8ca3e07ee02439ab5d0d2545fe5cf2195ffdefa5fa1959c1d3efb1c790057e23

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW PO # 32472.vbs
Size 1.4MB
Sample260804-kbftkazzhs
SHA256 8ca3e07ee02439ab5d0d2545fe5cf2195ffdefa5fa1959c1d3efb1c790057e23
MD5 d40f17c7bb1c615b6d25a8f831aa4cfe
SHA1 ea9f4cf05540c721bcc670fa4aa3a3829e340191
SHA512 05d8981d4e8d44bf1f1ce1273de542bd14703d17875dd3de6487f2e2001788084bdc45868c971b39a5b37706200d1a1334d35bd67100b623d5dd6d17a0b89e19
SSDEEP 24576:OyE9S+U4B3LWvM7/LyrsIkhbYiYSloXXiYzA7GC1jt:O8yqrbObqF06Cjt
TLSH
T16D65232073D0EFBF3A1C423211BA994505DB4ADB9CE7288DBC0173CF5646B53E90A769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1428	powershell.exe
2916	powershell.exe
4956	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	WScript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\prevhost.lnk	prevhost.exe

Accesses Microsoft Outlook profiles 1 TTPs 39 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
456	WScript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4976	cmd.exe
2112	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2684	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
1428	powershell.exe
1428	powershell.exe
2916	powershell.exe
2916	powershell.exe
4956	powershell.exe
4956	powershell.exe
4956	powershell.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
728	chrome.exe
728	chrome.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
3156	chrome.exe
3156	chrome.exe
3156	chrome.exe
3156	chrome.exe
3156	chrome.exe
3156	chrome.exe
3156	chrome.exe
3156	chrome.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe
4548	prevhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeIncreaseQuotaPrivilege	4956	powershell.exe
Token: SeSecurityPrivilege	4956	powershell.exe
Token: SeTakeOwnershipPrivilege	4956	powershell.exe
Token: SeLoadDriverPrivilege	4956	powershell.exe
Token: SeSystemProfilePrivilege	4956	powershell.exe
Token: SeSystemtimePrivilege	4956	powershell.exe
Token: SeProfSingleProcessPrivilege	4956	powershell.exe
Token: SeIncBasePriorityPrivilege	4956	powershell.exe
Token: SeCreatePagefilePrivilege	4956	powershell.exe
Token: SeBackupPrivilege	4956	powershell.exe
Token: SeRestorePrivilege	4956	powershell.exe
Token: SeShutdownPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeSystemEnvironmentPrivilege	4956	powershell.exe
Token: SeRemoteShutdownPrivilege	4956	powershell.exe
Token: SeUndockPrivilege	4956	powershell.exe
Token: SeManageVolumePrivilege	4956	powershell.exe
Token: 33	4956	powershell.exe
Token: 34	4956	powershell.exe
Token: 35	4956	powershell.exe
Token: 36	4956	powershell.exe
Token: SeIncreaseQuotaPrivilege	4956	powershell.exe
Token: SeSecurityPrivilege	4956	powershell.exe
Token: SeTakeOwnershipPrivilege	4956	powershell.exe
Token: SeLoadDriverPrivilege	4956	powershell.exe
Token: SeSystemProfilePrivilege	4956	powershell.exe
Token: SeSystemtimePrivilege	4956	powershell.exe
Token: SeProfSingleProcessPrivilege	4956	powershell.exe
Token: SeIncBasePriorityPrivilege	4956	powershell.exe
Token: SeCreatePagefilePrivilege	4956	powershell.exe
Token: SeBackupPrivilege	4956	powershell.exe
Token: SeRestorePrivilege	4956	powershell.exe
Token: SeShutdownPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeSystemEnvironmentPrivilege	4956	powershell.exe
Token: SeRemoteShutdownPrivilege	4956	powershell.exe
Token: SeUndockPrivilege	4956	powershell.exe
Token: SeManageVolumePrivilege	4956	powershell.exe
Token: 33	4956	powershell.exe
Token: 34	4956	powershell.exe
