77e307748b17f05bf2740441346a34bf468281dcd6c12c315b619e1c787b0fea

Analysis

user interaction
yes
max time kernel
564s
max time network
560s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Script-Ware.zip
Size 3.8MB
Sample260730-d5a2vack91
SHA256 77e307748b17f05bf2740441346a34bf468281dcd6c12c315b619e1c787b0fea
MD5 5fd2fd029a9093477c091549866dba20
SHA1 21cae6f871549907b45914eaf144ad9ecc7dbf0d
SHA512 7bf9cef107d621a0051645251e8e3dfd231567e0bd7c4d61644cfebd9d7104e131bc703fae4a239e276ce89abf6929527704e222b49748eddd6a430b2dbe303b
SSDEEP 98304:riQjuZ5eWBD3aOX+OVqryEcH7ya4DD0/P:rxjw5BBD3aOXLIrJcH7yTD4X
TLSH
T18D0633B25753025F8651CB3725CC1E0027EF3CDF822DAFB0A56B25A2D56581BDEC42E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
208	6112	Script-Ware.exe

Executes dropped EXE 2 IoCs

pid	Process
5208	Decompiler.exe
4860	Decompiler.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
194	raw.githubusercontent.com
195	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

ConfuserEx .NET packer 2 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/3936-279-0x0000022ECFCA0000-0x0000022ED0080000-memory.dmp	ConfuserEx
behavioral1/memory/3936-280-0x0000022EEA750000-0x0000022EEAB8E000-memory.dmp	ConfuserEx

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_611445209\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_223554658\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_223554658\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_611445209\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_223554658\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-tk.hyb	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3492	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Script-Ware.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Script-Ware.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Script-Ware.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Script-Ware.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Script-Ware.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Script-Ware.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298561716193651"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
5520	chrome.exe
5520	chrome.exe
3788	msedgewebview2.exe
3788	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
3352	msedgewebview2.exe
3352	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe
Token: SeShutdownPrivilege	2928	chrome.exe
Token: SeCreatePagefilePrivilege	2928	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe
2928	chrome.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1740	2928	chrome.exe	102
PID 2928 wrote to memory of 4324	2928	chrome.exe	103
PID 2928 wrote to memory of 4324	2928	chrome.exe	103
PID 2928 wrote to memory of 3492	2928	chrome.exe	104
PID 2928 wrote to memory of 3064	2928	chrome.exe	106
PID 2928 wrote to memory of 3064	2928	chrome.exe	106
PID 2928 wrote to memory of 4412	2928	chrome.exe	107
PID 2928 wrote to memory of 4412	2928	chrome.exe	107
PID 2928 wrote to memory of 1076	2928	chrome.exe	108
PID 2928 wrote to memory of 1076	2928	chrome.exe	108
PID 2928 wrote to memory of 5052	2928	chrome.exe	109
PID 2928 wrote to memory of 5052	2928	chrome.exe	109
PID 2928 wrote to memory of 3276	2928	chrome.exe	113
PID 2928 wrote to memory of 5480	2928	chrome.exe	122
PID 2928 wrote to memory of 5488	2928	chrome.exe	123
PID 2928 wrote to memory of 5496	2928	chrome.exe	124
PID 2928 wrote to memory of 6108	2928	chrome.exe	127
PID 2928 wrote to memory of 6108	2928	chrome.exe	127
PID 2928 wrote to memory of 4184	2928	chrome.exe	128
PID 2928 wrote to memory of 4184	2928	chrome.exe	128
PID 2928 wrote to memory of 5520	2928	chrome.exe	129
PID 2928 wrote to memory of 5724	2928	chrome.exe	130
PID 2928 wrote to memory of 5724	2928	chrome.exe	130
PID 2928 wrote to memory of 4360	2928	chrome.exe	131
PID 2928 wrote to memory of 4360	2928	chrome.exe	131
PID 2928 wrote to memory of 5880	2928	chrome.exe	132
PID 2928 wrote to memory of 5880	2928	chrome.exe	132
PID 2928 wrote to memory of 1928	2928	chrome.exe	133
PID 2928 wrote to memory of 1928	2928	chrome.exe	133
PID 2928 wrote to memory of 1900	2928	chrome.exe	134
PID 2928 wrote to memory of 1900	2928	chrome.exe	134
PID 2928 wrote to memory of 5780	2928	chrome.exe	135
PID 2928 wrote to memory of 5780	2928	chrome.exe	135
PID 2928 wrote to memory of 2244	2928	chrome.exe	136
PID 6112 wrote to memory of 5208	6112	Script-Ware.exe	139
PID 6112 wrote to memory of 4776	6112	Script-Ware.exe	141
PID 4776 wrote to memory of 1012	4776	msedgewebview2.exe	142
PID 3936 wrote to memory of 4860	3936	Script-Ware.exe	143
PID 3936 wrote to memory of 3352	3936	Script-Ware.exe	145
PID 3352 wrote to memory of 2352	3352	msedgewebview2.exe	146
PID 3352 wrote to memory of 3984	3352	msedgewebview2.exe	147
PID 3352 wrote to memory of 3984	3352	msedgewebview2.exe	147
PID 3352 wrote to memory of 3984	3352	msedgewebview2.exe	147
PID 3352 wrote to memory of 2728	3352	msedgewebview2.exe	148
PID 3352 wrote to memory of 5284	3352	msedgewebview2.exe	149
PID 3352 wrote to memory of 5284	3352	msedgewebview2.exe	149
PID 3352 wrote to memory of 5444	3352	msedgewebview2.exe	150
PID 3352 wrote to memory of 5444	3352	msedgewebview2.exe	150
PID 3352 wrote to memory of 5444	3352	msedgewebview2.exe	150
PID 3352 wrote to memory of 2184	3352	msedgewebview2.exe	151
PID 3352 wrote to memory of 2184	3352	msedgewebview2.exe	151
PID 3352 wrote to memory of 2184	3352	msedgewebview2.exe	151
PID 3352 wrote to memory of 3688	3352	msedgewebview2.exe	156
PID 3352 wrote to memory of 3688	3352	msedgewebview2.exe	156
PID 3352 wrote to memory of 5860	3352	msedgewebview2.exe	157
PID 3352 wrote to memory of 5860	3352	msedgewebview2.exe	157
PID 3352 wrote to memory of 3788	3352	msedgewebview2.exe	158
PID 3352 wrote to memory of 1812	3352	msedgewebview2.exe	159
PID 3352 wrote to memory of 1812	3352	msedgewebview2.exe	159

