db1abdb2326eb2fd6153ba84f27b20d3ee1ca53a64df1776b3c820aef340de61

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-it
resource tags

arch:x64arch:x86image:win10v2004-20260513-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
23/07/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1_Bonifico n.11012607232903_001.pdf.exe
Size 561KB
Sample260723-ldd87avdnb
SHA256 db1abdb2326eb2fd6153ba84f27b20d3ee1ca53a64df1776b3c820aef340de61
MD5 457142f0e24c04ac21fc367182c9e5a4
SHA1 9adc26789c178c72f66309324f0a70060a5b1afe
SHA512 5ec8d8411227071696ffb989867235049bb73d1bdafed25982df36c40159aad3478c0392400551a3d733cad082928f8c4573968a91b4bef3346c385e1050b57d
SSDEEP 6144:/KWYUfInjw6hRObw49+/cPc3F7q/gfMfKzdAnB37e4ObpF22NQy6GW590oaCjLY4:/TEc6mDcWIHBGB3C4+2
TLSH
T183C43B15FF5845E5D093E138D9A68615E3B33CD68B3087CB22A8932E2F33AD55D7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jsc.lnk	jsc.exe

Accesses Microsoft Outlook profiles 1 TTPs 39 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	jsc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4896 set thread context of 2416	4896	1_Bonifico n.11012607232903_001.pdf.exe	86

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4144	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
4052	chrome.exe
4052	chrome.exe
4052	chrome.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
4324	chrome.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe
2416	jsc.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	jsc.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeShutdownPrivilege	4052	chrome.exe
Token: SeCreatePagefilePrivilege	4052	chrome.exe
Token: SeDebugPrivilege	4324	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4052	chrome.exe
4052	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 2416	4896	1_Bonifico n.11012607232903_001.pdf.exe	86
PID 4896 wrote to memory of 2416	4896	1_Bonifico n.11012607232903_001.pdf.exe	86
PID 4896 wrote to memory of 2416	4896	1_Bonifico n.11012607232903_001.pdf.exe	86
PID 4896 wrote to memory of 2416	4896	1_Bonifico n.11012607232903_001.pdf.exe	86
PID 4896 wrote to memory of 2416	4896	1_Bonifico n.11012607232903_001.pdf.exe	86
PID 2416 wrote to memory of 4052	2416	jsc.exe	88
PID 4052 wrote to memory of 2036	4052	chrome.exe	89
PID 4052 wrote to memory of 3164	4052	chrome.exe	90
PID 4052 wrote to memory of 4144	4052	chrome.exe	91
PID 4052 wrote to memory of 4324	4052	chrome.exe	92
PID 4052 wrote to memory of 3868	4052	chrome.exe	93
PID 4052 wrote to memory of 5032	4052	chrome.exe	94
PID 4052 wrote to memory of 4928	4052	chrome.exe	95
PID 4052 wrote to memory of 548	4052	chrome.exe	96
PID 4052 wrote to memory of 1052	4052	chrome.exe	97
PID 4052 wrote to memory of 2052	4052	chrome.exe	98
PID 4052 wrote to memory of 2632	4052	chrome.exe	99
PID 2416 wrote to memory of 4324	2416	jsc.exe	92
PID 2416 wrote to memory of 4324	2416	jsc.exe	92