Token: 35	4956	powershell.exe
Token: 36	4956	powershell.exe
Token: SeIncreaseQuotaPrivilege	4956	powershell.exe
Token: SeSecurityPrivilege	4956	powershell.exe
Token: SeTakeOwnershipPrivilege	4956	powershell.exe
Token: SeLoadDriverPrivilege	4956	powershell.exe
Token: SeSystemProfilePrivilege	4956	powershell.exe
Token: SeSystemtimePrivilege	4956	powershell.exe
Token: SeProfSingleProcessPrivilege	4956	powershell.exe
Token: SeIncBasePriorityPrivilege	4956	powershell.exe
Token: SeCreatePagefilePrivilege	4956	powershell.exe
Token: SeBackupPrivilege	4956	powershell.exe
Token: SeRestorePrivilege	4956	powershell.exe
Token: SeShutdownPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeSystemEnvironmentPrivilege	4956	powershell.exe
Token: SeRemoteShutdownPrivilege	4956	powershell.exe
Token: SeUndockPrivilege	4956	powershell.exe
Token: SeManageVolumePrivilege	4956	powershell.exe
Token: 33	4956	powershell.exe
Token: 34	4956	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
728	chrome.exe
728	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 4976	456	WScript.exe	85
PID 4976 wrote to memory of 1428	4976	cmd.exe	87
PID 1428 wrote to memory of 2112	1428	powershell.exe	88
PID 2112 wrote to memory of 2916	2112	cmd.exe	90
PID 2112 wrote to memory of 2084	2112	cmd.exe	91
PID 2112 wrote to memory of 4956	2112	cmd.exe	92
PID 4956 wrote to memory of 4548	4956	powershell.exe	100
PID 4956 wrote to memory of 4548	4956	powershell.exe	100
PID 4956 wrote to memory of 4548	4956	powershell.exe	100
PID 4548 wrote to memory of 728	4548	prevhost.exe	101
PID 728 wrote to memory of 4952	728	chrome.exe	102
PID 728 wrote to memory of 2196	728	chrome.exe	103
PID 728 wrote to memory of 2684	728	chrome.exe	104
PID 728 wrote to memory of 3156	728	chrome.exe	105
PID 728 wrote to memory of 3040	728	chrome.exe	106
PID 728 wrote to memory of 4644	728	chrome.exe	107
PID 728 wrote to memory of 868	728	chrome.exe	108
PID 728 wrote to memory of 1860	728	chrome.exe	109
PID 728 wrote to memory of 3036	728	chrome.exe	110
PID 728 wrote to memory of 3764	728	chrome.exe	111
PID 728 wrote to memory of 4684	728	chrome.exe	112
PID 4548 wrote to memory of 3156	4548	prevhost.exe	105
PID 4548 wrote to memory of 3156	4548	prevhost.exe	105

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2084	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\NEW PO # 32472.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\JXCUFWOX.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:FZDZCNZASZNX))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Temp\JXCUFWOX.cmd" JVLZG"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:QELWETCW))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\edb_tmp\edb_tmp.cfg"
        5⤵
        Views/modifies file attributes
        
        PID:2084
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:VWVRVIUPG))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4956
      - C:\Windows\SysWOW64\prevhost.exe
        
        "C:\Windows\SysWOW64\prevhost.exe"
        6⤵
        Creates a file in the Startup directory
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:4548
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffc062bc728,0x7ffc062bc734,0x7ffc062bc740
        8⤵
        
        PID:4952
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1660,i,8302524094979370428,1253049329018961659,262144 --field-trial-handle=2004,i,8005912838760612802,18412527682294094004,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
        8⤵
        
