c89aa97ce9b0306e4dcc3f00227e337e68d3769502f082ed999b80513a2093cd

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW P.O 2026-03783292.js
Size 1.3MB
Sample260727-pmlw6sen3w
SHA256 c89aa97ce9b0306e4dcc3f00227e337e68d3769502f082ed999b80513a2093cd
MD5 67073352c54815574913a2f184b15abd
SHA1 1cfc117331d07ca2fc2dd1c758b2fa24a21966a4
SHA512 dafaa28095a5fefd0c435446829854940bfec2a73cd52c44d7e8fbc427430e2b858a99811c2194bcce07759ed4f2aadf803dd2ea7242ac7224112789dc4f5a65
SSDEEP 24576:o+SkaqbOZhhNNObfejuxOkAglAaTIBg7wub9qWqcKgflRuJSsgsu:602ucmTZqJT2lRjsM
TLSH
T17C55233A1856FB730B1C032D23AF1A33227C758DA46CD6945B9129CD252B723096E6FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1868	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenWith.lnk	OpenWith.exe

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	OpenWith.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	OpenWith.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	OpenWith.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	OpenWith.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpenWith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpenWith.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2404	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
2244	chrome.exe
2244	chrome.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
5076	chrome.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe
3308	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeIncreaseQuotaPrivilege	1868	powershell.exe
Token: SeSecurityPrivilege	1868	powershell.exe
Token: SeTakeOwnershipPrivilege	1868	powershell.exe
Token: SeLoadDriverPrivilege	1868	powershell.exe
Token: SeSystemProfilePrivilege	1868	powershell.exe
Token: SeSystemtimePrivilege	1868	powershell.exe
Token: SeProfSingleProcessPrivilege	1868	powershell.exe
Token: SeIncBasePriorityPrivilege	1868	powershell.exe
Token: SeCreatePagefilePrivilege	1868	powershell.exe
Token: SeBackupPrivilege	1868	powershell.exe
Token: SeRestorePrivilege	1868	powershell.exe
Token: SeShutdownPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeSystemEnvironmentPrivilege	1868	powershell.exe
Token: SeRemoteShutdownPrivilege	1868	powershell.exe
Token: SeUndockPrivilege	1868	powershell.exe
Token: SeManageVolumePrivilege	1868	powershell.exe
Token: 33	1868	powershell.exe
Token: 34	1868	powershell.exe
Token: 35	1868	powershell.exe
Token: 36	1868	powershell.exe
Token: SeDebugPrivilege	3308	OpenWith.exe
Token: SeShutdownPrivilege	2244	chrome.exe
Token: SeCreatePagefilePrivilege	2244	chrome.exe
Token: SeDebugPrivilege	5076	chrome.exe
Token: SeShutdownPrivilege	2244	chrome.exe
Token: SeCreatePagefilePrivilege	2244	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2244	chrome.exe
2244	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 1868	4360	wscript.exe	89
PID 1868 wrote to memory of 5484	1868	powershell.exe	92
PID 5484 wrote to memory of 5676	5484	csc.exe	93
PID 1868 wrote to memory of 3308	1868	powershell.exe	94
PID 1868 wrote to memory of 3308	1868	powershell.exe	94
PID 1868 wrote to memory of 3308	1868	powershell.exe	94
PID 3308 wrote to memory of 2244	3308	OpenWith.exe	95
PID 2244 wrote to memory of 4304	2244	chrome.exe	96
PID 2244 wrote to memory of 2240	2244	chrome.exe	97
PID 2244 wrote to memory of 2404	2244	chrome.exe	98
PID 2244 wrote to memory of 1272	2244	chrome.exe	99
PID 2244 wrote to memory of 5204	2244	chrome.exe	100
PID 2244 wrote to memory of 4916	2244	chrome.exe	101
PID 2244 wrote to memory of 1944	2244	chrome.exe	102
PID 2244 wrote to memory of 5076	2244	chrome.exe	103
PID 2244 wrote to memory of 5256	2244	chrome.exe	104
PID 2244 wrote to memory of 3288	2244	chrome.exe	105
PID 2244 wrote to memory of 2176	2244	chrome.exe	106
PID 3308 wrote to memory of 5076	3308	OpenWith.exe	103
PID 3308 wrote to memory of 5076	3308	OpenWith.exe	103

