280d161d675098b8eb49f4195afd5988bf3b91359c0a2735358c46135568dccd

Analysis

max time kernel
299s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO 47032.js
Size 1.3MB
Sample260730-e6v9vabg54
SHA256 280d161d675098b8eb49f4195afd5988bf3b91359c0a2735358c46135568dccd
MD5 d80f1c1aeaaa129382f671da1199eaa8
SHA1 ab9e4b77397d375af71f7cdc6df3702af06ff941
SHA512 61cfd285fcc7adf449ff3f681afa161ac270d6c7978fde8b82f0684787b8732f42ab79f2b0a42b08df04b603007af7ed7dd5ac72a9a0896cae137a99149a959d
SSDEEP 24576:Ry1CNC7pFChbCEmbI/ztxr1vx7dm0lltEjFhws+jQqz9Y2G:cP7pFVErz3LhUpqR0
TLSH
T1AF5523342442EC3A17EC9337372B6BB5D1A94ED1600CF505B1C2A6B6629BF23D9F281D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2320	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\prevhost.lnk	prevhost.exe

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2572	chrome.exe
5604	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6864	chrome.exe
6864	chrome.exe
6864	chrome.exe
6864	chrome.exe
6864	chrome.exe
6864	chrome.exe
6864	chrome.exe
6864	chrome.exe
6864	chrome.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe
6964	prevhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeIncreaseQuotaPrivilege	2320	powershell.exe
Token: SeSecurityPrivilege	2320	powershell.exe
Token: SeTakeOwnershipPrivilege	2320	powershell.exe
Token: SeLoadDriverPrivilege	2320	powershell.exe
Token: SeSystemProfilePrivilege	2320	powershell.exe
Token: SeSystemtimePrivilege	2320	powershell.exe
Token: SeProfSingleProcessPrivilege	2320	powershell.exe
Token: SeIncBasePriorityPrivilege	2320	powershell.exe
Token: SeCreatePagefilePrivilege	2320	powershell.exe
Token: SeBackupPrivilege	2320	powershell.exe
Token: SeRestorePrivilege	2320	powershell.exe
Token: SeShutdownPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeSystemEnvironmentPrivilege	2320	powershell.exe
Token: SeRemoteShutdownPrivilege	2320	powershell.exe
Token: SeUndockPrivilege	2320	powershell.exe
Token: SeManageVolumePrivilege	2320	powershell.exe
Token: 33	2320	powershell.exe
Token: 34	2320	powershell.exe
Token: 35	2320	powershell.exe
Token: 36	2320	powershell.exe
Token: SeIncreaseQuotaPrivilege	2320	powershell.exe
Token: SeSecurityPrivilege	2320	powershell.exe
Token: SeTakeOwnershipPrivilege	2320	powershell.exe
Token: SeLoadDriverPrivilege	2320	powershell.exe
Token: SeSystemProfilePrivilege	2320	powershell.exe
Token: SeSystemtimePrivilege	2320	powershell.exe
Token: SeProfSingleProcessPrivilege	2320	powershell.exe
Token: SeIncBasePriorityPrivilege	2320	powershell.exe
Token: SeCreatePagefilePrivilege	2320	powershell.exe
Token: SeBackupPrivilege	2320	powershell.exe
Token: SeRestorePrivilege	2320	powershell.exe
Token: SeShutdownPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeSystemEnvironmentPrivilege	2320	powershell.exe
Token: SeRemoteShutdownPrivilege	2320	powershell.exe
Token: SeUndockPrivilege	2320	powershell.exe
Token: SeManageVolumePrivilege	2320	powershell.exe
Token: 33	2320	powershell.exe
Token: 34	2320	powershell.exe
Token: 35	2320	powershell.exe
Token: 36	2320	powershell.exe
Token: SeIncreaseQuotaPrivilege	2320	powershell.exe
Token: SeSecurityPrivilege	2320	powershell.exe
Token: SeTakeOwnershipPrivilege	2320	powershell.exe
Token: SeLoadDriverPrivilege	2320	powershell.exe
Token: SeSystemProfilePrivilege	2320	powershell.exe
Token: SeSystemtimePrivilege	2320	powershell.exe
Token: SeProfSingleProcessPrivilege	2320	powershell.exe
Token: SeIncBasePriorityPrivilege	2320	powershell.exe
Token: SeCreatePagefilePrivilege	2320	powershell.exe
Token: SeBackupPrivilege	2320	powershell.exe
Token: SeRestorePrivilege	2320	powershell.exe