        PID:2196
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4" --force-high-res-timeticks=disabled --metrics-shmem-handle=1664,i,6513227429659205850,9287075935430555563,524288 --field-trial-handle=2004,i,8005912838760612802,18412527682294094004,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:2684
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4" --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,9234110220743357495,8763936646443741180,524288 --field-trial-handle=2004,i,8005912838760612802,18412527682294094004,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3156
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,4950464420116682211,9254068226781587579,2097152 --field-trial-handle=2004,i,8005912838760612802,18412527682294094004,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
        8⤵
        
        PID:3040
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2896,i,11199320075164258742,6380043732438446170,2097152 --field-trial-handle=2004,i,8005912838760612802,18412527682294094004,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
        8⤵
        
        PID:4644
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3368,i,14735694294725976565,6240217310712628517,2097152 --field-trial-handle=2004,i,8005912838760612802,18412527682294094004,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
        8⤵
        
        PID:868
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3392,i,8848020408521375119,488774944488627148,2097152 --field-trial-handle=2004,i,8005912838760612802,18412527682294094004,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:2
        8⤵
        
        PID:1860
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4004,i,18419882523236497672,4172593161193223149,2097152 --field-trial-handle=2004,i,8005912838760612802,18412527682294094004,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:2
        8⤵
        
        PID:3036
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4176,i,11190154763690972925,5323378209435294653,2097152 --field-trial-handle=2004,i,8005912838760612802,18412527682294094004,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
        8⤵
        
        PID:3764
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4" --force-high-res-timeticks=disabled --metrics-shmem-handle=4220,i,13156818092036355762,15882935849874664147,524288 --field-trial-handle=2004,i,8005912838760612802,18412527682294094004,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
        8⤵
        