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\1_Bonifico n.11012607232903_001.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\1_Bonifico n.11012607232903_001.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Drops startup file
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff98381c728,0x7ff98381c734,0x7ff98381c740
      4⤵
      PID:2036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1660,i,1273461297454694847,10304066584345754261,262144 --field-trial-handle=1944,i,13955267619033207581,4313332718273101254,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
      4⤵
      PID:3164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt" --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,8756390892475668748,18047937839957780034,524288 --field-trial-handle=1944,i,13955267619033207581,4313332718273101254,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      System Time Discovery
      PID:4144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt" --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,17057628954584877437,3821121542290702000,524288 --field-trial-handle=1944,i,13955267619033207581,4313332718273101254,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2932,i,553338031595762118,15092847961373877239,2097152 --field-trial-handle=1944,i,13955267619033207581,4313332718273101254,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2952,i,870932289579959982,3865883716523087427,2097152 --field-trial-handle=1944,i,13955267619033207581,4313332718273101254,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
      4⤵
      PID:5032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3336,i,1691267411108331732,4244706046555096911,2097152 --field-trial-handle=1944,i,13955267619033207581,4313332718273101254,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3360,i,10079785931539791527,17222791001255478772,2097152 --field-trial-handle=1944,i,13955267619033207581,4313332718273101254,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:2
      4⤵
      PID:548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3904,i,2201479002034799247,7822484578285971073,2097152 --field-trial-handle=1944,i,13955267619033207581,4313332718273101254,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:2
      4⤵
      PID:1052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=2928,i,17918216716111889817,18043655183215302920,2097152 --field-trial-handle=1944,i,13955267619033207581,4313332718273101254,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
      4⤵
      PID:2052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=it --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt" --force-high-res-timeticks=disabled --metrics-shmem-handle=4212,i,9031048817295604979,852958829207590902,524288 --field-trial-handle=1944,i,13955267619033207581,4313332718273101254,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
      4⤵
      PID:2632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Crashpad\settings.dat
Size 40B
SHA256 7e64473eadfbc1c370c19d9a34caa01f39d641738f4a4b316f2563199338c925
MD5 9e4ebc2f0de17e99e1fe5f1777c739ee
SHA1 35dea5075316f91d71b8bc270354e4fcc87ecbdf
SHA512 825b49d3bf0ecbd93c6198b60219207a6f51d4592115aa8e18995c4a6b600480a8c5f6ef845813556e9e5fd21191ea9ff85df14659f716bd7ba6fd9fdfc1f392
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 70076ae311dc9e4c8153df1d03b2cdf07cd6e09dcd3338afa15a9cabe87a5e0e
MD5 724dda9e66c7812452ad0de0a48c6d20
SHA1 b9856e485c9e451820c01ca8c7ac7ec89c3af67e
SHA512 0a5cdeaf9f2aec2a25b87213c08130fa53c0b5571b0b3aa60eac88d02f3dc628110371f383bc6a873898d89f9c1ef2e4ceb9f9d63bb583cafd19b33261333e08
SSDEEP 6:/FoEXEgzkphK8I6tXuPxm427XYYi+m2U9kDtz4pBIl3flpF:d7X3QS8cLY5o9izoB0R
TLSH