Token: SeShutdownPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeSystemEnvironmentPrivilege	2320	powershell.exe
Token: SeRemoteShutdownPrivilege	2320	powershell.exe
Token: SeUndockPrivilege	2320	powershell.exe
Token: SeManageVolumePrivilege	2320	powershell.exe
Token: 33	2320	powershell.exe
Token: 34	2320	powershell.exe
Token: 35	2320	powershell.exe
Token: 36	2320	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4240	chrome.exe
4240	chrome.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 2320	4336	wscript.exe	90
PID 2320 wrote to memory of 3964	2320	powershell.exe	94
PID 3964 wrote to memory of 4772	3964	csc.exe	95
PID 2320 wrote to memory of 6964	2320	powershell.exe	96
PID 2320 wrote to memory of 6964	2320	powershell.exe	96
PID 2320 wrote to memory of 6964	2320	powershell.exe	96
PID 6964 wrote to memory of 4240	6964	prevhost.exe	97
PID 4240 wrote to memory of 6364	4240	chrome.exe	98
PID 4240 wrote to memory of 6480	4240	chrome.exe	99
PID 4240 wrote to memory of 2572	4240	chrome.exe	100
PID 4240 wrote to memory of 6864	4240	chrome.exe	101
PID 4240 wrote to memory of 2764	4240	chrome.exe	102
PID 4240 wrote to memory of 504	4240	chrome.exe	103
PID 4240 wrote to memory of 6648	4240	chrome.exe	104
PID 4240 wrote to memory of 5728	4240	chrome.exe	105
PID 4240 wrote to memory of 6028	4240	chrome.exe	106
PID 4240 wrote to memory of 1984	4240	chrome.exe	107
PID 4240 wrote to memory of 6804	4240	chrome.exe	108
PID 6964 wrote to memory of 6864	6964	prevhost.exe	101
PID 6964 wrote to memory of 6864	6964	prevhost.exe	101
PID 6964 wrote to memory of 4432	6964	prevhost.exe	110
PID 4432 wrote to memory of 1316	4432	msedge.exe	111
PID 4432 wrote to memory of 3700	4432	msedge.exe	112
PID 4432 wrote to memory of 5604	4432	msedge.exe	113
PID 4432 wrote to memory of 4144	4432	msedge.exe	114
PID 4432 wrote to memory of 6052	4432	msedge.exe	115
PID 4432 wrote to memory of 1196	4432	msedge.exe	116
PID 4432 wrote to memory of 4584	4432	msedge.exe	117
PID 4432 wrote to memory of 5520	4432	msedge.exe	118
PID 4432 wrote to memory of 4516	4432	msedge.exe	119
PID 4432 wrote to memory of 1136	4432	msedge.exe	120
PID 4432 wrote to memory of 6368	4432	msedge.exe	121
PID 4432 wrote to memory of 4316	4432	msedge.exe	122
PID 4432 wrote to memory of 6688	4432	msedge.exe	123
PID 4432 wrote to memory of 4136	4432	msedge.exe	124
PID 4432 wrote to memory of 6704	4432	msedge.exe	125
PID 4432 wrote to memory of 4772	4432	msedge.exe	126
PID 6964 wrote to memory of 4136	6964	prevhost.exe	124
PID 6964 wrote to memory of 4136	6964	prevhost.exe	124
PID 4432 wrote to memory of 4244	4432	msedge.exe	127
PID 4432 wrote to memory of 5648	4432	msedge.exe	129

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\PO 47032.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "iex $env:WJTMEHLRG"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\04q5fcuy\04q5fcuy.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES749A.tmp" "c:\Users\Admin\AppData\Local\Temp\04q5fcuy\CSCF242C0C1BD4F4F6AB6D9D2705B84A97C.TMP"
      4⤵
      PID:4772
- - C:\Windows\SysWOW64\prevhost.exe
    "C:\Windows\SysWOW64\prevhost.exe"
    3⤵
    - Creates a file in the Startup directory
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:6964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4240
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbb622c728,0x7ffbb622c734,0x7ffbb622c740
        5⤵
        
        PID:6364
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,8719396659611784633,14701020758669268694,262144 --field-trial-handle=1892,i,16702337374422153930,17154482441818722439,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
        5⤵
        