        PID:4684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3820

C:\Windows\SysWOW64\prevhost.exe
C:\Windows\SysWOW64\prevhost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 de2744dc8847ac71bcac8483faca3a0885c8ac2d162f5c7508beac6ba4dc3679
MD5 cb33489e7ebf399b503913a9a69bccd4
SHA1 7d15182d6f3931cbb398d6cf6c22324497f93662
SHA512 17bf6b6a09183417fbe606d3fcb35fbd641c56aeda5ee7f364438910916eb990f8c2f0c91aab73be615727486c3300ed25fa199f115fe9f605c753591dbe4768
TLSH
T1D5117A23F39C8921CC96163A509D9C51727683D7819FDF9F7FC0D205A5BF588CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 e12885196f53f13023c7c3c15b393761114b4f3ab00a768db1edad34c7a4ceb4
MD5 0cb862e17b3a2c8afedbc043714fae2c
SHA1 8910852c447986a068dc88189c15b28ee154700a
SHA512 507c61399aebb2f0a44c06fc172e927b188cccb6912bef2399f303339931329ee1a98dc8dbf23bfac7b72e414aca0ce62ce9b4f6b82eea0c280566300ee4c946
SSDEEP 384:4rf+jA9p+5uTJlrEqVekW5o9owGToT6seYWZe2x/+C3Sof3u7DQJ4cfrX3llds8/:ifiuT/BsKoXTo8ZFBSGu7DQJ4cDFDsyH
TLSH
T15E82C56D600F66C3C8C19378D00B055FE4F2EE8D531A03D8BB5E5E3B8AB8A9ED16D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Crashpad\settings.dat
Size 40B
SHA256 941c1bcd8a26fb3308e27fed8cda58f8efa1aa1003ddef149f8c90a02b7902f1
MD5 4590ee6e46ba180baf1ace40a4a8809f
SHA1 1052cebcffee0734c86fb8b97620171082a6da6c
SHA512 25c42dfeb78c137413f6a82ba8449ad23e0d043a1a1b70ebe8b8899e77f69170864fc4c0b1f7c2452d37c32256b45c3057267638537c718cae5e380e32605c43
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8795de0b772c212371dcf7349d3773135edc89e23e662d0e48883af34182c6b2
MD5 3c528df4b383857797d2edb4dcab1253
SHA1 7ad3daa08bbc7b3888a9b0dda7341d7b52929bf6
SHA512 158511af9d1480590064126446af024727ba369827526a1ac31a75ef76857b031d30725a1b0942afddcd8ff4c02e4821a749fed2a76d10b1002c729fa96349db
SSDEEP 6:/FoEXE3xc+H+MN/02ypy+6KV/qedNSoKkEXA2vQlckllgQKyFL+haQ:d7X0LNN/0f0GsiMkEri/zV8M
TLSH
T1FA135E3CD7801D6BEA5814BC58867B72C3B18959E25B56635D216D64F48470200AF28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 cc72b5725cf89b53d4a2b9e990263b5f445669a77e57b76cb6e551d85d4ab14e
MD5 5ac9733c2132aa9f46f4ed16ab103d83
SHA1 b90a9c2601aaeb8115ff9ec6477d08833e621812
SHA512 30dbfd51cd7d6e1b10d4c600a14484393259a995723bdd0e59765a9a21b9d1801de44a4ae34bffd3a6544a5a730cb437ec66d95001e410dbcf567a8c41a341f7
SSDEEP 48:154olJ4va8MYSP3zlblQfKq3SM1Xg4X1tE7MmX4IedVEPLVBKWwtl:11qZAhblQ/Sug4HE7jiVOLHKWol
TLSH
T12644A8F71E09DFC1EA18CAF85C42623C8E3246162CBAED79F57848B255516F7312C9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 8b8f70e7587cbe92fe0b7c4b7b2d0c40a1cef12aa0482ab468bc1f24eb21126c
MD5 aa9fe32bf0f724d5ed138925c0bfa08a
SHA1 985cc45a26279b4ca9c51103c6cc650b513b92da
SHA512 5cfe02fecf6ff36559072aa172db3bf1cf3d82fd6099234c7de3ea40c768ca6df5a6882e01f9f1289a2edef8096d6efc55bf0f74f7cbaa77b86db7c95ad7c2d4
SSDEEP 768:9UfDPLSgcRUv+04jUfDPLSgcRUv+f41fDPLSgcRUv+S4CUfDPLSgcRUv+K46z4Vy:sAAUdzrz7zdCZz
TLSH
T190166EB74F687946D781EFB0BBC9ED1C3CB022C6ECD36892E512926959E0FC4178511E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 eb6b3eba034f6fb1b0252835f873c53b289016e8689840f18110371dbacbaa8a
