f9651a6d5f970604ad5918734f3a41c06274cd0d392cffbad60fafb9def90452

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-it
resource tags

arch:x64arch:x86image:win10v2004-20260513-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
23/07/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
root-service-provider.dll
Size 850KB
Sample260723-ldd87avdnb
SHA256 f9651a6d5f970604ad5918734f3a41c06274cd0d392cffbad60fafb9def90452
MD5 c68f1ff358d9687f07a24f2740704726
SHA1 ae20ab4677a7e282b2bf96d7e6d644ee071e47de
SHA512 261b164f38808817cd192ffd3dac24920fb98fb0f69de6641726bfe43b95233cf46750f7f5579ffbece95d4a8894d3b17e1089ca55ac627a0b03bb1bf1907451
SSDEEP 12288:F0nkkxXfxAXg2GokubGCgqYWYDZxjRO5s1K6MlkfI:F0nJrAXg2BNblxNYDZxjR9s
TLSH
T18D05B61BBEB951E1C0BAC0399493653EF8B174A29B3157C75291971F1F23BE4AA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jsc.lnk	jsc.exe

Accesses Microsoft Outlook profiles 1 TTPs 39 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1600 set thread context of 1140	1600	rundll32.exe	84

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1028	chrome.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
512	chrome.exe
512	chrome.exe
512	chrome.exe
512	chrome.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe
1140	jsc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	jsc.exe
Token: SeDebugPrivilege	4168	chrome.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1140	1600	rundll32.exe	84
PID 1600 wrote to memory of 1140	1600	rundll32.exe	84
PID 1600 wrote to memory of 1140	1600	rundll32.exe	84
PID 1600 wrote to memory of 1140	1600	rundll32.exe	84
PID 1600 wrote to memory of 1140	1600	rundll32.exe	84
PID 1140 wrote to memory of 4464	1140	jsc.exe	86
PID 4464 wrote to memory of 512	4464	chrome.exe	87
PID 4464 wrote to memory of 4760	4464	chrome.exe	88
PID 4464 wrote to memory of 1028	4464	chrome.exe	89
PID 4464 wrote to memory of 4168	4464	chrome.exe	90
PID 1140 wrote to memory of 4168	1140	jsc.exe	90
PID 1140 wrote to memory of 4168	1140	jsc.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\root-service-provider.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Drops startup file
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc35b7c728,0x7ffc35b7c734,0x7ffc35b7c740
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1656,i,17083133953483356880,11834687608184216500,262144 --field-trial-handle=1736,i,4386476048813277768,7310679927985009391,262144 --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
      4⤵
      PID:4760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4" --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,2240489151224824671,10404204849335112487,524288 --field-trial-handle=1736,i,4386476048813277768,7310679927985009391,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
      4⤵
      System Time Discovery
      PID:1028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4" --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,6681783990785052662,9364835412809284314,524288 --field-trial-handle=1736,i,4386476048813277768,7310679927985009391,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4168

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jsc.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jsc.exe.log
Size 1KB
SHA256 eb2a701d10c25dd4185688fa8c4db1e4353249090627c7a4695d71e50a212f10
MD5 28503cac11e1dc61febc9376cf21ce3d
SHA1 092be99031b2cc642b6876c24ad7c60dee6fbc27
SHA512 da702a8d4b382fa0c63e29c15d2de2ad6402a1e39c9a41afb1d2e306d9f531c483aff0585f8d783290515776dfd03787506c82386277036b18c9f9eda34f9216
TLSH
T1033190303232B4D84D022F57081869C963FF4749BAA4DF5CB699225EDD2A44BEB321E3
MD5 SHA1 SHA512 TLSH

Submit Download

metadata

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Crashpad\metadata
Size 114B
SHA256 a6650c7dfd29b7350b7faceee28003a2148ba101dec552ff512b5f24f67cf9ba
MD5 36c5cb77c90f72590854add9884e6adc
SHA1 e6b89c16d9abe4236d2e70c3efe33f283077cedb
SHA512 e69c307df4fdc171f56068a31bcfe79bf5143a2b419f17e71c0b65b4e5f7b5b1694e1c99067bd55417168c63958fb3fc06647657f002fd5b100e7442eb2d98c1
TLSH
T15EB01120B2800080C88282F20EA22A3A803AB3302302002288A32A2AAE088028E00028
MD5 SHA1 SHA512 TLSH