        PID:6480
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch" --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,2187509355285606768,15592892870402064936,524288 --field-trial-handle=1892,i,16702337374422153930,17154482441818722439,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2572
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch" --force-high-res-timeticks=disabled --metrics-shmem-handle=2120,i,4827596876295388626,1502419287586602800,524288 --field-trial-handle=1892,i,16702337374422153930,17154482441818722439,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:13
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2956,i,657839762545883506,9736963636878889330,2097152 --field-trial-handle=1892,i,16702337374422153930,17154482441818722439,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:1
        5⤵
        
        PID:2764
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2960,i,16051537927197138066,3302360796806763768,2097152 --field-trial-handle=1892,i,16702337374422153930,17154482441818722439,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
        5⤵
        
        PID:504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3212,i,6813358800807997956,2476978395702595032,2097152 --field-trial-handle=1892,i,16702337374422153930,17154482441818722439,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
        5⤵
        
        PID:6648
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3236,i,15676068101660494308,3798593389700943729,2097152 --field-trial-handle=1892,i,16702337374422153930,17154482441818722439,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:9
        5⤵
        
        PID:5728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3892,i,6684603892046901833,2932683887340283868,2097152 --field-trial-handle=1892,i,16702337374422153930,17154482441818722439,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:9
        5⤵
        
        PID:6028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch" --force-high-res-timeticks=disabled --metrics-shmem-handle=4296,i,10163042057652830013,2372482615577196272,524288 --field-trial-handle=1892,i,16702337374422153930,17154482441818722439,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
        5⤵
        
        PID:1984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4360,i,4775597195864655018,12822414942792571828,2097152 --field-trial-handle=1892,i,16702337374422153930,17154482441818722439,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
        5⤵
        
        PID:6804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z"
      4⤵
      Enumerates system info in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffbb25ac188,0x7ffbb25ac194,0x7ffbb25ac1a0
        5⤵
        
        PID:1316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1864,i,7784124506403671373,6855813064956668858,262144 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
        5⤵
        
        PID:3700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,13633306192098363844,17896812497256772350,524288 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,4040167387128972757,11467552680933555909,524288 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
        5⤵
        
        PID:4144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3292,i,4957241687171225629,580919534705691292,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
        5⤵
        
        PID:6052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3296,i,17738395191105520051,11475806078904109761,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
        5⤵
        
        PID:1196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3724,i,16604376094650370022,8933734783349638963,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
        5⤵
        
        PID:4584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3740,i,1020498993443889854,9657180464708645012,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:9
        5⤵
        
        PID:5520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3796,i,4161314445011200594,3883738302480264213,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:1
        5⤵
        
        PID:4516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3848,i,13712704890439072595,8619296208437019663,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:9
        5⤵
        
        PID:1136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3860,i,6164083617072511420,6229302224706225978,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:1
        5⤵
        
        PID:6368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3888,i,10600672971971770412,10221447965237591924,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:9
        5⤵
        
        PID:4316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3924,i,15884608520668202936,18322847760909317836,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
        5⤵
        
        PID:6688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3936,i,13304356979336076795,6740776079507579590,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
        5⤵
        
        PID:4136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3980,i,9897273373190783623,10894090916779880150,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
        5⤵
        
        PID:6704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3984,i,15735157346262281990,9655418691696663927,2097152 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:9
        5⤵
        
        PID:4772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,9839364253140099337,4802817603239060805,524288 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
        5⤵
        
        PID:4244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,18204076979507331344,13444061111919675783,524288 --field-trial-handle=2364,i,18376971873808187290,18163402390244335985,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
        5⤵
        
        PID:5648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4728

C:\Windows\SysWOW64\prevhost.exe
C:\Windows\SysWOW64\prevhost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04q5fcuy.dll

Path C:\Users\Admin\AppData\Local\Temp\04q5fcuy\04q5fcuy.dll
Size 3KB
SHA256 a0d23ceac1522f3844499e84ece3493bb403e292910e35453fb87e39d007bb2e
MD5 854c7b803108ec6e14c4262d1f0bed89
SHA1 3eede5326c5a70d59d439e4c73f72d5edbcbbb82
SHA512 fe6910625bb04776fc411775ca75b4bc7408bc8b6b263ab327f76c7d83c08dfec91607407a3ef576671d8470e7eb198d6fe65051962845f276f744f19acac5db
TLSH
T15371D01BD7E4452BE4BA0738AEF3431717B4F8649F73936E5A5002192C607645A31FA0
MD5 SHA1 SHA512 TLSH