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Script-Ware.zip
1⤵
PID:2908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffce450c728,0x7ffce450c734,0x7ffce450c740
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,11824277327240853908,3824023441709820052,262144 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2124,i,9797085917125744796,14632960689824580518,524288 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,3056935888464453095,2788785964057441865,524288 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,12075724948698914943,6861102377064180049,2097152 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,17653825812673390481,6397563765840785401,2097152 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,11750963468539849464,9584320968858976816,2097152 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,4838745885123822018,4014206455701685016,524288 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,12443008140006700648,2184900235655348375,524288 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,13676506350362851755,745692026358212344,524288 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,12637404727122200514,9891237648136023550,524288 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=244,i,100013419230071624,4420742123372975293,2097152 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6124,i,12026423077085134969,2843136393681264122,2097152 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6060,i,1535432609203826494,13499760770165998217,262144 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5960,i,11527073316975027156,4267568228167475719,2097152 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3020 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3396,i,13168769389119225924,3237913646436888783,2097152 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3248,i,1627605106374176558,8345201472356661012,2097152 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3020,i,16324202473779665043,14884581404098640463,524288 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4140 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6032,i,18141439677369393398,1495451112706039901,2097152 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6044,i,9065522656307535484,15010412184306285748,2097152 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,12113194180670460328,11071146840203015442,524288 --field-trial-handle=2016,i,7148392448430879244,12016968024418514082,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4808

C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe
"C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\Downloads\Script-Ware\Script-Ware\bin\Decompiler.exe
  "bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Script-Ware.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3936.2008.18345948137110061483
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x1ac,0x7ffcdedeb078,0x7ffcdedeb084,0x7ffcdedeb090
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView" --webview-exe-name=Script-Ware.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1772,i,11511685045946028567,3505538092395386743,262144 --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView" --webview-exe-name=Script-Ware.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2080,i,11511685045946028567,3505538092395386743,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:3
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView" --webview-exe-name=Script-Ware.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2420,i,11511685045946028567,3505538092395386743,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:8
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView" --webview-exe-name=Script-Ware.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3676,i,11511685045946028567,3505538092395386743,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView" --webview-exe-name=Script-Ware.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3652,i,11511685045946028567,3505538092395386743,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:1
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView" --webview-exe-name=Script-Ware.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2256,i,11511685045946028567,3505538092395386743,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView" --webview-exe-name=Script-Ware.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4808,i,11511685045946028567,3505538092395386743,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView" --webview-exe-name=Script-Ware.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4732,i,11511685045946028567,3505538092395386743,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3788
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView" --webview-exe-name=Script-Ware.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4848,i,11511685045946028567,3505538092395386743,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:8
    3⤵
    PID:1812