Submit Download

360d88b4-31fc-42c7-9403-6aca0cbeb8b2.dmp

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Crashpad\reports\360d88b4-31fc-42c7-9403-6aca0cbeb8b2.dmp
Size 896KB
SHA256 8fc09c25d57e38c076b7c2153a0109043ab3cd8aa7cb116080a2a31f919771e2
MD5 478d33245b5db10eef4df8662700b70f
SHA1 9ad44e2dd621d0a02a8374af389fdfb9bb5be946
SHA512 c5c70577480872785cca470d6ba78e3fd5770415f47953f5e93521904e603d6645c1cc8fd4a0287c8d2e9e945ef1ad4bbc28f05015eb75b7df17c52e908dad53
SSDEEP 3072:/8RbLH+TIiOxE8MoshDu9vk+cjk7hBqKSlamegf2Q959Nx5YzSaAbZwfNyRR4h/:/wWnOxEVJKvn0k9BqKqf2Qv9N7az/
TLSH
T1BA1500177BC069B6F11ACFB26EC22750E7F6E4EC4B72438B4250526E5C67A805F21B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Crashpad\settings.dat
Size 40B
SHA256 3a6d165c83dece5a9420ae25f0ff88a8fbe58d50afecc107c6fcc9b75f06f0e2
MD5 cd0e5229c931d463b6cf71ec57724cc4
SHA1 36059626b6ea03792f21119de43a22687fddd419
SHA512 3391a72a4cbb1c11cce31f9ef1f681acd5c4768df8c591a9540414dfb0753f0a43f3d08328f0db98e62e144fee86ace17385b426b2dcf91f54eddf8060122823
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History-journal

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Default\History-journal
Size 512B
SHA256 a3d34215f4f74af37eab9436da69a2c1b4bc36e90dee14c3e2005c427940c8ed
MD5 66905539bed71a125cf4f34ab8037cb4
SHA1 49be307f291c2f094c926b38c450fb371162e1a3
SHA512 861e8aa1dce2e1444ed5607a0c5c66d9772ef1eaf3b1fa4ec9f6fca142bf0188c6b18316e1af930957814afb6d9bb34dd1beed3c3f520b468f501ad46a15d3cc
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

ServerCertificate-journal

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Default\ServerCertificate-journal
Size 512B
SHA256 5314e2d721ac3a8c80a77da9583985d60e719581b882b77f6560edee654c17ad
MD5 dc9cef01375e7ee607810aee265717ee
SHA1 13fa2d582e685ed23c755c5d78ee0181246c9494
SHA512 7d53fa06f996dd6ac53d96198d74150b721ac55e5353c4ab92515584ca3f9e7deab08af5365e1999e45109132f34d64c81183c3db0a8a7c194bebb594071dcea
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Default\Site Characteristics Database\LOG
Size 147B
SHA256 0cf8e2ca3abe34cf457b4a0f1b332f9fe526fb1ef884ee869abba1c898a3290a
MD5 21fd230e84684e51162d0d53b9c2b5cf
SHA1 e690c778455c2ddeb303b224954e718d89598874
SHA512 87ef9a4a4b3581f65a24a4afe2d1029ccb871a6b3ac080f68b5b7991b5220efb7028455416e0d52681d5cbdf45e0a70f42a6baaa0d1cc3aeef2122ed83520bd3
TLSH
T1CDC02B3392C6C77A018221F66524F30AC91EA408E6A62F3C4E3DF504A28F84DF393743
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Default\Sync Data\LevelDB\LOG
Size 136B
SHA256 5627e142124ebc1b42edd9c13704a516298569b8352ab1ea2eb122b0da224934
MD5 58f38880219a3a74b314a59966dfcf49
SHA1 7a4c0b5056464f90613849df50cbe7c663d64de9
SHA512 bf5727e47c164fc3b4fcadb34e85221662827c8c13b6f687193d59d6d419f00ebbd2398c69b26c4a39b4eb975bb46bead2905720f562871d76e537d6717ad121
TLSH
T1D1C02B73C1C58374004052E291687706847CA80883813F0C4F3CB814618640DA333383
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Default\Web Data
Size 2KB
SHA256 b4b85113e5386498ea1157bd1cd952a0beb1a3499d3856e4203310d80a4ecde0
MD5 a9ac7cf64a9ade263e802058b86b358b
SHA1 d4cbc61b66dfd3e3736bdf576de964d54cebb55c
SHA512 2eb61598fcbfbd81170c012018ce9454ce016db0df9d7e3eaaae4c6a8f01701e1091bf725bcf3e5c00e03f72ddba0eef23107f6bf75385d376f183ad972522b9
TLSH
T1EC4104C05740104DD0551DF154D1537C4F15D1D4C1010F33175411544C415C40D705DC
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data-journal