Submit Download

RES749A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES749A.tmp
Size 1KB
SHA256 c92e0fa7ace777cb23ef0905fc7abaaf43c00ec0abb9b3634adce347fb5c573d
MD5 bce452f32bf24c4b073e22f6c220bf1f
SHA1 b6f50c3af28146d49e4dde8082dfc6c94ff11ee0
SHA512 5f75b736c6832fc42676d73310822cb77faec1f193e57b0c3364de4a6b5ee6dbf817b07b6b9a6c38c51776baf1aad8dbb40cc582f34e97e21549a4410d27090c
TLSH
T1C7216A0593E8870BF0735731BAF5171FA679FD65EF62535A854042282C51504EEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Crashpad\settings.dat
Size 40B
SHA256 dddcf8029bdbaa7f73477f4376f956bea40b0405f3418bdf33a0da1534ef3690
MD5 dcc6cc95b413cb91d80e4eb63e07d664
SHA1 7a1f4fdfcfd626ce9152c509b38fb88e1048f7af
SHA512 d04c1553a792c37b8a325ebb62cb7b4031f5b5340ebf4ecbd6f9a7917576116f057041dc2c6f63f932502beff89b895462d894edc75bf87fa1f402fe1ee83771
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 bb32505432857d3612ae42bb8bc7df09ba8db05473dfc62472a22a5c0d07dfe4
MD5 07a90b467ee2e48219c3befcecac5193
SHA1 5b9e81358e080591f0d39abf348198ab43bd2d57
SHA512 9580984ce4f48699473723b20d022ad6089131bff3e2b8f3a10c166c0978089ff9aa856e04b5c505f2da365a1bbc947f082930258d5130337019f6dcade074e4
SSDEEP 6:/FoEXEfuiKkNk8YrU2lmDuoOpm7849k67GmKKtnH2Qq+hhvOXfw:d7X+vNkv8Sb4ukH
TLSH
T15413A7BC6D47CCD6C288147E6C4F1BFC7BB2DD88E516435303B2312CE5C8350100A554
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 7c6b440ff126da5ef0febccda3e773afb10916e369c1ca87967e395316cbc66a
MD5 8233183e0ba1a6c0e74e2726635791ea
SHA1 335f12db68388057dfff2e0a9edf5f21885abbcd
SHA512 43918bfcef641094bc60f44768c03888ecddb7577256d5e6ef7a6b5d3b3cfa4ef8c5589375d35f403fb291fea303cd697044c95ef17a319a959abfc066768e31
SSDEEP 48:mol5s8YT6P3zlblQ2m3SM1Xg/weZ7MmX4I1Xx5dVEPLVBKWwtl:J5MTIhblQXSugoeZ7jT1VOLHKWol
TLSH
T1C644A9F72D05EEC2EA18CAB85C41923C8E3246263C5AEE79F27944A255505F731285B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 703befa405f7a8660ad2a82ca9b7b2e55afa5996f9f76a6338e27614d7184083
MD5 b054785af1e296c2f3ecd5b70282100d
SHA1 3a291b39250e9959d4a319e26891255cf463ff91
SHA512 904bda91ec6dfe72148f3732f75e8df6aedecdc38511da394c0d83b4d7e938a504994ee09a306297ef009aa345c66f6d29fb87ccd2662c0007a7d2a199a0ef47
SSDEEP 768:GUfDPLSgcRUv+X4kUfDPLSgcRUv+M4AUfDPLSgcRUv+d4F2ZfDPLSgcRUv+B4E0r:cMVyYz7zdCSzQz
TLSH
T1E4164DB74F68B946E781EFB0BBC9ED1C3CB023C6ED935892E512926949E0FC4178511E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 d1be2d56b6a31b214656a3b6b642d7bd33236643e32c197e1391df2506c7f782
MD5 a6a2715e8aac0bc65e1ebe68cd2fcd88
SHA1 be90631a3d726f549eb49b5bce2729033cc203fc
SHA512 f44c293b580af02d1d2d8ae1e0d1e9ff9d03b81fd24f7c1dff7d56b0bf06dbd72038144b2cabfaa6e9bf030a0829aa412d222888ca0960ef379b9d0d120d80a1
SSDEEP 768:DaT6qaZmTMXoQ+IN8t7bXGt9LcDRmbUhN/RuLs4pKARGu1Rr04nHuk:Dk6qacgXoQ+v+L+RmbIZuLsyH5nHuk
TLSH
T16B03F1F261532AEB4D228CE2F19DEA7FBD73C649CAF8EBCC620564067407E750694642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Cache\Cache_Data\f_000002
Size 70KB
SHA256 202f6947db28f364478faf1adfb51acbf040157ef4a3e26404b8f1075a0c5d8f
MD5 1f5c87e7e976d26a5d082bfbbb43e5cf
SHA1 25f240f331ff78dc584b3fc047eb9df63034d1b9
SHA512 7d7d174dc67deb8730918f064638cf9cf1bbaf6f2e7d04215b5a6977f940acd9143e2a299afa594f98d1cf6b3dcc15d729b321eb0e77a331a14008fa4d2d91f5