C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe
"C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe"
1⤵
- Downloads MZ/PE file
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Users\Admin\Downloads\Script-Ware\Script-Ware\bin\Decompiler.exe
  "bin\Decompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:5208
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Script-Ware.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=6112.6104.8717130124557503704
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x174,0x178,0x17c,0x150,0x188,0x7ffcdedeb078,0x7ffcdedeb084,0x7ffcdedeb090
    3⤵
    PID:1012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3352_223554658\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3352_223554658\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3352_604990207\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3352_611445209\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e91d49409309b35e0a11f0eb3198c31b0bef5df97ce266b2ea1ee7516482da9d
MD5 55345bf86ccd916d3930b1970e1cc213
SHA1 28356f6177f1849ff8f447e70fc8bd3ca20e5556
SHA512 095172103d5d269e9c92706dcdb902c09c1c3eb95d6faf8926172c06847b7473ee9824b720654958c1954a494c262102314e33e19bf39ee45eb7494cd78aa4bd
TLSH
T18AE022AADA31EC2B28F9472C60941B8AEA4013573B80C95F3A3C8509CFF5B3A0186C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 a115c5c671d5151d1bb6ed30cece4a614192aa613824c170e75db2b819d29525
MD5 81a5c8823cd84250c782ba6709c0aaf2
SHA1 b0602e1096cdda71e0770d986ea9da386eb29d68
SHA512 e53cb1b32593672809b3d5da2bc6a906eded0ffe24f58a3826b0b376ca1e296ae1b401104680f30fcebeade9089e463d3352cc0dd3424857f3bda064c3c25510
TLSH
T14EF0263D201A88F5EB9D963853E9499137967E2A01135A1F78941CECAC62DF7ADD01C2
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c0dfea3dfdf18cf257a3185d6112f56a136eb20fb8f1041bb75192121956f5fe
MD5 76cd13400f1dcabe2cfbf87e2667eee8
SHA1 758169f55b5b31e43f153593a75b8fd87faeed98
SHA512 3a6211fc48aa6fea74b63bb3da1fde28794a6009a800db0795dad85889430b045564570fbcc92789ce70c26abfcb654c6c5996c5f239336b153237128339cbc4
TLSH
T1E8417BF7D3E8896E891652E4DB216E1FCD3D0A14132D3C62C9D8AF5B43E2972D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 72405b7b029a88356e6097dec2d5b076ce70c21365e51042f787fa277a228020
MD5 eea7e0d44677430ff5d8c672e93ee7da
SHA1 a04de6c6e9899a79aaba131e70cb0b1f122639e7
SHA512 ea792e104fc8c83599761ba9dac5c4e32b47d96308f5166c3dde5ac2b0c432bb0282ce16979ae4b23be2e922ff8681738df567cb1c944799ef6bde3cbc3eecd9
SSDEEP 192:D0uwmitqJJ5Ju9aIpEdLDSpOoqAIaPdvqfPiNPPwKNlbQmtisK:D0uwmitqJJ5Ju9aIpEdLDSpOoqAIaVSt
TLSH
T1ADD1ABF783E4866DC91156F4DB15AF1FCE291628032C3C62C9D4AE1BD3E2872E25534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 8e42041ca2213ed4eff0b20c062a71f232fd8c0ce32ce3c71c437a4fe539e5fe
MD5 5a2e0954087f0e3f416741b6603a529d
SHA1 f29083bc7dcbd7a66a53e39fa89907b8cebe0b1b
SHA512 78d0f84df594468aad94e4b7cd2de44d3b151955500d93eff0f55fa54541ef3ec046816312685698394d557f362f5e17f66ce9197b457e24a588cf8613c6cea4
SSDEEP 192:D3f4RRE40JgRaIpVF5YDSrOnKcNIaPdvH2fPRNP5E:D3f4RRE40JgRaIpVF5YDSrOnKcNIaVPX
TLSH
T147D17EF7C3D8866D881156F4DB256F1FCD2A1A28032D3C26C9D8AF5B93E2972D21534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 db2c7d425503916ddbad1679f785264d099f29bd37f409bee46d4560936c3b08
MD5 8ab116cf7059a07517c7315f50a2cd6a
SHA1 36dd4ddc0b1cbb45cc0d035e796527a28fae0517
SHA512 0e1d8463187d5888da1fb6f3840661a8a3daec312e13bc52e1e9c7f46e7dfa59e50765afbb024e97521c2ecc2667e8eb0abf73a4b12959a7a0108ce5811a65c7
SSDEEP 192:D3f4RRE40JgJu9aIpVFLDSrOnKAIaPdvH2fPRNPPwGNIabQmtiQ:D3f4RRE40JgJu9aIpVFLDSrOnKAIaVPM
TLSH
T174F18EF7C3D8856DC91156F4DB256F1FCE2A1A28032C3C26C9D4AE5B93E2872E25534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 f1678728f1012ae05799fd6b030eb61779b478170b23b159009f30526e4cfadb
MD5 372a58d73e25407addd0f7eb65f7496a
SHA1 60b450a1afef44c2e9083e7b8cdc5b5a4700d783
SHA512 bed236d5d93de72ae20a9d38588b8da79fccad60bbb31caa3e23ed558adf83b703e01d873cab7cbaae00448ab33a21c6dc61af853618cb24157bec574feb4aa8
SSDEEP 192:D3f4RRE40JgJGaIpVFLDSrOnKAIaPdvH2fPRNPPwsLNIH3:D3f4RRE40JgJGaIpVFLDSrOnKAIaVP2e
TLSH
T157F18FF7C3D8856D891156F4DB256F1FCE2A1A28032C3C26C9D8AF5B93E2872D25534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 915d55646943fbfd4defe73bfafc8dc1cddc1973da1fb3bfb394d5f30e208795
MD5 b78e5ce679e225bb1a133fd5e5a3e04b
SHA1 8c7304ae27c4ba3317c1d3d7e5b71967be393e5e
SHA512 3755ba7b0581fc5d319b3bd130a0dd35c836f45fac5af8737410bbcbe6c6b9c1fc795ceb32b9b7698783feb55f0b373288096fe93def3061a5c16d069903b591
SSDEEP 192:IR1oxUtv78IAPRp209DHsb+WNnDw0EnRSkwMadVyIsnAUgraJ:IR1oGN4JXD5ws0kSsare