MD5 30329130c845173f4ae525b9753bad26
SHA1 ecaeeb73e7e04552f35f110ef2747a55942c0672
SHA512 218ba19d324333227a59789afc7b891f2e11b1162681df5ab7e692a0d526be6fb7ead368f1ae2663ce7c459dc7a310e0d04595120fe61a043ae87785a2945452
SSDEEP 768:eX3sKaVzeiXDH6/hdJ0iJiRDSJ1V3a3kY6YffY/sKEkUJ5XCnMO4:esKEqiXj6ibCHY681GEXCM
TLSH
T1C203F15E80CEBBE41AA6201797DDD06408F8F6C2D4DA3EFA85D778D8D7CC98A604D0E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Cache\Cache_Data\f_000002
Size 70KB
SHA256 202f6947db28f364478faf1adfb51acbf040157ef4a3e26404b8f1075a0c5d8f
MD5 1f5c87e7e976d26a5d082bfbbb43e5cf
SHA1 25f240f331ff78dc584b3fc047eb9df63034d1b9
SHA512 7d7d174dc67deb8730918f064638cf9cf1bbaf6f2e7d04215b5a6977f940acd9143e2a299afa594f98d1cf6b3dcc15d729b321eb0e77a331a14008fa4d2d91f5
SSDEEP 1536:DGgRo2P4EXELm9zQFG44t0kgAoSuEhsqjwKELAr4Nvoygkm1A7vWPmQ7P:DGg5P4GE8zQFGhYE/EcUNvo0v4D7P
TLSH
T1496302E1CCF31F1103EDD73516A1556CE09EEA7B28E750D7B111B658862B34F9C90E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Cache\Cache_Data\index
Size 256KB
SHA256 593181184bb253229950c371effaed6beeaf202e7f91d8c414ee077672722397
MD5 1532330a9aed40db81c46f7590c7fba6
SHA1 eafe8db660f45df81c0d254d15d41f8993a459b8
SHA512 542575c72fa5d38f4dae78e73a58577c58215fb4948ee12fe03a6270be5dda0161b130288d697290b473a6162b8abce0c1db7b99775c760cf0262762c6cdacde
SSDEEP 3:LsLllFlklNllklkXlHVRlltSllLll/mltnllll/mNtlNlXl3Nl/lZNtlQlell//:LsRa3lP1R/A47llluNtbHlt
TLSH
T16044112E83802F2AC3C022FC88038B2023B8C808CB8F8B0B0B003A203CC23802E0F020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 de12f30e20c0f3cfb6fe1a83108c31d8a4f8e936f9169733ba5b1fee3a3befd1
MD5 36307d95ea9a467ccec5224c2b458e58
SHA1 d050da8484d4ed86a154c4ece698dfdb1b74cf0a
SHA512 6f917f3518ce2a17a6ae0ce6e22f879888b96907ffc4df54b7fbd143dbaec8635498abd49fd52bc0590c81470e04921714e07cedc9f3fdbae63fd8494f8b317a
TLSH
T1A3E02B81864C0F0ED32D96F7CDA603454E0B42C42ABE3603ACC1C2C233124241288522
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7a14cbaa7f25b783eaf4422a2b1b8564fe6680bdc7c2576ca7c2013f481214bb
MD5 8f0784c990457f7dece79f15c0a77fe9
SHA1 1cd6066dab813d9adf39682bd8dec07d6743b90c
SHA512 667cf68a9875125a92494c4dce77a42695d86827b2ea0317e8b5b58bf5e53b5ae058d6aa9fea9367571eb58997e5843d7cb06a60734cfc9c39bd617309b25ebb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 377391bf048472a70fbbb52d845cbeabbd0312b30953614a4eaf0a9b876019f2
MD5 5cc161847f626ce6006cda179c1cea14
SHA1 6c7f10218d7c9e789d007a004aabaa3e32408ec2
SHA512 b30f05a0ff7ff2227add9f603425fc59a9afde195015165cf8094329ef0485357a1be3e5f8eaeb5a1432b0c853762297ec257479cc2fb7eef51955e6a2f81dfa
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\DawnGraphiteCache\index
Size 256KB
SHA256 d41d3f17a66c6ef2a2118ecbb64ed902297c91e9618a8c512521f1f4d3f80f4c
MD5 1238e442a5b3e025346a2c688456fba5
SHA1 f8718de42281f6e612a0a47fe44a15e21ac1ef97
SHA512 f6374ab80763fe721c7b7d09a3520a9e5e21cacc9c3529bbf51972a1fba24de32a13db4f59b1c5e071eb36dc94cd01b9697f3e39a127b1ad77ea3678bf6c67fa
