 f812cfaf3fdd067d1a238b9c56eab72a
SHA1 9b7c7ea244625334885ee4f37335937bc5aac737
SHA512 b2afc59744897b8cd622a5405cc31e90085dbfbcb62f73bae286d67a52d6796db6b626d5dba77591326d5d4bfb499a55fd0fda6be85dfcfe030cab7f89199d5b
TLSH
T111D02E42299FC62B011890EEDAA2B3CECA242C0CA78A3A0C4F4ECC94301250EA294B56
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Extension Scripts\000003.log
Size 76B
SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
MD5 cc4a8cff19abf3dd35d63cff1503aa5f
SHA1 52af41b0d9c78afcc8e308db846c2b52a636be38
SHA512 0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Extension Scripts\LOG
Size 271B
SHA256 1c0650cbb4aa0b64fb4b14fee73b485a09cf5b81c66a01ec1f9d42e44ea85c33
MD5 89db29fb9f30d78c1248f25ba7b90cac
SHA1 237eaa596204ad1b25ca4bb2fae0c19f7a86a067
SHA512 59562f9f1f425e3421c4f84cbc5fd8fd07fe40108c667a49f3a3f6e6f4a6a7cc540853986ca6032e9ff59e0637b13631487218d56f5daf9446df373385be8317
TLSH
T1FAD02B440CAFC66B450484EF8A7373CDC7A83C09B64A760C0F4ACC5420566099651F45
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Extension State\000003.log
Size 228B
SHA256 48d535bb330519c00d150578734c6cecb056c4b5cdd2a45c70590bc896d27d9f
MD5 af1d95e1f9eb485393273b25446e1ae5
SHA1 1d762c96b1c38ba6a849a5b76d12fac636b8d780
SHA512 826d207edd55401e1c13249350814adbb3ab00a135c46b8da8bb7267751c70580f183982cccbc1e47bf3e3f433f20ba1d2f2afd601fcb67b635c0e7429558165
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Extension State\LOG
Size 265B
SHA256 7a5953b039863a8f9f10c5da16d3be4065e7c8b8e8a012965ff021f288602b48
MD5 73949329de081f960cb61e5ce96911bb
SHA1 747bc43c53ed78b26f2866203177de0d837a71d2
SHA512 5102142994342e531b5d19b1aa06274d1fe7e25c416cc05f9f5ca037dfec1bca863b20acf4c6293ea540f198f1a6d01bfc9ecc00362661c7c4cf3da70b3aee11
TLSH
T14ED02B00059FC62B450498FF8B3B33CDCB713908B689360C0F5FCC182402B0A9750795
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\GPUCache\index
Size 256KB
SHA256 1af3510fd62ca54c11bbff01aa4bb408f4826e94a72e78000c2f313a2185e26c
MD5 3f3910f3e49129f692668b599696b63f
SHA1 4e628d4f226ab4a2c12b55d4e0eb44fd8bd832dd
SHA512 9689e40ecf9cf1bcf0858325efffc8dac2fa68466f898063d782e9643cad777dbcd4eadbeba641dc6fe854a431d3d7a2e0c09f9c279845d39ca7b1b2bcc5efc1
SSDEEP 3:LstlNllklkXl9QK/l/:LsX3lP9f/l/
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Local Storage\leveldb\LOG
Size 277B
SHA256 5af3e848ac758d0424f97a03ff22d95ba3beb74b4d1d31834a962bc9ac5b087f
MD5 c4969079877927e7b1702c2895f2ae4c
SHA1 ab81f31cd5139a4bcadf7fca87dc47e184392a4e
SHA512 15b913b354c741465ec833650fa5931b29df5863eca84af75b5b8d5c5925a6ea1e389a1505712b8720845e9cd46180afcacd1e29efb8120cbf35dddf56cedf27
TLSH
T1DBD0C291899F862B160480AF8B2673CDC7702808AA8E2B0C8E9BEC18385650DD790787
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Network\Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Network\Reporting and NEL
Size 36KB
SHA256 473cee21f162f3a7a25635fadf8a9264238ac53cf89f7bb67ede9fbcdc676cfc
MD5 56e8276cedbc027359e31311dd2f91ed
SHA1 5aead8213b1fdeb895b9d51975126c5527ed8949
SHA512 c6ae5450f3ec31cb87fe6deb33b79c9c7919f637343e93cd0866d52c9fdaf674ab82eec261d77aeb0da4a5ed9f2960431657474cde55067a8b49c58c5a12888b
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:uIEumQv8m1ccnvS6
TLSH
T195F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Network\Trust Tokens
Size 36KB
SHA256 61747eae344a1ed6b1bea06522e094eba6879049db5f918e55423dbd8981a881
MD5 f2a84020dd3bf7c981b9b69dc6b8951e
SHA1 362b54cbf3c0ad6473ca595d4b72930ad9268890
SHA512 75ef07c38033b51286eb208d494d3856e7238bf0b1e928c8c35b5ececa05e8b591fc908ff83f89a1695ba74ed2bd155e49d35222a8cfdf8dbe936daeed7ae1f9
SSDEEP 24:TLn3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T731DtX5nDOvyKDhU1cSB
TLSH
T1A5F2469BA93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\x5nh4mur.wny\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3040-149-0x0000020B4FB40000-0x0000020B4FC32000-memory.dmp

Download

memory/3040-150-0x0000020B36C40000-0x0000020B36C72000-memory.dmp

Download

memory/3352-17-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-15-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-27-0x000001F2A5330000-0x000001F2A5362000-memory.dmp

Download

memory/3352-26-0x000001F2C1040000-0x000001F2C1132000-memory.dmp

Download

memory/3352-25-0x000001F2A7DD0000-0x000001F2A7E1C000-memory.dmp

Download

memory/3352-24-0x000001F2C0E10000-0x000001F2C0EE8000-memory.dmp

Download

memory/3352-23-0x000001F2C0D90000-0x000001F2C0E0A000-memory.dmp

Download

memory/3352-22-0x000001F2A7D00000-0x000001F2A7DD0000-memory.dmp

Download

memory/3352-21-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-19-0x000001F2A52A0000-0x000001F2A52B2000-memory.dmp

Download

memory/3352-18-0x000001F2A5240000-0x000001F2A529C000-memory.dmp

Download

memory/3352-0-0x00007FFD605CF000-0x00007FFD605D0000-memory.dmp

Download

memory/3352-16-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-28-0x000001F2C1230000-0x000001F2C1280000-memory.dmp

Download

memory/3352-14-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-13-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-12-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-11-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-10-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-9-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-8-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-7-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-6-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-3-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-2-0x000001F2A7A80000-0x000001F2A7AA2000-memory.dmp

Download

memory/3352-1-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download

memory/3352-209-0x000001F2A7E50000-0x000001F2A7E62000-memory.dmp

Download

memory/3352-211-0x00007FFD60440000-0x00007FFD60DE4000-memory.dmp

Download