TLSH
T13042C62EBE10693B6CDBD229FD257753D7F6102161A52E44EAFC8E1C14EB5CC222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6dc1ff44f83984fea3e0648551ad905fc8268f98a87a3eba14a5ab98a84bc13a
MD5 98603e42a896841fd68f797ef94beffe
SHA1 840d6b4e23bb47193b516807225eb8c52e0aeb8d
SHA512 24d4cf09b3cb4d94c8a5363c70c03103c2fff040dd5d9ea8297ce5096aeef388155c399f2c3ba816cba06f6a618bc20d5f6bb821c1a0a904a8288788e54e4e94
SSDEEP 192:IRpcBzox1av78ImPRpkZOh9DHsb+WNnDw4o3YTnRSkwMaRVyIsnAUgraJ:IRpmzob247XL5wsnY9Ssa3e
TLSH
T15452B72FBA1069376CDBD229FD657753D3F51021A6A42E54EAFC8E2C14E75CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4d0d61504b1762fc585efca111978b2b196768e8a9f87733cb48c95558667e22
MD5 23a604f1df9b5ddd08098c668708d01b
SHA1 9ad3957a6f58c616c124ddeb811bcbce77fdcfee
SHA512 5b10fc935cb92ac04d79720050561e6fd9b36466f3368fb5479a311fd9fe488a51e20f243066e093cfa6a5436a7f5c4d8d0a8a36192baa46fe71b630f0e3d731
SSDEEP 192:IR1oxUhv78IAPRp209DHsb+WNnDw0jnRSkwMa2VyIsnAUgtaJ:IR1oGx4JXD5ws0tSsaO8
TLSH
T12742C62EBE10653B6CDBD329FD257753D7FA102161A52E54EAFC8A1C04EB5CC222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4a4e691fa3f313840d0a045d401d92b88c0283a8503d8348ce12a1f6bd66a571
MD5 7f9a44d46d34eef807b0d4f1eb2b6e51
SHA1 63e852d45c7613e7b1809cb47a41b82f395b8da9
SHA512 55bf5d9e57ba4d350e612266eacd6eaaac8d9ed9434e596662f782958a9bca8cc86113694ba92bc87e02e78508f3f35ccf7542ee655404fd0cd99954fe994d95
SSDEEP 192:IRpcBzoxlav78ImPRpkZOh9DHsb+WNnDw4o3YTnRSkwMaRVyIsnAUgraJ:IRpmzor247XL5wsnY9Ssa3e
TLSH
T1FC52B72FBA1069376CDBD229FD657753D3F51021A6A42E54EAFC8E2C14E75CC222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 352e62c4a32b01400299a073b93262cecbff5b7ee8f93df514b82bd0f2c20d12
MD5 f9a3524e1d888f4ce4f99e3225de78ad
SHA1 d44c516f6310ce6a1d4590c4819ae6929f0299b2
SHA512 3e814f95a21b22ccab890d55458d8d74219db60e269501266d136e8b3f13d48481d21f3a9986cf91c65e59b5e18576cc7fc420a56b6d369a17f75846c2cbbd9a
SSDEEP 192:IRpcBzoxDJv78ImPRpkZOh9DHsb+WNnDw4W12dnRSkwMaRVyIsnAUgraJ:IRpmzodJ47XL5wsD2jSsa3e
TLSH
T1EE52C72FBA10293B6CDBD219FD657753D3F51021A6A52E54EAFC8E2C14E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 79e807f2fbd1226ddca1aed090785ed5ae262689aae5e4bb5e248b62ea0fcdb6
MD5 0382e418f7bdea213dce069f167a810e
SHA1 f77d67e6bdae6bb291f4bf547101be484ab60e05
SHA512 6865c63eeff6a39cfaf2a71f17a9338e8e854d0d3f026236b0efab29f3346e25cd00c4da60dfc7aee6c3187a4b5239102aef22e5a79dd1ec869afd2f989e01ed
SSDEEP 192:IRpcBz8x7kv78ImPRpkZglqlxlAh9DHsb+WNFHu4ubDwdy31a2RPA+o3YlnRSkwy:IRpmz8VA47Xl5wJrjidO9YrSsa3e
TLSH
T19362A42FA920197B5CEBD229F815B756D3F51021E6E46E84EAFD8E1C14DB6CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 012b1bfc6b2231ce773051ec1d911a7e0dcdfbbd6e11c54b6802f42f49967e9c
MD5 c84304c2bc5eacc080cdcccd47f26832
SHA1 03aa23f1cabd84d93d05397b231a6fd855646683
SHA512 d1b2dd55a443e7eaa1b01a45e369735c713364acb4fe2be01b6b061dd8d056e4ecd80de8969cd3250bb012e46c51cfd289bd33e72fc0c96618fc5d7f95bfc48a
SSDEEP 192:IRpcBz8s7Shv78ImPRpkZglqlxlAh9DHsb+WNFHu4ubDwdy31AQfPA+o3YbnRSkJ:IRpmz86Sx47Xl5wJrjiRg9YFSsa3e
TLSH
T1F262B42FAA20197B5CEBD229F815B756D3F51022E6E46E84EAFD8E1C14DB6CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 8d9d103bcd3f54ddf01d1c37d55577b3ca4ee5243cba58e432617af5eeda57be
MD5 b3b60c7705369cd7ef6120d990dfa5b3
SHA1 016f3ce31778466a1db021a847cf801be5cb75b4
SHA512 7aba548906225fe3f8827b90178d054bfe43f5737b566592f42282c5dd647f8c50995d4afb5d058e340043db3f05bb349f09bd32d112adddd9cdc57b69ceca13
SSDEEP 192:IRpcBzoxxav78ImPRpkZgl+lAh9DHsb+WNdu4ubDwdy3xPA+o3YmynRSkwMaRVyr:IRpmzoT247XN5wdrjiu9Ym2Ssa3e
TLSH
T19652A42FAA2029775CEBD229FD15B757D3F51021A6A42E88EAFD8E1C14DB5CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6c6eaf43e62e17f73201b8b0ee5fb3ab6648b43e8ffd7a26c0c0643f96944bcd
MD5 84cec23c00e400a9ee917634c189a4e0
SHA1 257c17a35ae86b62b5580074e67a37094f151da8
SHA512 2d63806e8cd3299ec49a37dc9aeec930d61438de54f45129112f7adb3db2c3cad6c9ffa0f3e6e04edacec06bd0ec44d88c7577e6160417894254490640428718
SSDEEP 192:IRpcBzoxDav78ImPRpkZOh9DHsb+WNnDw4AzUseaqnRSkwMaRVyIsnAUgraJ:IRpmzod247XL5wsPAseaOSsa3e
TLSH
T18152B62FBA1029376CDBD229FD657753D3F51021A6A42E94EAFC8E2C14E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 08f9ca43ba51d6c0c16f055e718cbce108e1e066464c74a766e65623c1273b0b
MD5 066dd48004cf4546b0b17fc88fe8da10
SHA1 5e7a155af9d435e8073b733c6e5b881a9da8cd05
SHA512 099d9fcb49279a74992ac286855cd9f1f5138d5022b15fd2d5df481e008574d26899a40ce1a42d1f67ee6153e5e9e0369f01deb70db5cc193e05cc01b762a219
SSDEEP 192:IR1oxUtv78ImPRpk09DHsb+WNnDw00nRSkwMaRVyIsnAUgraJ:IR1oGN47XJ5ws00Ssa3e