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OpenWith.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\NEW P.O 2026-03783292.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "iex $env:DBDZBMXFO"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w1zbncmt\w1zbncmt.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DF3.tmp" "c:\Users\Admin\AppData\Local\Temp\w1zbncmt\CSC27BA75C4681546DFA8DEBD818BF6A3F.TMP"
      4⤵
      PID:5676
- - C:\Windows\SysWOW64\OpenWith.exe
    "C:\Windows\SysWOW64\OpenWith.exe"
    3⤵
    - Drops startup file
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:3308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fk0udrow.too"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\fk0udrow.too /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\fk0udrow.too --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff9bdafc728,0x7ff9bdafc734,0x7ff9bdafc740
        5⤵
        
        PID:4304
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fk0udrow.too" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,7133569671767135556,13206361924634525031,262144 --field-trial-handle=2064,i,15805184903922409256,17973182482022994894,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
        5⤵
        
        PID:2240
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fk0udrow.too" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1828,i,14501666246378635639,2948270409774153389,524288 --field-trial-handle=2064,i,15805184903922409256,17973182482022994894,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fk0udrow.too" --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,3746622463414705136,3044884251291579415,524288 --field-trial-handle=2064,i,15805184903922409256,17973182482022994894,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:13
        5⤵
        
        PID:1272
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fk0udrow.too" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2924,i,4480027270172904128,16472122291645449660,2097152 --field-trial-handle=2064,i,15805184903922409256,17973182482022994894,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
        5⤵
        
        PID:5204
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fk0udrow.too" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2936,i,8055043482416714252,14309154703246710681,2097152 --field-trial-handle=2064,i,15805184903922409256,17973182482022994894,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
        5⤵
        
        PID:4916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fk0udrow.too" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3156,i,3157672733303289961,17946535047378801070,2097152 --field-trial-handle=2064,i,15805184903922409256,17973182482022994894,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
        5⤵
        
        PID:1944
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fk0udrow.too" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3168,i,4294037393518198924,9579858331157936463,2097152 --field-trial-handle=2064,i,15805184903922409256,17973182482022994894,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:9
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fk0udrow.too" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3912,i,5977484741697289584,14759826934335110786,2097152 --field-trial-handle=2064,i,15805184903922409256,17973182482022994894,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:9
        5⤵
        
        PID:5256
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fk0udrow.too" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4228,i,15680813451603944059,4533388260231337096,2097152 --field-trial-handle=2064,i,15805184903922409256,17973182482022994894,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
        5⤵
        
        PID:3288
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fk0udrow.too" --force-high-res-timeticks=disabled --metrics-shmem-handle=4292,i,17707466289277578074,11562931886545471414,524288 --field-trial-handle=2064,i,15805184903922409256,17973182482022994894,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
        5⤵
        