SSDEEP 3:LstlNllklkXlQTul:LsX3lPQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\DawnWebGPUCache\index
Size 256KB
SHA256 e71dff0d70f858caa3ed3a0158d1a41dd4c0f7fb32576c1551e3d60d80499f9c
MD5 4a2bd1bbef341b2594bfa693d022273e
SHA1 7d80717bb5eb8ca5bda7c6fea39818bba35d2dc0
SHA512 f1fb488dd4e36bccd98d43bd42825fbd1ef1e074ab08ab3bd0f20e92bff44f5d71662830b749825308b4c200719e5cfd10d42478b9fa5c988c8b05274cc37f78
SSDEEP 3:LstlNllklkXlsvGtl:LsX3lPsvC
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\GPUCache\index
Size 256KB
SHA256 fcd0699dedd7b737ea73b572537df362b8817c1666b7cdbcac5ee9d12b576204
MD5 7bb4b54579e2073e64a53685230136c1
SHA1 aaeb13519831e77ee72327fc4ddc51bb1f2a9acb
SHA512 5e50cd67e9cefb241178c61a4a7a79b02271012f02effea2d67fbcde0bc06a153cce5f34d59043bd431911306bac1582355615bdee2f3c9dbd65a8b1858ff50a
SSDEEP 3:LstlNllklkXlVLul:LsX3lPVq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e80a844093debede939bc4a72908044686c999e0012d0b458d3cdbcbc8e03985
MD5 30926dcede2a75b958355dfbb7cf3fc2
SHA1 1174accd2399540bf6c8c6397e5a6351f24035b6
SHA512 794e1ed9de495df43eaf130206e4055947e1a8686fee9c5818c0cab47e5e066baeb0daf133cbd064d37f07f3baee4c489362f808712a1ac8ecd81421abcfced7
TLSH
T158A00255164091A0C10012B42912A38D1708B925906303277AD007479C750514952188
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Session Storage\000003.log
Size 61B
SHA256 5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923
MD5 9f7eadc15e13d0608b4e4d590499ae2e
SHA1 afb27f5c20b117031328e12dd3111a7681ff8db5
SHA512 88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f
TLSH
T1C4A0041C1341D037FC1DC730054533303731DCDD1F111543444D15D00717F751401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Session Storage\LOG
Size 265B
SHA256 3d43da6fca998858f611d542f81cfbbdcfc653b7927c9a6b4e725cf8c7d585f1
MD5 5381e4912f265c67719da245fe9c154c
SHA1 695aa72cb670197c37678f8c2073d271887e956f
SHA512 cdc2b9eaf6fc1749bb0ee0f23f3f5006a1344cce05d40f47280539f0273f6e177737e8f7291fdea34971546f81aec7a12363f08e471ce27d8345e177f51772ea
TLSH
T121D0C27041C68277023081B71526370CC7F0740CEE892F682E3AD008264700B66B3A41
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 68d4dd0210ca6e9dd929d16f84e0cd7903fcdcd931991fdbd22a67470150d4e6
MD5 a00d33773e4c45fc828b8ecfac89a792
SHA1 c464b1b8b7e4152b6860ecdecf83ed3373469bcf
SHA512 08b40af292d0b070777933cb7538a48fa957d8f020f30efebe29dfcf5b8306cb2bb839b73cc10e32e2b78260a46f1ab77570c06a1cae31b41dcda7efe9c63516
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\Default\Shared Dictionary\db
Size 44KB
SHA256 b08af7745c49533422c5afb2e683b61ab1b025a2ef13f892321a2cd1383fba79
MD5 ad4b0d21f32cbccefd98c28e33a59a6e
SHA1 1850a90ed7ec61efca181fcc35927a2888549e6e
SHA512 0bc8a37f441ce5cbb0fe4ea3f766f741cc6424ac4274ffa42fcf507c8fc7154115375bc669449da02d8b57a19227483814357367cc8611cbecdf247d7b65706b
SSDEEP 24:TL6BgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:T1OIy4m1b3fbUdeqSB
TLSH
T16B13BB0F1E187551D1BD0236E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\3fthvz00.px4\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