TLSH
T1A142D82EBE10693B6CDBD229FD657753D3F5102161A42E44EAFC8E1C14EB5CC222711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 482595d0753b57858de9982ada29073a035851569b073c78c33056f338d47f15
MD5 4cc97301b46079c1788124f5159137b5
SHA1 f0a2d5bac31c1390a71f7f8bdb82fda6c883eb01
SHA512 72cf09f2727ec5fd41c10f2133eac3480b9ef9a4a7167a0a0c881f33811dd8ed8a3befbc38980b03c2f92849a863d606ec022261c218332639835ddf9a63d303
SSDEEP 192:IRpcBzoxYav78ImPRpkZKlAh9DHsb+WNtubDwvPA+o3YFynRSkwMaRVyIsnAUgrK:IRpmzo+247Xa5wtjw9YF2Ssa3e
TLSH
T1C152A62FAA2029376CEBD229FD657757D3F51021A6A42E54EAFC8E1C14E75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cfc367854073ce97b495dbe02ac16a3ebbdf18c0408f6a12798de60c5a0731af
MD5 efdb8c0226a6300ccc42719c8fb1e934
SHA1 01cf2b8592fdbc80921740057933e99fd25366dd
SHA512 e8f4f81e3cee1c95ff950e682e2e865bb02adf7b254eed5cdb7b67fe6470efbde041699e5246017c5dccceb9276cdd73c88dbc5df5d08fd01d62e081abbe97a2
SSDEEP 192:IRpcBzoxC4v78ImPRpkZglqlJlAh9DHsb+WNFHu4ubDwdy31LPxPA+o3YcnRSkwy:IRpmzoIk47Xl5wJrjitu9Y8Ssa3e
TLSH
T18362A32FAA20197B5CEBD229FC15B756E3F51021E6A46E84EAFD8E1C14DB6CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7ddf1d03c93394749cb9b6c5f9b9cb0d47d9e6b6ccb46e6672ea83e1b23d3aaa
MD5 09faa5ec18f444083b80b01b83097c4c
SHA1 4d2396ed2cbb99784e4e6b9a6c60790387b2e3f3
SHA512 df819f311b0677505f0640245114b50ddf988eb018585f93c339817f8a0e635218587ef57c6f824be92d2a280044a4e72cdce326c0cbec3ee7ae24944c35e024
SSDEEP 192:IRpcBz8x7Shv78ImPRpkZglqlxlAh9DHsb+WNFHu4ubDwdy31AQfPA+o3YbnRSkJ:IRpmz8VSx47Xl5wJrjiRg9YFSsa3e
TLSH
T19762A42FAA20197B5CEBD229F815B756D3F51022E6E46E84EAFD8E1C14DB6CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 c0912f288735a7202b3a8a441a52fa2da5c29c147ace43f9416e8b2e83701c5e
MD5 69c7735c84ddcc2c2d560ffd326a5cac
SHA1 b297883b25164dfa1cffae1ed46b2db72d14bdc4
SHA512 b145be2c8d2ec87de5be5d1450bf0208f36e13d9465afa010b84351a11bc936421b03c634414e09199f532d6a54b4a8fba298f859a86fed7115ba9ba94af34ee
TLSH
T175A0023259510065E41842715485025033544C1432A3120284D1018DDE60291D935C42
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 3b9cfa4b1378749376fbb9d7f6ebdab07527893f67afa268311b633c3c572fb9
MD5 9348c284e63ecc426eb6d7decf740b39
SHA1 dd7d646624cd8e10ceeec3fa9a1f5552a4d3a9d0
SHA512 69ecae1b1c70a8b0e29611e3d9c736ab6130c63bda4bdc1c89248f5c38fc2e540bb504fbd691ccdad76f416f4ca92e7886b0b0b200a287618ab9fab2d80868f4
SSDEEP 6144:CYOy/eY/0Ljo6PGqnom7Rkm1tYpBeh2BAo+:CYP2Y/0Ljo6r9oBGcAo+
TLSH
T14F342323EE71F7B61499522CB08F991C1CB21583DA49F6E18ED9EF8827FA9C41D18D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 278KB
SHA256 0077613d1385684c6a3d54bca70ced2cf1ad6586528c8c20721a34aa04cafc75
MD5 f80d42d8ba744afcc2cf6f0bc70c6920
SHA1 bd913446cc7d4dde59ef0d016864f538d3ac904d
SHA512 7ea49f3ff004854022828b0042e3371ae4510ba6eadd26421cdba24e2af45e9c1fdfeea664ea84b1127b79507b57d63e0eec8fadcd5026d554595596a5a158f3
SSDEEP 6144:HgivrjWZvpj1yOy/eY/0Ljo6PGqnom7Rkm1tYpBeh2BAo+:AijjWZRRyP2Y/0Ljo6r9oBGcAo+
TLSH
T1C2542333ED71B6B608C4A52DB04EA91C1CB25AC3DA8DF691D8C59B8467EF5C82D19CB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 ff6e8d488dad6bf023febc8a7268d760272b8dd7fe1a826a81ce44b018d4238d
MD5 0f039c4be801a997188c481e0edfe9b4
SHA1 8efd59c82e7cbbfde7dec70a5f390a21a541aa22
SHA512 6ca689a5735acfc040cc27c2fc2de824d99f05d99fb6d31f9b8dc59ffc6bf3d88d48dbbb59903f2d1860baeb668b162dc640d7ec311bdcc73acfe20fceefdc19
SSDEEP 6144:G1rOy/eY/0Ljo6PGqnom7Rkm1tYpBeh2BAo+:KrP2Y/0Ljo6r9oBGcAo+
TLSH
T1C9342337AD71BA76089A562CB04FA91C1CF12683DA4DE6E19DD9BF8823EF5C41D18C70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 06d03fe64e1a5f88ec187b5ce93f4bfb441c1c9c50fe0fac789ce10d3a686976
MD5 2b4f0c8875fbf2af948d91ddb72750a9
SHA1 ed15c5e6a39965c944d774c094e43bc4cc5557f3
SHA512 3168bdac2af5b8781b0e05e7ce31d3d8043ebb54350cf17bc709e007c4f9cb042f59b3150ada0e9cff576b6c719bc532a80f933d60b76b4a2efa7b5fa1fc7cec
SSDEEP 3072:BGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Qm7Rkm1tYpBeh2BAoO
TLSH
T101C3123B5D65E9375D79A70EB48E0B1E1EF249A6C930DE4288D86B0437FA7CC1A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e5e47521df08cce973f3524c27f420d77729e535fb078f5c67b3cf4e5f438026
MD5 6200475a1799ee2fe03f7efba00f2316
SHA1 21d5e34f7247c2951bd8a2c1499aab43276712e2
SHA512 d4c1c1e594daee1fe5ed109278f4cffe9d8c5cec4a3f6e446a7796cb76f59646018c830f88378f24518382f72961243dbf8d7b72446c27df87bc4c7d9c558317
SSDEEP 6144:5YOy/eY/0Ljo6PGqnom7Rkm1tYpBeh2BAo+:5YP2Y/0Ljo6r9oBGcAo+
TLSH
T1B3342323EE71F7B61499522CB08F991C1CB21583DA49F6E18ED9AF8827FA9C41D18D70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.json