        PID:2176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2600

C:\Windows\SysWOW64\OpenWith.exe
C:\Windows\SysWOW64\OpenWith.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES6DF3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6DF3.tmp
Size 1KB
SHA256 0bc8311093f203d14f5b5d92a4727ac95bbbf2180822514c00b4b31ce5b22100
MD5 c1bcbde43d1f6e3d57b8b8b66aed1fe6
SHA1 db4e2eaf3829a940ed309f8afb2c959a4ade8edb
SHA512 b44d7efe4779658cdc85b17aceb11787d985f4db695a85e9a425bbe25755078aa73effa4578dded3935304b493483758ff964c706f4b37ce80e98ae473cacd2c
TLSH
T11221CC0593EC871FF0730331A9F6172FA674FC54EFA193AB444042282C41654EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Crashpad\settings.dat
Size 40B
SHA256 3fbe80ffa68b0bada9147f2e8d254ce20babcaa2554ba504404af63a75ef0c5c
MD5 02496241e60038f686f6f2bda2a9a661
SHA1 9c2fec3a5ac0c6993ecc91a540b5c331f0474169
SHA512 74fe53d7495665b2784c3797e3a1fc46ab1f4b2fb2127735a18c9a93f2107df934a5a53e8b72056ba561bc3a77e0c4c36326430c1930fe09e97df8934351ff9e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 3ce1c809abe6117be472e280cd9e6c5f55fdcace7bb542845010ad20458037b0
MD5 a0a9e5035fb622545a39f1b6521278be
SHA1 05f5ee29cc65193faa02f429539ecd5b06e47456
SHA512 f1e5667ea9f6bcc3e1f3eea98a7adc6f46227c449513d7aa42b0c62bbd93c02d918bc289f2434561543854a5f38685f9dea825e518dd24d11eeb30327015cf22
SSDEEP 6:/FoEXE+YkN2+MpXKFYZ+o3uGLltdubeYzpFbl:d7XFN2+pYAo3u4XdS1/bl
TLSH
T10B13527CA9E29E26CB94023C18CB4BF0C3B8901AD8C2EB4301B93C32F50832930DD284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 8cb0832601f3fa3d3622a27956d3b68427c09a918a5f621bf7a85fb71c9e8dcd
MD5 c51f031b2a2bae785fc8660537a4d62b
SHA1 fbafdacf5f01842973fa53a09cb4c6b16ddfa683
SHA512 51c24fa37826af8571ef4e5ee1297eb52b444fd6e0d23bfe4ac132f293a4c578141c21333c7bc06a99833c808af216fa095707df92e871aff6d2c8ced055323b
SSDEEP 48:rYNKfl3qJO5eD0HCfagKfeM1Xghd/MmXkXXbdVEPLVBKWwtl:MkN6O5eRf+eughd/jkhVOLHKWol
TLSH
T1384498F72D04DDC6DB1CCBB56C42913CCE3257251C99EEB5F63884B265405E731186A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 6e179a9a54272f6093fcb2d455d76d031d44f57ec7812688d7563e562c05b286
MD5 e2c30b71ed1ac225a29e92fce2ea0af2
SHA1 540a24558ce3e44d5efd9c1d7271792547f8437c
SHA512 c87f8eaaf2c4040586a78c1e430f63216dbc0b929869c29fe3cbeed24f7b420c63611e6e18f7dc5f95e2ac36292cb0037876ae1503f0abf1036afd65d53efa23
SSDEEP 768:4UfDPLSgcRUv+P4pUfDPLSgcRUv+v4wUfDPLSgcRUv+l4/fDPLSgcRUv+i4snz4T:+6ZqfztxMzEz
TLSH
T1A0165DB74F68A942E785EEB0FBCDED1C3C7023C5ACD65892F022926959E0FC41B8515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 31212e538cdce27781e476e1d0b170abd6bdff4440a3d7510cb26bc9f7fc8cb8
MD5 b25c254433e0423952279a017ef75430
SHA1 4744440926e6b893558da2d96512277254048338
SHA512 547e2865146b4819f30786558cc13c16f1d0317d261b4ebb552f73b3150b6eb403615feb68a6c7bca8442cc564d864c0b1f322eaaf6098c30a149c8d2c906046
SSDEEP 768:pukQ7n13lrNa/opukQY2DJWMHaWEY2wWVKKbXV5wYv+aW+bU/Nt:6J1rNOCHQY2VWMIVZKm55v7FbUL
TLSH
T1B903F25625B6CF3D21C66A472C37960C456320B3E7575A32B3E4423222B13D9AEF661E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 6a61b95e873e0f5505dd480208c00ac0e32a4d913209648a9825332eb8b9b6fd
MD5 7637378e46397a3f66a65894969d73e7
SHA1 cda8574cdb9a71fb96e173cfd0a1d9189604c08b
SHA512 fc3e5fbfdc0c873271c306c8fa75150d43366463cff354b2c146dfb3dbf195eda1d87077a90177ad5c2e6e993ae1f823bb1eb7535afa5c041c632d62fa67b971
SSDEEP 1536:ZEqcbzcJJpTE0N6EvOHns627rRH/WipIdENTEQVInkL/XKjaaZVjC:ZEq4zgTRN6IOHG7VfWipCE1BFjKhNC
TLSH
T1B063120A8BD6953ED5F73F867B38630D235A70DDC74288A7FB20A4A12356C2D916346D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Cache\Cache_Data\index
Size 256KB