T173135E2FED443DD7EBA019FD496B2FFC3330C418AA9A47830C7030A12A99701004F140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 5a3f6dd9de6de2cc70422a0446625f04566bf4e11d6b1a73957b36d9b267ee22
MD5 84398ef812fc59219db6bdfb3ce67b73
SHA1 f0febfccd17016da8cbdf1555304cfce0a198df7
SHA512 94857840786fb0eb05c81f1666465c578dfcc719481d054aff85c6c3b26c95c4b542c1b32d98b558ca0611a83ee544ef2e1357f908696bf26f2c2367837bf2ec
SSDEEP 96:+K/9JoYUmJKNu5eughyTdjk2VOLHKWol:VCmJKNugQTdA2Scl
TLSH
T13B44C9FB5D04EDC2DB18CAB46C51923C9E3352161C9AED75F63848B24150AF7322C9B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 3e6d5d27a5ad6b7af494f76b2b607461746ba2c935143822ffe58cb08320dd02
MD5 9df6742d2939314de2e1fe904f003ad3
SHA1 861daf21d077fd46601a3a6f13d8c08e58a1d263
SHA512 a5a2b3eb4829b0cc742b8cc1dd7700b4fa8a061de7c0f51c0aabdea09cce53ced146eb297080cbece4d639035225f89efc6acd90e05181daa17463a2c870e79c
SSDEEP 768:e8UfDPLSgcRUv+b466UfDPLSgcRUv+C4+PUfDPLSgcRUv+V47fDPLSgcRUv+k4b:5vlcozTxXz9z
TLSH
T1F4164BB64F68B982D785EFB0FBCDED1C3CB022C5ACD25892F422926949E4FC41B8515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 f74d5c3ef9282c23ab448d079a22507ccd0cac9d43c0b77808d07cc9379a6202
MD5 d763e2468af1339de2b606d0d4d6f7af
SHA1 c045252e8cc8b75162fe364fe26cdaf0cd4d05f6
SHA512 3a0f7f158cb26e96e6f09967f7a0a4be8d6bc62361797e990c9e688fa1cc96188f142775f53c0ccf11bad0ed9e6d4209b19499a08e7a0e76ad4aba257ddad04f
SSDEEP 768:NnIOTPnBhyeoqsC34huDtphjQTZT/XAb50+N6RuojiQ5:9IoPBPrIhO3EAb5ew/Q5
TLSH
T1B203F1C99211E0774A1AD96FE3E3CF399AA002334864583D883858DEC6F6F386254ECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 6a61b95e873e0f5505dd480208c00ac0e32a4d913209648a9825332eb8b9b6fd
MD5 7637378e46397a3f66a65894969d73e7
SHA1 cda8574cdb9a71fb96e173cfd0a1d9189604c08b
SHA512 fc3e5fbfdc0c873271c306c8fa75150d43366463cff354b2c146dfb3dbf195eda1d87077a90177ad5c2e6e993ae1f823bb1eb7535afa5c041c632d62fa67b971
SSDEEP 1536:ZEqcbzcJJpTE0N6EvOHns627rRH/WipIdENTEQVInkL/XKjaaZVjC:ZEq4zgTRN6IOHG7VfWipCE1BFjKhNC
TLSH
T1B063120A8BD6953ED5F73F867B38630D235A70DDC74288A7FB20A4A12356C2D916346D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Cache\Cache_Data\index
Size 256KB
SHA256 03a6442b0c7eafcb8f593629b57e30c85b2a21215d5a700518cf1dcf98c940ae
MD5 4288bce7d16be9cac24599ba82f0343b
SHA1 cfbf750e9f1b26b09e572517f429ac0eaf1927c2
SHA512 36f91e158337b3614805709be4c6c44cb42056de144a634760507da294d2b1a741bb39fb4ab19f88b99dd7353ecb7f981d5a875dc33ffd7a786983dde14c9ae6
SSDEEP 3:LsLllFlklNllklkXlum7YzllLll/mltmE/L/5Ntl2NtlNlXlYlXlwl:LsRa3lPumUJ4METBUNG
TLSH
T1974411AE8380AE0EC2C002FC88838BA03338C008CA8BC303030022202CC0BA28E0F0A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 a4d8a5b4553190b22e3358474e1948569677d7b328929e49deec2e0658c6d2a4
MD5 d9617654ec2ca1b09304c3ace0ddbd45
SHA1 81d9ca9af937cb9b4f99fef4b8b728d32638fd4c
SHA512 8ec2c4a0b65867476abebec8915698c3ed3b0f0368bdc52f232c010aa307acfa61416dd5f82db1f8bcd7c3eef0a5f7b9dac76923f57e2f861c442bce05c69e7c
TLSH
T153E02B91824C0F1DD32D96F7CDF603084B0B52C42ABE7603A880C6C133124281248522
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 15e31fe15fc319bbb0caad94cb14dd44aa740001e195c1f1a01fe58916bf7b50
MD5 02fa73b889f39028dd0c846b82222bcf
SHA1 fa4e8a958d6cdbe8080cf8caddc8dd1f245dabe7
SHA512 67e5363dbb335ef6e382859aca9f2ee298b4a51133b22cac87c568f20272aa63e855759974c1479617cf805964e8a63649e9061484ea43422d4b1c277ce47a71
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 27c43ec315183dde290ca6aacb502670487e0f824286caace51c79e6a2248008
MD5 aac7554e4c138090cf7835c3c8275c76
SHA1 8f28f3d7708989c155f9145d99f59e06a72bb101
SHA512 b06cfdcd35b659f9a5b55e973183af0eed73de7a3717e95dea1e7a6d288ea4af58093e5e4ee963fdcdfe78b104e2d570666879d0adc54b374b4ea5265e791eed
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\DawnGraphiteCache\index
Size 256KB
SHA256 cc685757506a6d55486d0f75699e45d75c5e82bf86e04c12882af16e3e1cf4f9