SSDEEP 1536:DGgRo2P4EXELm9zQFG44t0kgAoSuEhsqjwKELAr4Nvoygkm1A7vWPmQ7P:DGg5P4GE8zQFGhYE/EcUNvo0v4D7P
TLSH
T1496302E1CCF31F1103EDD73516A1556CE09EEA7B28E750D7B111B658862B34F9C90E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Cache\Cache_Data\index
Size 256KB
SHA256 6571024f0f02de1de87b471f2f6ad6f7297cc36b672165ba038578ae669be802
MD5 b03ac336e36f629eeba555eb526d7f70
SHA1 a717a84eadd6c12fcb25f3c5cdfb6cde0d96872a
SHA512 692d709a528bc2a7a4aec3fc3fed63b5f2b571105fb0bffad76a28245f9468e43232e869dd4a1bd1d7476e53ee47263bb9023ab8ff49cfa6cbb3accd0a4ae00c
SSDEEP 3:LsLllFlklNllklkXlH7HGA1Sllx/nN/JNtlmNtlZlglNlXlME/:LsRa3lPH7HVIpRkNHE
TLSH
T1D344016F57958E4AC6C126FC9C838BA5B734D595DB9B8343438466241CC17A12E1F8A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 6a1d33a743409a7d5ebe8a2885ee7b99de8c6b37101fde5d3d1d9efd38bf9f4c
MD5 7cf90e91d133d43878d0be8e56efbf87
SHA1 d2fe85f5ce05b0627d6b92ba44b92718ebc2c6c7
SHA512 c9ac22c8faa6f71d82ae44b27ab9319164c1f2164b41ad9f51b357e9bac438f999d5cc9949fbdde0724a10482550ca539901160500af1fdc77730a264259a40f
TLSH
T135E02B81C24C1F0DD33D96F7CDB643054B0B42C42ABE3A03A882C2C273164241248123
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 a296dd7a51240449f9ea5027a48d556f7787e1e6cb3dcbd9210e1a7265ec8009
MD5 774c10e290390e900d3ec46c9c346541
SHA1 be1ac6550ef13c49c9964d892c49e2e4e7f1f913
SHA512 aba18406619a32e640602269a871f04d3f5ba7018f4f4c06ab1922c34471151a2b7c5ffa3f0dc4a6984572552d99587471f51ea52cc98a1dc96a61e2e0c5f390
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\DawnGraphiteCache\index
Size 256KB
SHA256 434c55f2c766a871785d6e4caf5b8a9545f329c36c65444130975607d1a46887
MD5 0c4ebbb08057b178403486053ada2571
SHA1 13a14d79332cea8ad3a00d5506af455e2d863f01
SHA512 9eacdfb8332f1aa21aa26ecc98625c0d8a93e699166303b5a9f737e9a215f205b13edfb4b06372f6810415934c64aefa01f98a1ba6022681633d55eaeedf8a69
SSDEEP 3:LstlNllklkXlAgPu:LsX3lPAgm
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\DawnWebGPUCache\index
Size 256KB
SHA256 1ec4430701406489594f9222dc0bdb6381d1dea4c3f5d82c7910570cae04acbe
MD5 ff1a54fa89b86b25f184b043580f4720
SHA1 0aacbf09242e954869e9ce8c6b39813c163b9d11
SHA512 8bf3066f472849fd50342ecaf643c99147046e1b4dbf7cf02ae874fa6850e2f2cf365bf31573cd147836d7c4ed9b9361c3c60e0cc7ed3bb66ae726d6bcfdb29c
SSDEEP 3:LstlNllklkXlM+/:LsX3lP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Extension Rules\LOG
Size 265B
SHA256 6e732fc2df77058ecb539f3fd06cdda63d3ce08bbe169524586e0b26374af5c3
MD5 d6bf399f93d6e9b83f2c9e95fa878a23
SHA1 9e8b92a72ca3569659acf4e4fc119876aed5b1d2
SHA512 2390b7d0ad0ba6d956079abbfaa21140a75685c9b89bbda72be4e5a1f2afe3fedffdbc2c0d7425446a0155a1ddf6e92a748e0647a9916d856a957fd08c6173c2
TLSH
T115D02B119C86C2EA0638B6A6C5A4A34AC6356D0CF78C37050F3DEA4C305244D9288384
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Extension Scripts\000003.log
Size 76B
SHA256 cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a
MD5 cc4a8cff19abf3dd35d63cff1503aa5f
SHA1 52af41b0d9c78afcc8e308db846c2b52a636be38
SHA512 0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Extension Scripts\LOG
Size 269B
SHA256 e5d81e1ea72a73e0e26c9f25f4fd75316c57176716aefe7a1447a21f5a0b1053
MD5 e78973faeb01b178642ff5393d79bd67