SHA256 12cf53f2c8c8303c15a74df1bd933688472201e4d66bdd79a0e76467b7619798
MD5 afed35df94f7ef9f43e6ce15c3f70250
SHA1 337ee319bf3441f40604b2fe87b2661571bdad53
SHA512 7bdccb599e1241538dca13d74215a4edf4645dcb999a70bfff8b9b824c3272dbef0ed2fc7fb5e03cc5dbf4b78b338e66b40cd31ef5b4fb629e20e29a53e4e0e7
SSDEEP 3:LsLllFlklNllklkXly+F3oXollLll/911mE/L/9lXlQlYlXl2NtlJNtl:LsRa3lPyuoX4aETdONZ
TLSH
T1FA4402AE4B454E0AC6C006FC84D747607735C565DF5B8743034425607CC1B911F5F0A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 282e7522a185ba82f8235d0c195cbb71046c8209b9b2d496dea454b90db6eebd
MD5 2fadfa0f1990f8289849912a3dc59456
SHA1 2726fe76b58e2a881eb1f6c2646d93eb95526d2f
SHA512 bf207a0abb3dc192f2d449a52c37832549d92997eae26aa668bcc20b1ee3ba39c9a09de344508649bade69f131853dad01181e21fe818f530b347220423c3c19
TLSH
T1B9E02B82828C1F1DD32D96F7CDA603484A0F53C429BE3603A880C2C277124681248523
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 03072efb17e0ac8860a5dfa1e50c299d47f0ba6b654d5783c10ba2522d687e43
MD5 f97c3efcb8165a17626aaf7d4f46248c
SHA1 11424878f5febea3bd21671d94107af2a9cc4dd2
SHA512 ac39ca156f0fc92b15ab7d6c2443aef3dbbfe0482d5bf8ec5012cf27a2cb0b782f8c2400aa7c71b68d1cc05f099f39d2a6e579e47833bba105e7f115319f7f9f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\DawnGraphiteCache\index
Size 256KB
SHA256 7cc186de88579e82202cb400fe52418f84b288cfd5d0a425914d209e7a732e83
MD5 f69b9aa526492e3f4150bca079e2f61b
SHA1 b6e7c1d4a33ca8cf733702be1b2a5b0c8c5d2b12
SHA512 7e89132920ad5d13099035b8f0e73d8e81b1e76a44b7727c098c303342c46108c31c8bbe27fe881a40ac34db85676ee3df8967015317b535b502b4b408f77315
SSDEEP 3:LstlNllklkXli7:LsX3lPi7
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\DawnWebGPUCache\index
Size 256KB
SHA256 7e9bfdaf26f4c481080f996beed44ac6797cb0c2bf9cadd7e4b69a5269edf21c
MD5 b97a123bc098fa7fba929c951b65dfd0
SHA1 879ec6ed3281fe3a832ce3aa0b51e442afa7ce5f
SHA512 08e260eb8c346934fd16b88be2a673ba50b23c7a8afe813ff488fb12d84e0272c0fb76dcb270f1058166fb1b67d22b49975c25263f39466b083a19a00c30fa57
SSDEEP 3:LstlNllklkXl/f:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\GPUCache\index
Size 256KB
SHA256 8e2c21b0c590f7aafce49705a08ad1dd58e542068074a9e7dcbbdacffd49e274
MD5 21cda1cadeb561a98459b70a4fc5f888
SHA1 f22996414fd07b97d80084d8d499b11699ade6f4
SHA512 618410aa22764c3f72fc3e7ec13702c5461d6a25eeace8f24417d8250d5b170068c4570c38cc8907083f4c865c322c21ac23a46b4f9fc707ffec7fe444b5e90e
SSDEEP 3:LstlNllklkXl8O:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e84d463bd46be1925dfbd10f7a81f49cc622fdf3a793f377e8a9db75ae232821
MD5 fede3c4b055de3e7f993c1beb0d847d3
SHA1 adba60796694dd2eeb7efbb72ab9adbf7fa1ef09
SHA512 6b1186f64df45a103a9eb2f228647eaef6d66a063cce5193740b139020c61ad7c799f0b70d9c140fd3881ccbee693defad9e1ca5b767b6f29f40669bf7aaa5ae
TLSH
T1DFA002911251D912C90857B52CC283887634F93A930343237AE11366DD612506956544
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 5db7babde313fcbdb948a94ab7fbfce65d8eff3490762aeeede8c4b504460751
MD5 de08a4430bba4cdf72236d28af2ea857
SHA1 19242c9ee9bddfe323771c86f4990b859a98857c
SHA512 3544f0c91b46e431d7b1c68526f218a52b99dbdb3fc5aaa6ba718e449501b4e8212cdf0773d1ff4ad160841aa38f3ee839d34ffe2e51cb594d18fa18e99b4bba
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fk0udrow.too\GraphiteDawnCache\index
Size 256KB
SHA256 63a430e0b820bda0b1a14baf008db10ad350e5934d6da3e1012e587a31d8d021
MD5 62d3f55836e635851cf3157c7f3f80ea
SHA1 48a99cdb6f4831b915daca95a8e826ad1803d62c
SHA512 7cf3be338c922b75618b8a759281f0c81eb24cc038de46f418aec17367b1a32a3b5e90fb75d0d1110558b7d715522ede2f0b2c842ca50402bd83f5d062751550
SSDEEP 3:LstlNllklkXlA:LsX3lPA
MD5 SHA1 SHA512 SSDEEP