MD5 05720e760cd3903b87d2851479b30342
SHA1 ff22cc408cbbde61558f07e029a6661ca99682d3
SHA512 fca810e8883bf7cb70c8e41740aafb63e8dc2d4f74dd1c72a9f2b250bee000f3c2e92051ae12753ee5e631af1d2083b4e74a15dd015339b13cef429ef0418d50
SSDEEP 3:LstlNllklkXlrn1:LsX3lPrn1
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Extension Rules\LOG
Size 265B
SHA256 4fb468510da8df3f3dc526370b916037eff82dbf4e77eaccb991b03ec3572f78
MD5 bc88ae46b038ec92853459299512419f
SHA1 dfdddf673bc3673c87772d3fd46df2384191c2a5
SHA512 31b4f84d1bb944769f0a14cfb4022e6a8dfebed962ec673ca3491a1bd61f90dfecc73aa43c07276078d6bdd6186fad8d1b3dfb16af793f3a93b649be4e0d48a0
TLSH
T15DD02B9158E5C5660168E197E7A9530AC750280DA7483B080F1CD8C8344A10CA3AAB41
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Extension Scripts\000003.log
Size 76B
SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
MD5 cc4a8cff19abf3dd35d63cff1503aa5f
SHA1 52af41b0d9c78afcc8e308db846c2b52a636be38
SHA512 0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Extension Scripts\LOG
Size 269B
SHA256 739fec9e0ca7b566194430782c8d4ed835aace0bb2d30b08a8a86480926135dd
MD5 dc33e14b4b3134a41500e4e4f870dc2e
SHA1 429ab49ae39b1b499c8ddbb311024c4ba8c81443
SHA512 103ff9ef65a019dce763bd22d9015e6abaf44e19ef926d7be768a92cbb9456692b5406c5b53a55f6a0e09bb1353c1a2e2fe0af71d3f13886261f2d30338b2c41
TLSH
T138D0C2945CE9C5760168D5978B7A630AC7902409B649BB080B5CDDC8304A208D762F81
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Extension State\000003.log
Size 228B
SHA256 48d535bb330519c00d150578734c6cecb056c4b5cdd2a45c70590bc896d27d9f
MD5 af1d95e1f9eb485393273b25446e1ae5
SHA1 1d762c96b1c38ba6a849a5b76d12fac636b8d780
SHA512 826d207edd55401e1c13249350814adbb3ab00a135c46b8da8bb7267751c70580f183982cccbc1e47bf3e3f433f20ba1d2f2afd601fcb67b635c0e7429558165
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Extension State\LOG
Size 267B
SHA256 c43730c8394dd056ec968fa7252434e31beb8c29157539c93b497192408dcdc9
MD5 f6f7b6263e04a779f8a8a3a75375e0d5
SHA1 4177d866207bbb21e9168a960a6bbe9ce6f5ae80
SHA512 ad43183b1a17001ba062ebf6d3cf2e3dc27a16407bd9263d5b62f91f82ec378be0dd3313bde5cbd9ce679e753cdac90a626d108e5cb6123cfa1b5f7fdf070a94
TLSH
T18AD02B000CEFC11608ACC5E7973A230E8F60340DB7483B180F2CE888304A159D366F01
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\GPUCache\index
Size 256KB
SHA256 7758aa8483035747629cca134b0cb6b4902fcd332e23c375178e65869ada7748
MD5 7f7f274a102ccc50b13f2420ca697c70
SHA1 7a4b152fd7b628f4e8ad9ecc3ca076e5c9076028
SHA512 d6a6f603b89e25cd1802abb874b88cd280f6d3bcfcaace8093cd08783ef11315e9412aa3b8c2f4b4f92aa96f3128ad0b51a7bdc42b76c89b3e32ec317f327f59
SSDEEP 3:LstlNllklkXlDe7YK1:LsX3lPC71
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Local Storage\leveldb\LOG
Size 277B
SHA256 f83245e713e4bc623aa83c54c0d8a5669f65b0733c0ebf2171bd58f63ea67abc
MD5 f21dd59c77816388e494c1293bea8da5
SHA1 18d039a787831e722e7d5f2733fac955a56e5880
SHA512 c69b30567fb7f78f1ada782a343e0ecf056978b16cadd35cc1a25921cc594e93b69f9b040e9fa469260bf027fef39f488bc13f428350a7c4c025731708e29d7e
TLSH
T117D0CDE044EAC1361159816F5729730ECB701408A54D2F484D6CF544B48D008C792683
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Network\Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Network\Reporting and NEL
Size 36KB
SHA256 473cee21f162f3a7a25635fadf8a9264238ac53cf89f7bb67ede9fbcdc676cfc
MD5 56e8276cedbc027359e31311dd2f91ed
SHA1 5aead8213b1fdeb895b9d51975126c5527ed8949
SHA512 c6ae5450f3ec31cb87fe6deb33b79c9c7919f637343e93cd0866d52c9fdaf674ab82eec261d77aeb0da4a5ed9f2960431657474cde55067a8b49c58c5a12888b
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:uIEumQv8m1ccnvS6
TLSH
T195F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\jfdqcrlz.itt\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2184-220-0x0000000000E30000-0x0000000000E3E000-memory.dmp