Path C:\Users\Admin\AppData\Roaming\Script-Ware\data.json
Size 127B
SHA256 0c2ed536c2f318227aed18d8c144028cb778f4539be216963b0886bc4aad91ac
MD5 01cfce12eab8ab041b6942b2e49fd1d6
SHA1 5ef8f81dd1ab4b12e7319009a0ee412ebff7c140
SHA512 3d91ada31290af4f2c720b1b9fd497417292aeb7969345a684815b6c422f9fd2004d93aa7acfcb10be0463a94f66af7887ae8d78ff77a6d96d65d74a1883e5f6
TLSH
T15DB09222A0A104AE10B48688C0618413F780CF0B22B10C43F0FBAE19227A8B26880F93
MD5 SHA1 SHA512 TLSH

Submit Download

data.json

Path C:\Users\Admin\AppData\Roaming\Script-Ware\data.json
Size 132B
SHA256 9ee7d32382cf67e66cb8d310ab8fa819430deaa749a00e80f269054e83c5eed5
MD5 5fab3f60f82b599aa18d76ef50e269ef
SHA1 7766b5d077c4da3d3a3f69b4b90bd72f9585576a
SHA512 8a3ca2cd474fac83d1c066571c6d3d6f397912b478603b11f17910f3467c61ae950d0080f6bbf46f4ba15b9d17bac5632cbaa7a295e67779db7061ec11715198
TLSH
T179C09B3290D144BF10B55548D0614413F740CF0B21710C63F4F76D1526799B25840F53
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5b244b63e77f097694709fd22b78309ada33772594b6290902efafb543d0615e
MD5 b29517ffa09105f98561200b9377bb36
SHA1 b2ba4469984e9fdd1fe57fb341ff30bb469a0156
SHA512 f6a0b6d4db92d288a0c744b3ecfeccd8df350a45f028a1ade63a1ae4a601b3c90bd829dd5283b3763a6201eee2a25c32e32b230a71a8a6e42ac3b07b5057da32
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bcdba8710b576f32599a6f82782a5fcfcdfd4fbf5011676e4f5446c389715dd3
MD5 b9798aabae55e5f174190a7e52eee668
SHA1 ba41f53ddc19172d5d5a9a9a871d8d6433b05250
SHA512 13d5b108c70c00118349c085cc5664f7c54c1e431e45fa1780809a97ef7e7adb706897854ba112c05e4b0c8b773364a7043e7352b52e1f684fde432bf3f1e7be
TLSH
T135D0123A33110234C4202073100265881845C50B40458440E428852D3E044500D06465
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 535B
SHA256 4174084aefb315876a889c677363a457ddc38d65f46ee55663bcb0db783a6f8f
MD5 ff1a2906513962237e21e0769dc8d280
SHA1 d5e6aaf6f3f4b3415b801cabc9a3c35212231eed
SHA512 802e8512d639399940eb8e864991ac312ecee1579b31fb02d7bf0915f8aec126f05296b3091c75fca1e82c897039b4d4ad4ab74cda38549603047f542f2fb19f
TLSH
T1F2F0C071D5D807BD459502E41B347867CD1E040642383D568EF5BB4F63E01F8D10014F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5fe9cc.TMP