JXCUFWOX.cmd

Path C:\Users\Admin\AppData\Local\Temp\JXCUFWOX.cmd
Size 1.4MB
SHA256 80bf930bc7a4948f1ddcf71eab55e9c695b04a4de7c6982aee16bf547f041f3d
MD5 5ff429f33ee60e0754816c6da8fe7334
SHA1 415d916a911bab95b5f5ccdd54052194e419dfe7
SHA512 a0f5fbe09fe0f10a1728ec9f01fcdfbc3970423a527820220caa9039dca52318bde7a6e1e0301c89c635f90517b5aefb18d00b129d8585d501f15588f78e7efb
SSDEEP 24576:nSENKa8gdnn2vUff/OzIIEtPQewSlA/jagzMbyqtPd:n4SGz7mTa9QGSPd
TLSH
T101652374A7916FAB1A7C8023165BDE560A9F8BE3996B6CCD350173C44A8B303DD0F798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_paevzzvx.en4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_paevzzvx.en4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1428-3-0x000001C1705A0000-0x000001C1705B0000-memory.dmp

Download

memory/1428-2-0x000001C1705A0000-0x000001C1705B0000-memory.dmp

Download

memory/1428-4-0x000001C16FFB0000-0x000001C16FFD2000-memory.dmp

Download

memory/2916-17-0x0000000005830000-0x0000000005896000-memory.dmp

Download

memory/2916-14-0x0000000003090000-0x00000000030C6000-memory.dmp

Download

memory/2916-15-0x00000000059A0000-0x0000000005FC8000-memory.dmp

Download

memory/2916-16-0x0000000005780000-0x00000000057A2000-memory.dmp

Download

memory/2916-18-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/2916-31-0x0000000006B00000-0x0000000006B1A000-memory.dmp

Download

memory/2916-26-0x00000000060B0000-0x0000000006404000-memory.dmp

Download

memory/2916-28-0x0000000006550000-0x000000000656E000-memory.dmp

Download

memory/2916-29-0x00000000065A0000-0x00000000065EC000-memory.dmp

Download

memory/2916-30-0x0000000007D00000-0x000000000837A000-memory.dmp

Download

memory/3156-224-0x000001F46B500000-0x000001F46B5F2000-memory.dmp

Download

memory/4548-79-0x0000000004EC0000-0x0000000004F98000-memory.dmp

Download

memory/4548-86-0x0000000006450000-0x00000000064A0000-memory.dmp

Download

memory/4548-85-0x00000000061E0000-0x0000000006272000-memory.dmp

Download

memory/4548-83-0x0000000005BD0000-0x0000000005C02000-memory.dmp

Download

memory/4548-82-0x0000000005AA0000-0x0000000005B92000-memory.dmp

Download

memory/4548-80-0x0000000005100000-0x000000000514C000-memory.dmp

Download

memory/4548-78-0x0000000004AF0000-0x0000000004B6C000-memory.dmp

Download

memory/4548-75-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/4548-76-0x0000000004BB0000-0x0000000004C80000-memory.dmp

Download

memory/4548-77-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/4548-278-0x0000000006540000-0x000000000655E000-memory.dmp

Download

memory/4548-277-0x0000000006600000-0x0000000006676000-memory.dmp

Download

memory/4548-276-0x00000000063E0000-0x00000000063F2000-memory.dmp

Download

memory/4956-65-0x0000000007800000-0x0000000007808000-memory.dmp

Download

memory/4956-51-0x00000000706A0000-0x00000000706EC000-memory.dmp

Download

memory/4956-74-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4956-64-0x0000000007990000-0x00000000079B4000-memory.dmp

Download

memory/4956-63-0x0000000007960000-0x000000000798A000-memory.dmp

Download

memory/4956-62-0x0000000007920000-0x000000000792A000-memory.dmp

Download

memory/4956-61-0x0000000007820000-0x00000000078C3000-memory.dmp

Download

memory/4956-60-0x00000000077F0000-0x000000000780E000-memory.dmp

Download

memory/4956-52-0x0000000070E40000-0x0000000071194000-memory.dmp

Download

memory/4956-66-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4956-50-0x0000000007560000-0x0000000007592000-memory.dmp

Download

memory/4956-49-0x0000000008600000-0x0000000008BA4000-memory.dmp

Download

memory/4956-48-0x00000000074B0000-0x00000000074D2000-memory.dmp

Download

memory/4956-47-0x0000000007410000-0x00000000074A6000-memory.dmp

Download

memory/4956-38-0x0000000005BE0000-0x0000000005F34000-memory.dmp

Download

memory/4956-73-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4956-71-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4956-72-0x0000000010000000-0x0000000010060000-memory.dmp

Download