SHA1 d3e6d65c7ecfd0beda4684c1e311157781f7781d
SHA512 1d6f141bcc1c248f104deb8ef50233567b5b209a437efec0b85cfa9b0a75cd07d76ca874df432c5979bdcf528b7c0629949c8feca4cff40d5aadbdd4bceb7dc9
TLSH
T101D02B149CDAC2B60638AAE78575B35EC6757D08F7C877050F3DDE0C2056548D644B80
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\GPUCache\index
Size 256KB
SHA256 75eef6044bc6962a667539230f94d99ff3b612a3ce874641d0ec34eeed127335
MD5 041a1584f413b23710bef4c14af3f8d4
SHA1 7fedeee27cb25f149988fee06cfed3de62787d63
SHA512 4bbf2f5ce9474c0b1001d27cf9f9ef919870e9e7602bb856764ea1c587634834c69bdf9f5596bc8bd09e213ccb82f142ebf9118b917612ed9cd9b56ab72d0d71
SSDEEP 3:LstlNllklkXlXDTu:LsX3lPXDTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Local Storage\leveldb\LOG
Size 279B
SHA256 c10645ca267839d2446faa40acd16212d58665ab8813b6d2789ae213f2d51c12
MD5 3e2d0224a2cf67131a657d0573b883dd
SHA1 8a472c5bd7d632a29c7b95c5029dec61c5a96448
SHA512 e577d32d0dc5c3632ba7a9e79c5b6354fb7ba748037d03dfe508e8de94aa99de617fa1b16617cee428d89f284bba15657002ad635259d0abc2f1e2724ae3220b
TLSH
T165D0C2A08A8BC16A0369516F9525B38EC734680CFB8C3B064F55FA0CB486458C7C02C3
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Network\Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Network\Reporting and NEL
Size 36KB
SHA256 473cee21f162f3a7a25635fadf8a9264238ac53cf89f7bb67ede9fbcdc676cfc
MD5 56e8276cedbc027359e31311dd2f91ed
SHA1 5aead8213b1fdeb895b9d51975126c5527ed8949
SHA512 c6ae5450f3ec31cb87fe6deb33b79c9c7919f637343e93cd0866d52c9fdaf674ab82eec261d77aeb0da4a5ed9f2960431657474cde55067a8b49c58c5a12888b
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:uIEumQv8m1ccnvS6
TLSH
T195F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\b5xyhfon.fch\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z\Crashpad\settings.dat
Size 280B
SHA256 0ddfebbeb9bef7637a9b563cb955ea945e638ecd1d352e247461ee67cf96543d
MD5 c1113d2181b9daeeb7fb3872739d3506
SHA1 d13df62cc1a1dcd49032c4ca336771f7777c95cb
SHA512 d7b3a0fa3f83bd87bbc7917521f535a449072627f94254c0e90e15cd2feff22aadbefc25264eb6cbeb9ce425ba6561526a4e9b9ba2cc6f9de56049fd1ace6e18
TLSH
T172D0027173DE9348D79439F794AB4F290709CC075F8322A68630E34C5EB60901F5158A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z\Local State
Size 3KB
SHA256 494a07c7110d336568dedfcc2f565945a94a28636432977d364e8eb68ab53d04
MD5 ca890d18bf8e5821f41daf034075e2d8
SHA1 637f25f12a3e515c746421be06b710662394531e
SHA512 11bf76d5e2d3372bc5914b2bbcccfd2fb41a9b9ed5ea942414d85a783125817bf67cf6b68ff059fabd2fe72c91559976f36df18e170c719c756a2eb147e301d9
TLSH
T14281D9B36524EC3355E52945F59A27A35E783173DD4AFF49E2C9130C04EB2582B8A827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z\Local State
Size 4KB
SHA256 a011c110c19d74701126720946fc28ced686de7a51a458a1a0dc9c2db8c767ee
MD5 ae8e5938c799f9833bfbc390aebf4f57
SHA1 e5328d94bca737b9a2625e35349391976dc9bca4
SHA512 ca0b7e4198d30590e3563a816d8c9e22878b42fd8deabbd9a6d60089c33291248cc8e085e9e99a1c21d073f2e6d03e0f7de9bc1b3835884063bdbe5cd550808e
SSDEEP 96:MqGNkPQsFfddt58Frh/cInURoDotov0TNDqtBtNv2Nt0Ro0eUnSuzoJqq4a:XGNr4CooDUwCVqzw0RoqSuzE
TLSH
T1F6A1D7B66524EC335DE56905F9CA27536EB42133E889FF89E2D9170C04DB3981786C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59a1b5.TMP