Submit Download

w1zbncmt.dll

Path C:\Users\Admin\AppData\Local\Temp\w1zbncmt\w1zbncmt.dll
Size 3KB
SHA256 6d84f08578e7e519ce612cb04b0f7f6fdce09cc9738ed22c94e70f3e6dcb93e3
MD5 da6d1e9843d7360667733d89015e4b8f
SHA1 3671e48e56479baf4d737329c6bbbf78dd92ae72
SHA512 f774e97bf25580fa967ea2c866b81924d290522803cc580ff19c61b2402b5440a2c2c30b18f08932eff0d63bfe8b9324de4c60f730472ca1f88a5c981cc1c1bc
TLSH
T14B71FC1797E9467BE0B60734AAA30B1327B4F860AF7353AF0A90022D2C517649D72BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC27BA75C4681546DFA8DEBD818BF6A3F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\w1zbncmt\CSC27BA75C4681546DFA8DEBD818BF6A3F.TMP
Size 652B
SHA256 3b788a47879f55fea85638323cb24ad8fe43a19fc4385dcf1fbf166747ad6d5f
MD5 a7abe869c7ed2b46f3dbb4874346022d
SHA1 9992ddf0d63e631dbccb3bc861d45d919c9dceca
SHA512 ab3e0a4437ab12cde76b46e9ca5d78572b337f46920248af96d2d943c1fc3c9916240bfb726ba9a06377ea9ef86ca36bf637a4394dc9392a4a2373d1457dec6f
TLSH
T12FF05E0AA3FC420EF0F34B30FDF653A795A8BC68DE3293ED1440031D28649208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

w1zbncmt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\w1zbncmt\w1zbncmt.0.cs
Size 407B
SHA256 17903854876a2772f0c7e4989bb4ef67a4726b1fa5e02f36689dca528f047aa2
MD5 6111f3c44612f27772f17cf7aabd6c3b
SHA1 8b65ca610c6d1873eab31ef4616d7af6c1101815
SHA512 85fc6c0119855227074aba1a50be452a1de6d9b432bc215ce5773cc9b55cdd5e6c7da23c91a8ce599e3e679b4fe29f89f3a8ddd4649c9c3b523c16f98796bc3f
TLSH
T17AE02B982B92D75828C39E1E4EE9E37DE773F4F41BBC181157B946125F46406433B702
MD5 SHA1 SHA512 TLSH

Submit Download

w1zbncmt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\w1zbncmt\w1zbncmt.cmdline
Size 369B
SHA256 f10683caf6e448c473fd4374fc52affedfe51d6e11a40dc2db88e3dd29e3fa30
MD5 88faca214d9605447e1c039730fc958e
SHA1 c5562190655c77cd1612dc618bcd8f908a267c97
SHA512 48b95f34f616f05033020fd16108e1b15729840b73bd7ae4434567b49842c9fb0dde8c77621cbe5cefa52f9036193f590d067f3a1fc2794be4ef399b59f79d0d
TLSH
T174E0682A7257F27D01DB100721A9C8AC837706C329D03F945088842DD09B060E7D3756
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1868-25-0x00000000079E0000-0x0000000007A00000-memory.dmp