Download

memory/2184-221-0x0000000005830000-0x00000000058EA000-memory.dmp

Download

memory/2184-222-0x00000000057F0000-0x00000000057F8000-memory.dmp

Download

memory/2416-152-0x00000000013A0000-0x00000000014A0000-memory.dmp

Download

memory/2416-6-0x0000000007660000-0x0000000007762000-memory.dmp

Download

memory/2416-11-0x0000000007BB0000-0x0000000007C42000-memory.dmp

Download

memory/2416-157-0x00000000013A0000-0x00000000014A0000-memory.dmp

Download

memory/2416-13-0x0000000005980000-0x0000000005990000-memory.dmp

Download

memory/2416-153-0x0000000005980000-0x0000000005990000-memory.dmp

Download

memory/2416-151-0x0000000005B10000-0x0000000005C10000-memory.dmp

Download

memory/2416-0-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/2416-9-0x0000000007990000-0x00000000079F6000-memory.dmp

Download

memory/2416-8-0x00000000077E0000-0x0000000007820000-memory.dmp

Download

memory/2416-7-0x0000000007770000-0x00000000077A2000-memory.dmp

Download

memory/2416-10-0x0000000008160000-0x0000000008704000-memory.dmp

Download

memory/2416-5-0x0000000007320000-0x0000000007412000-memory.dmp

Download

memory/2416-4-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

Download

memory/2416-3-0x0000000005DE0000-0x0000000005EB8000-memory.dmp

Download

memory/2416-2-0x0000000005A90000-0x0000000005B0C000-memory.dmp

Download

memory/2416-1-0x0000000005980000-0x0000000005990000-memory.dmp

Download

memory/2416-214-0x0000000007B30000-0x0000000007B42000-memory.dmp

Download

memory/2416-215-0x0000000003390000-0x00000000033AC000-memory.dmp

Download

memory/2416-216-0x0000000008C40000-0x0000000008CB6000-memory.dmp

Download

memory/2416-217-0x00000000080A0000-0x00000000080BE000-memory.dmp

Download

memory/2416-12-0x0000000007D50000-0x0000000007DA0000-memory.dmp

Download

memory/4324-154-0x000001FB9C4F0000-0x000001FB9C5E2000-memory.dmp

Download

memory/4324-155-0x000001FBF6960000-0x000001FBF6A62000-memory.dmp

Download