Path C:\Users\Admin\AppData\Local\Temp\lxt55zvv.d2z\Local State~RFe59a1b5.TMP
Size 1KB
SHA256 4385586c3ea917e89ab9c5b72c719a17521f033490be62a0e8de02cc1feed899
MD5 6c92414d76ab0abf1244cfed0624a253
SHA1 882cb078d64cdc91354108b15e6ded8e7b30e04f
SHA512 f9972a735b9ededc017616fbd2f1c51d088d16ea80b4e691b755b1a21fe34ed4eac54318bc786eb5c99911c0949ea71122eb942930b535aa7d32297934dbbd3c
TLSH
T1713197F675585C73ECE01A4BF34EAF632E746532D156AA4892EE120C05E75CC1786C3B
MD5 SHA1 SHA512 TLSH

Submit Download

04q5fcuy.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\04q5fcuy\04q5fcuy.0.cs
Size 409B
SHA256 9703ee3055643800f34b0d4c82ce6d726ff7c8a814a758c722a5b8c9a3ffce94
MD5 fce4679c1e69227f87cf37aec283b6fb
SHA1 377276f726ed7c5f5b4345782220c6763925243f
SHA512 a037f2c47bf35ab938031db721d66b6631234abf0b26f0d530c909b284c9144ccaf60985c075f740830b59493c329ec05761adf5f4a3c063d226cce5007046e5
TLSH
T152E02B981B52D61828E39E1F4EE9D36DE773F4B42BFC28105BB905124E46807437BB12
MD5 SHA1 SHA512 TLSH

Submit Download

04q5fcuy.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\04q5fcuy\04q5fcuy.cmdline
Size 369B
SHA256 5f4a1c78ce2534bb7612d7b3b152267c0d9115cbf49e18665d262b8cffb5498e
MD5 1407249101b88469fd65ba52f798eee7
SHA1 113eb753319bef6a74d5dd6af6d998bb70a37abd
SHA512 35cdc0e07f0d377289a4f53751c9e7e65c7d9f1e0c702e087c91723a6f746afc155340db3aa611f1e72997b9e931e85c7d8425e846a2e41185c2f51a1291dd4c
TLSH
T139E06F2A6686C27D01FA104B2B6AC9AC83720A8329803F88E040840DF027000FBE27A1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF242C0C1BD4F4F6AB6D9D2705B84A97C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\04q5fcuy\CSCF242C0C1BD4F4F6AB6D9D2705B84A97C.TMP
Size 652B
SHA256 273ae2ed60e6019d4e3a53631579fa08690d64a8239b3bcb563108c048b3a56f
MD5 af8ce8673968d231011dca165b9e0881
SHA1 da413751006a70e395aa6317b7662a433d680184
SHA512 2e0d8a0968e8160f1e68d4c8dbb486830d9866eac0c19ad9bf292d103ddc83cddb9b9c8833079626af72aef340f281de8993ea78a7295ac7727eefadd925f569
TLSH
T116F0820AA3F8420EF0F34B30BDF6436795A9BC65DE3293ED5440031D2C649148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2320-27-0x00000000745C0000-0x0000000074D7C000-memory.dmp

Download

memory/2320-13-0x0000000007890000-0x0000000007F0C000-memory.dmp

Download

memory/2320-54-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2320-1-0x0000000002D70000-0x0000000002DA6000-memory.dmp