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Default\Web Data-journal
Size 512B
SHA256 ed4f5cf0a59a44cf89e9f7edf7d356aff5345032a61422da4591d36e9b818dcf
MD5 d082e52a4a8a774a6eb7636f188514f4
SHA1 de86f20dc1b95328179568e9254d4a7f398ef0a5
SHA512 4cf1c08d8499bdadad76fcbf94d6f2426439c229b2c9991d6b5aa82ab0073293f60ebe84bc80e569c165666f85e2b04a45e4bd19af98d7ca06fcc36a7e002c2c
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Local State
Size 1KB
SHA256 c5d560394be26f5494be3c14f760def8384e1098dabb8018d78052497c6d6a60
MD5 4ff47bb9bc74b29811b059816333606a
SHA1 1a68c6052841543e624ef1a76fb014526e6a06f8
SHA512 d38c2170769fae139827dd6f5c240e2c9debc251560d0422ca7dfe6768457bc328754b35189ed3b5af7fa06d85efd28fa4254fe0607cb2c4ce1384d8c60fee0b
TLSH
T13111D8716A486B22A9454546DA82AF730DBC527BF002DD4C3FCA2B04057E3DD5B02C30
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\segmentation_platform\ukm_db
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

ukm_db-wal

Path C:\Users\Admin\AppData\Local\Temp\1eb4ip1f.5t4\segmentation_platform\ukm_db-wal
Size 32B
SHA256 c19ebbdc7743e7e141101dfd324c93c67b169c2dc98444d2504a11fd957a4876
MD5 793fbc7914f5263cb74cf0d282334271
SHA1 9cf4524896017d92bfc8f9be04d7923c539aad4c
SHA512 58face49ad44996ab355e678427d9d00ca5ef0130a74991d9989cc30039e4d40811a28f4a922c35e8eab404146c07f7664cad852d951d8b856543a281db93036
MD5 SHA1 SHA512

Submit Download

memory/1140-11-0x0000000007120000-0x00000000071B2000-memory.dmp

Download

memory/1140-8-0x0000000006D30000-0x0000000006D70000-memory.dmp

Download

memory/1140-1-0x0000000004E40000-0x0000000004E50000-memory.dmp

Download

memory/1140-67-0x0000000007FD0000-0x0000000007FEE000-memory.dmp

Download

memory/1140-48-0x0000000000A40000-0x0000000000B40000-memory.dmp

Download

memory/1140-42-0x0000000004E40000-0x0000000004E50000-memory.dmp

Download

memory/1140-43-0x0000000000A40000-0x0000000000B40000-memory.dmp

Download

memory/1140-41-0x0000000005010000-0x0000000005110000-memory.dmp

Download

memory/1140-13-0x0000000004E40000-0x0000000004E50000-memory.dmp

Download

memory/1140-12-0x0000000007C80000-0x0000000007CD0000-memory.dmp

Download

memory/1140-0-0x00000000007A0000-0x0000000000870000-memory.dmp

Download

memory/1140-10-0x00000000076D0000-0x0000000007C74000-memory.dmp

Download

memory/1140-9-0x0000000006EF0000-0x0000000006F56000-memory.dmp

Download

memory/1140-66-0x0000000008030000-0x00000000080A6000-memory.dmp

Download

memory/1140-7-0x0000000006CC0000-0x0000000006CF2000-memory.dmp

Download

memory/1140-6-0x0000000006BB0000-0x0000000006CB2000-memory.dmp

Download

memory/1140-5-0x0000000006870000-0x0000000006962000-memory.dmp

Download

memory/1140-4-0x0000000005420000-0x000000000546C000-memory.dmp

Download

memory/1140-3-0x00000000052F0000-0x00000000053C8000-memory.dmp

Download

memory/1140-2-0x0000000004F50000-0x0000000004FCC000-memory.dmp

Download

memory/1140-64-0x0000000007090000-0x00000000070A2000-memory.dmp

Download

memory/1140-65-0x0000000002790000-0x00000000027AC000-memory.dmp

Download

memory/4168-44-0x000002B6D5510000-0x000002B6D5602000-memory.dmp

Download

memory/4168-46-0x000002B6D5680000-0x000002B6D56C0000-memory.dmp

Download

memory/4168-45-0x000002B6D5710000-0x000002B6D5812000-memory.dmp

Download

memory/4384-71-0x0000000000910000-0x000000000091E000-memory.dmp

Download

memory/4384-72-0x0000000005320000-0x00000000053DA000-memory.dmp

Download

memory/4384-73-0x0000000005240000-0x0000000005248000-memory.dmp

Download