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5fe9cc.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 bc33855d2792ebf41ac48f0617c9ffe3f2f8343512413da14821a9aa1aa1a9fb
MD5 9d18f9bd6096115c79fe499b314e020a
SHA1 e4b62c63ceec84b26be2c44bbf343c0a87d1c42f
SHA512 7a9f16ed2e5c87f4ac842bb4acd47107deb89286dcafb20725258d98da1032219febdce926979951ddba4245a32f6a793a88c17deeedd42fe8aea18cf5a5958a
SSDEEP 96:stZ/05+epd9b9+Fff0Z8i0vhEJkmsm/7qx+WVHMSm+uecaxgkQjZo+gw1KjMOB:stB0YNf8Z8pax1/S+Wi8xgknyyMC
TLSH
T15ED1B7475F2859778CCBF6197A35BB12E2F65022A2C04E98EBFC861C04E65DC534780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5f7122.TMP

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Default\Preferences~RFe5f7122.TMP
Size 6KB
SHA256 8893cf289bf89f0550b366c5b5d1e7e2001132c76c34ad11aed6a7a18fae58c5
MD5 1c73954e3a7b217cb5895c911886e4a6
SHA1 a3a108d00ac35005e02a0b5fb1834f5bea0bc5d2
SHA512 f975e5563e71f0fc81e12f739f331235ca8ac451467208872b8322b30e2c7388d1751dc1acde216969c20d85dfb76ffb2e8384fc01f2130c20e9836b24685b7c
SSDEEP 96:stZ/05+epd9b9vFff0Z8i0vhEJkmsm/7qx+WVHMSm+uecaxgkQjZo+gw1KjMEB:stB0Y0f8Z8pax1/S+Wi8xgknEyM8
TLSH
T13ED1DA475F3869774CC7E21DBA35BB42D2FA502262D44E98EBFC861C08D55DC534790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 e3cda7d693cb0f6022898b1d47e5ea2a835c6da4649822df8dd3e9a2f4c34749
MD5 a0a83cc14427126e08bef796783c6004
SHA1 0ad0f860bf99eb55991e4abb1ba4acea6540be74
SHA512 c275342aa2a5e28bae7338376488bb924008e67b6b65351bda7ceddc4f60060ee495133d5e47b253122b0e06fc7b84112bfae1485a382199daecd4a59737c04d
TLSH
T16D2187B7D49C5772ADC51A01B126BB062E90602AC701DE0CE0CD471C02FB4DC97B7C72
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 85a756b3d0c57cb9132da1b094382036fc282556b22be309833cbe40b1d17291
MD5 beebea09fa5b3c206487108cc9b49391
SHA1 6b8afc7fcc4d091b53ba4b96517c770a9fde6367
SHA512 15892809f6b4d196dd937589e7a61147b00dfe84894870b047c49b6351f371fdd763257a12f5b3546be1a4822a37c62740b08661c8d56eab9d4f4ff16451e5e5
TLSH
T1A231A9F2E5985732ADC1664171177F072E511026C701DE4CA1DE4B0C02F75DCA77AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 0d69958c46ad0f7d572180003411aad8ddd1bf8980279a2a585f616ad0e85aa1
MD5 e1dc16e2bf4f5f7f758d137b022665bf
SHA1 8acf1787e21a75f987b0b6ad44aa6a7f452608af
SHA512 a7abfbbc1e84d7393d2f938f5e1a8a755fffcd93aa4a4685f9535e78e9b1b1a97c9956202ecccd374b3f696fae5c5b59a31ebfed9fb7c30d8f2c7ba823e82cbb
TLSH
T16C51B7B3BD58973389E25A04B95A3F026E765126CB527F58A9DD0B0C01EB59C2392C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 19ee381bf930a27c42f4f0d4e4bb2e571aea31c9167b454e640d08fead70b193
MD5 cba14a16d9586f7e3e5ddd649edcfad9
SHA1 7721af95653a7b9a1423ea5520dff0de18d00088
SHA512 78918f48647a036a866ac9f64554af03adac3aa6fd0d2d5730f04ab95376211e9dbe393f6c3259ea011af6d2cf176eba3087abc8267e35e9cbd739e9446aa4c9
TLSH
T17F71C777A968D6374DE29E04B88A3F067AA15127DB817F98D9ED0F0C01DB6DC2392C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 801ed02fdd37d9363d305a2ba5f555e27a17bfd7c3ce4929cdd493082fa4b6e2
MD5 747a7b57b6c97fd043fd120a7c2bf4ac
SHA1 2e2e6450cdc20a750a75225c865dc9b288daedbd
SHA512 3476ec428f38bc449c2e3e9a870fd06f9be9eb398db0f3d08372a05b51baf3e8f54ee19dd8104306d3c44c8f4fc3275c0176fbf65986c5f5ac06f59cc04aa35e
TLSH
T13271D977A964D6378DE29A05B88A3F027AA15127D7857F9CD9ED0F0C01DB2DC2392C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\Script-Ware.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 5c25ee64bfa80c4146cab00fc5baf2a21f1a8fbaaab5452c89fda3aa72c6f33a
MD5 de5547458e763aba8a52a30627a5b528
SHA1 9186f6fca81cee3c6f9a77011f96c35e7c11e6df
SHA512 c879db3d60427c874e5c14dc83f275cd8d85a28ae57302d3364bd8e0e61666fab92b87b6694a3366f498f8c9c09ac6bf651c6b08eff897c5c08d4730c56de0d1
SSDEEP 384:zj+aQikB+z/xvxjg/qhEwNbcG4eXwywz9z4:m/UxvxjgC+wjXwyYF4
TLSH
T12272AF3F59686E2399F2FA047A5D170B9AB88472C1C27ABC4EFD5F0D06CB2D81342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Decompiler.exe