Download

memory/1868-14-0x00000000069D0000-0x00000000069EA000-memory.dmp

Download

memory/1868-32-0x0000000074550000-0x0000000074D0C000-memory.dmp

Download

memory/1868-45-0x0000000007A00000-0x0000000007A08000-memory.dmp

Download

memory/1868-46-0x00000000083F0000-0x00000000083F8000-memory.dmp

Download

memory/1868-47-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/1868-52-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/1868-55-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/1868-54-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/1868-53-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/1868-1-0x0000000002F90000-0x0000000002FC6000-memory.dmp

Download

memory/1868-2-0x0000000074550000-0x0000000074D0C000-memory.dmp

Download

memory/1868-4-0x0000000074550000-0x0000000074D0C000-memory.dmp

Download

memory/1868-3-0x0000000005730000-0x0000000005D7A000-memory.dmp

Download

memory/1868-5-0x00000000056C0000-0x00000000056E2000-memory.dmp

Download

memory/1868-61-0x0000000074550000-0x0000000074D0C000-memory.dmp

Download

memory/1868-63-0x0000000074550000-0x0000000074D0C000-memory.dmp

Download

memory/1868-6-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Download

memory/1868-7-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Download

memory/1868-10-0x0000000005FC0000-0x000000000631B000-memory.dmp

Download

memory/1868-11-0x00000000064A0000-0x00000000064BE000-memory.dmp

Download

memory/1868-12-0x00000000064F0000-0x000000000653C000-memory.dmp

Download

memory/1868-31-0x0000000074550000-0x0000000074D0C000-memory.dmp

Download

memory/1868-29-0x0000000008370000-0x0000000008394000-memory.dmp

Download

memory/1868-28-0x0000000008340000-0x000000000836A000-memory.dmp

Download

memory/1868-27-0x0000000007B10000-0x0000000007B1A000-memory.dmp

Download

memory/1868-26-0x0000000007A20000-0x0000000007AC3000-memory.dmp

Download

memory/1868-24-0x0000000074550000-0x0000000074D0C000-memory.dmp

Download

memory/1868-0-0x0000000074562000-0x0000000074563000-memory.dmp

Download

memory/1868-21-0x0000000070920000-0x0000000070C7B000-memory.dmp

Download

memory/1868-13-0x0000000007CC0000-0x000000000833C000-memory.dmp

Download

memory/1868-20-0x00000000707A0000-0x00000000707EC000-memory.dmp

Download

memory/1868-19-0x00000000079A0000-0x00000000079D6000-memory.dmp

Download

memory/1868-18-0x0000000074550000-0x0000000074D0C000-memory.dmp

Download

memory/1868-17-0x0000000008900000-0x0000000008EBA000-memory.dmp

Download

memory/1868-15-0x0000000007710000-0x00000000077A6000-memory.dmp

Download

memory/1868-16-0x00000000076A0000-0x00000000076C2000-memory.dmp

Download

memory/1868-30-0x0000000074562000-0x0000000074563000-memory.dmp

Download

memory/3308-62-0x0000000005180000-0x0000000005258000-memory.dmp

Download

memory/3308-256-0x0000000007200000-0x0000000007276000-memory.dmp

Download

memory/3308-68-0x00000000063D0000-0x0000000006462000-memory.dmp

Download

memory/3308-66-0x0000000006090000-0x00000000060C2000-memory.dmp

Download

memory/3308-65-0x0000000005D90000-0x0000000005E82000-memory.dmp

Download

memory/3308-64-0x00000000053E0000-0x000000000542C000-memory.dmp

Download

memory/3308-58-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/3308-257-0x0000000007120000-0x000000000713E000-memory.dmp

Download

memory/3308-69-0x0000000006870000-0x00000000068C0000-memory.dmp

Download

memory/3308-57-0x0000000004DE0000-0x0000000004EB0000-memory.dmp

Download

memory/3308-56-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/3308-255-0x00000000067E0000-0x00000000067F2000-memory.dmp

Download

memory/3308-59-0x0000000004EB0000-0x0000000004F2C000-memory.dmp

Download

memory/5076-203-0x0000022A6C0D0000-0x0000022A6C1C2000-memory.dmp

Download