Download

memory/2320-2-0x0000000005540000-0x0000000005B8A000-memory.dmp

Download

memory/2320-3-0x00000000745C0000-0x0000000074D7C000-memory.dmp

Download

memory/2320-60-0x00000000745C0000-0x0000000074D7C000-memory.dmp

Download

memory/2320-4-0x0000000005360000-0x0000000005382000-memory.dmp

Download

memory/2320-6-0x0000000005C00000-0x0000000005C66000-memory.dmp

Download

memory/2320-64-0x00000000745C0000-0x0000000074D7C000-memory.dmp

Download

memory/2320-5-0x0000000005B90000-0x0000000005BF6000-memory.dmp

Download

memory/2320-8-0x00000000745C0000-0x0000000074D7C000-memory.dmp

Download

memory/2320-7-0x0000000005D90000-0x00000000060EB000-memory.dmp

Download

memory/2320-11-0x0000000006250000-0x000000000626E000-memory.dmp

Download

memory/2320-12-0x0000000006290000-0x00000000062DC000-memory.dmp

Download

memory/2320-53-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2320-56-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2320-48-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2320-47-0x0000000007620000-0x0000000007628000-memory.dmp

Download

memory/2320-46-0x00000000075C0000-0x00000000075C8000-memory.dmp

Download

memory/2320-33-0x00000000083C0000-0x00000000083E4000-memory.dmp

Download

memory/2320-32-0x0000000008390000-0x00000000083BA000-memory.dmp

Download

memory/2320-55-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2320-14-0x0000000006780000-0x000000000679A000-memory.dmp

Download

memory/2320-30-0x00000000745D2000-0x00000000745D3000-memory.dmp

Download

memory/2320-31-0x00000000745C0000-0x0000000074D7C000-memory.dmp

Download

memory/2320-29-0x00000000745C0000-0x0000000074D7C000-memory.dmp

Download

memory/2320-28-0x0000000008060000-0x0000000008071000-memory.dmp

Download

memory/2320-0-0x00000000745D2000-0x00000000745D3000-memory.dmp

Download

memory/2320-26-0x0000000007870000-0x000000000787A000-memory.dmp

Download

memory/2320-25-0x0000000007750000-0x00000000077F3000-memory.dmp

Download

memory/2320-21-0x0000000070AD0000-0x0000000070E2B000-memory.dmp

Download

memory/2320-24-0x00000000076C0000-0x00000000076E0000-memory.dmp

Download

memory/2320-20-0x0000000070810000-0x000000007085C000-memory.dmp

Download

memory/2320-19-0x0000000007700000-0x0000000007736000-memory.dmp

Download

memory/2320-18-0x00000000745C0000-0x0000000074D7C000-memory.dmp

Download

memory/2320-17-0x00000000084D0000-0x0000000008A8A000-memory.dmp

Download

memory/2320-16-0x0000000007450000-0x0000000007472000-memory.dmp

Download

memory/2320-15-0x00000000074C0000-0x0000000007556000-memory.dmp

Download

memory/4136-446-0x0000019038A60000-0x0000019038B52000-memory.dmp

Download

memory/6864-198-0x000001D7D18A0000-0x000001D7D18D2000-memory.dmp

Download

memory/6864-196-0x000001D7B9150000-0x000001D7B9242000-memory.dmp

Download

memory/6964-67-0x0000000006750000-0x0000000006782000-memory.dmp

Download

memory/6964-69-0x0000000006A70000-0x0000000006B02000-memory.dmp

Download

memory/6964-66-0x0000000006430000-0x0000000006522000-memory.dmp

Download

memory/6964-65-0x0000000005A90000-0x0000000005ADC000-memory.dmp

Download

memory/6964-63-0x0000000005870000-0x0000000005948000-memory.dmp

Download

memory/6964-62-0x00000000056F0000-0x000000000576A000-memory.dmp

Download

memory/6964-58-0x0000000005520000-0x00000000055F0000-memory.dmp

Download

memory/6964-59-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/6964-57-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/6964-70-0x0000000006CE0000-0x0000000006D30000-memory.dmp

Download

memory/6964-464-0x0000000006C80000-0x0000000006C92000-memory.dmp

Download

memory/6964-465-0x0000000006E90000-0x0000000006F06000-memory.dmp

Download

memory/6964-466-0x0000000006D70000-0x0000000006D8E000-memory.dmp

Download