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\bin\Decompiler.exe
Size 9.4MB
SHA256 fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8
MD5 a109790efbe0542dddf63ef0415dd508
SHA1 34d3f0c57dd5359f21bee246e00ee01f69132678
SHA512 a148f1b6a5423147651ab12fad0250ff000efb605e7d468fa45d1e1c1bba71bf2748741d9e62aa72228b9e674d3766d736df64e81b85c9d441e840e0bed75d7f
SSDEEP 49152:AhW7+AqGnMYHZi0h/tipa/lZ9dco869rpyd8cuIhwSt+AOaQXkiShcwaPJXqlExR:UkDPUKXmtGYGz2YhN
TLSH
T124A6C62A676960D9C1BFC07892839F22BD21749D073977F7898182692F20EF87D3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

current_version.txt

Path C:\Users\Admin\Downloads\Script-Ware\Script-Ware\bin\current_version.txt
Size 5B
SHA256 813b231f281e55d9af5ea2364998b4d88d5d8c59158214c140f2d0f812d36d5d
MD5 7178aad20a4973a4eef42fc1a0145061
SHA1 0992c0f451ab473f8f11480b130bb4f1092476a6
SHA512 83b27147a701dadabe61904de646636c4e0346aa13605a55616293a598f78384ad4100bbd62a4eee237943f4433ed56adf7131cbee69054e66d1b414283241aa
MD5 SHA1 SHA512

Submit Download

memory/3788-863-0x0000028491370000-0x0000028491371000-memory.dmp

Download

memory/3788-861-0x0000028491370000-0x0000028491371000-memory.dmp

Download

memory/3788-862-0x0000028491370000-0x0000028491371000-memory.dmp

Download

memory/3788-852-0x0000028491370000-0x0000028491371000-memory.dmp

Download

memory/3788-860-0x0000028491370000-0x0000028491371000-memory.dmp

Download

memory/3788-858-0x0000028491370000-0x0000028491371000-memory.dmp

Download

memory/3788-857-0x0000028491370000-0x0000028491371000-memory.dmp

Download

memory/3788-853-0x0000028491370000-0x0000028491371000-memory.dmp

Download

memory/3788-859-0x0000028491370000-0x0000028491371000-memory.dmp

Download

memory/3788-851-0x0000028491370000-0x0000028491371000-memory.dmp

Download

memory/3936-288-0x0000022ED0470000-0x0000022ED047A000-memory.dmp

Download

memory/3936-291-0x0000022EEA6D0000-0x0000022EEA6DA000-memory.dmp

Download

memory/3936-289-0x0000022EEA6B0000-0x0000022EEA6C8000-memory.dmp

Download

memory/3936-285-0x0000022EEA680000-0x0000022EEA69A000-memory.dmp

Download

memory/3936-284-0x0000022ED0510000-0x0000022ED0518000-memory.dmp

Download

memory/3936-282-0x0000022ED0430000-0x0000022ED043A000-memory.dmp

Download

memory/3936-283-0x0000022ED0440000-0x0000022ED0468000-memory.dmp

Download

memory/3936-281-0x0000022ED1DE0000-0x0000022ED1EA2000-memory.dmp

Download

memory/3936-280-0x0000022EEA750000-0x0000022EEAB8E000-memory.dmp

Download

memory/3936-279-0x0000022ECFCA0000-0x0000022ED0080000-memory.dmp

Download

memory/3936-286-0x0000022ED0480000-0x0000022ED048A000-memory.dmp

Download

memory/3936-293-0x0000022EEA6F0000-0x0000022EEA6FE000-memory.dmp

Download

memory/3936-287-0x0000022EEA6A0000-0x0000022EEA6A8000-memory.dmp

Download

memory/3936-294-0x0000022EEADB0000-0x0000022EEAE52000-memory.dmp

Download

memory/3936-292-0x0000022EEAB90000-0x0000022EEADAC000-memory.dmp

Download

memory/3984-332-0x00007FFCFF6E0000-0x00007FFCFF6E1000-memory.dmp

Download

memory/5284-418-0x00007FFD00AD0000-0x00007FFD00AD1000-memory.dmp

Download

memory/5284-416-0x00007FFD00AC0000-0x00007FFD00AC1000-memory.dmp

Download

memory/5444-457-0x00007FFCFF6E0000-0x00007FFCFF6E1000-memory.dmp

Download

memory/6112-297-0x0000029C1C630000-0x0000029C1C64E000-memory.dmp

Download

memory/6112-295-0x0000029C03D20000-0x0000029C03DE2000-memory.dmp

Download