67e91defa449abcbcc0df237c1db78b3f63753ccdca88b4fdb50d3eb27a23dc4

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW ORDER-SUNNY 5916081940.js
Size 1.4MB
Sample260804-n7mtjaaf66
SHA256 67e91defa449abcbcc0df237c1db78b3f63753ccdca88b4fdb50d3eb27a23dc4
MD5 44fd8f8fed2ee73ff173b1904f10ccb4
SHA1 c12b1340bf1294d6e3d55212b24f5248d6679e42
SHA512 6b361a4a623980a22ed59c8ab4e03c5ef4ef63bf26e645590f4309f14d8cd50f3de3759ea543ae46a6c0bdda35456784af0d627b24b5a06f3dd42eb79330c112
SSDEEP 24576:DOZPGh43so97ZNveUdvHC6aPtY+rNtKE6Lt2dxeUJDaa0x8XpWs7QbDtY:jh01hHKWzmMUaYg3u
TLSH
T1A5652321AF8A68FF8A085061A50BC6540536EEC15066FC6E3B863DF5EA29F473FC5B05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4600	powershell.exe
4324	powershell.exe
1896	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\prevhost.lnk	prevhost.exe

Accesses Microsoft Outlook profiles 1 TTPs 39 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
872	cmd.exe
1188	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4984	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
1896	powershell.exe
1896	powershell.exe
4600	powershell.exe
4600	powershell.exe
4324	powershell.exe
4324	powershell.exe
4324	powershell.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
3628	chrome.exe
3628	chrome.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4136	chrome.exe
4972	prevhost.exe
4972	prevhost.exe
4136	chrome.exe
4136	chrome.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe
4972	prevhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeIncreaseQuotaPrivilege	4324	powershell.exe
Token: SeSecurityPrivilege	4324	powershell.exe
Token: SeTakeOwnershipPrivilege	4324	powershell.exe
Token: SeLoadDriverPrivilege	4324	powershell.exe
Token: SeSystemProfilePrivilege	4324	powershell.exe
Token: SeSystemtimePrivilege	4324	powershell.exe
Token: SeProfSingleProcessPrivilege	4324	powershell.exe
Token: SeIncBasePriorityPrivilege	4324	powershell.exe
Token: SeCreatePagefilePrivilege	4324	powershell.exe
Token: SeBackupPrivilege	4324	powershell.exe
Token: SeRestorePrivilege	4324	powershell.exe
Token: SeShutdownPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeSystemEnvironmentPrivilege	4324	powershell.exe
Token: SeRemoteShutdownPrivilege	4324	powershell.exe
Token: SeUndockPrivilege	4324	powershell.exe
Token: SeManageVolumePrivilege	4324	powershell.exe
Token: 33	4324	powershell.exe
Token: 34	4324	powershell.exe
Token: 35	4324	powershell.exe
Token: 36	4324	powershell.exe
Token: SeIncreaseQuotaPrivilege	4324	powershell.exe
Token: SeSecurityPrivilege	4324	powershell.exe
Token: SeTakeOwnershipPrivilege	4324	powershell.exe
Token: SeLoadDriverPrivilege	4324	powershell.exe
Token: SeSystemProfilePrivilege	4324	powershell.exe
Token: SeSystemtimePrivilege	4324	powershell.exe
Token: SeProfSingleProcessPrivilege	4324	powershell.exe
Token: SeIncBasePriorityPrivilege	4324	powershell.exe
Token: SeCreatePagefilePrivilege	4324	powershell.exe
Token: SeBackupPrivilege	4324	powershell.exe
Token: SeRestorePrivilege	4324	powershell.exe
Token: SeShutdownPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeSystemEnvironmentPrivilege	4324	powershell.exe
Token: SeRemoteShutdownPrivilege	4324	powershell.exe
Token: SeUndockPrivilege	4324	powershell.exe
Token: SeManageVolumePrivilege	4324	powershell.exe
Token: 33	4324	powershell.exe
Token: 34	4324	powershell.exe
Token: 35	4324	powershell.exe
Token: 36	4324	powershell.exe
Token: SeIncreaseQuotaPrivilege	4324	powershell.exe
Token: SeSecurityPrivilege	4324	powershell.exe
Token: SeTakeOwnershipPrivilege	4324	powershell.exe
Token: SeLoadDriverPrivilege	4324	powershell.exe
Token: SeSystemProfilePrivilege	4324	powershell.exe
Token: SeSystemtimePrivilege	4324	powershell.exe
Token: SeProfSingleProcessPrivilege	4324	powershell.exe
Token: SeIncBasePriorityPrivilege	4324	powershell.exe
Token: SeCreatePagefilePrivilege	4324	powershell.exe
Token: SeBackupPrivilege	4324	powershell.exe
Token: SeRestorePrivilege	4324	powershell.exe
Token: SeShutdownPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeSystemEnvironmentPrivilege	4324	powershell.exe
Token: SeRemoteShutdownPrivilege	4324	powershell.exe
Token: SeUndockPrivilege	4324	powershell.exe
Token: SeManageVolumePrivilege	4324	powershell.exe
Token: 33	4324	powershell.exe
Token: 34	4324	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3628	chrome.exe
3628	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1188	2216	wscript.exe	86
PID 1188 wrote to memory of 1896	1188	cmd.exe	88
PID 1896 wrote to memory of 872	1896	powershell.exe	89
PID 872 wrote to memory of 4600	872	cmd.exe	91
PID 872 wrote to memory of 2128	872	cmd.exe	94
PID 872 wrote to memory of 4324	872	cmd.exe	95
PID 4324 wrote to memory of 4972	4324	powershell.exe	98
PID 4324 wrote to memory of 4972	4324	powershell.exe	98
PID 4324 wrote to memory of 4972	4324	powershell.exe	98
PID 4972 wrote to memory of 3628	4972	prevhost.exe	100
PID 3628 wrote to memory of 4364	3628	chrome.exe	101
PID 3628 wrote to memory of 4636	3628	chrome.exe	102
PID 3628 wrote to memory of 4984	3628	chrome.exe	103
PID 3628 wrote to memory of 4016	3628	chrome.exe	104
PID 3628 wrote to memory of 3208	3628	chrome.exe	105
PID 3628 wrote to memory of 4408	3628	chrome.exe	106
PID 3628 wrote to memory of 3992	3628	chrome.exe	107
PID 3628 wrote to memory of 4572	3628	chrome.exe	108
PID 3628 wrote to memory of 4136	3628	chrome.exe	110
PID 3628 wrote to memory of 4376	3628	chrome.exe	111
PID 3628 wrote to memory of 4192	3628	chrome.exe	112
PID 4972 wrote to memory of 4136	4972	prevhost.exe	110
PID 4972 wrote to memory of 4136	4972	prevhost.exe	110

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2128	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\NEW ORDER-SUNNY 5916081940.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\KCXEHFUNHU.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:QQIQNDKZDMCN))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Temp\KCXEHFUNHU.cmd" YGGRTYFL"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:872
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:PUPGAH))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4600
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\net_profile\net_profile.cfg"
        5⤵
        Views/modifies file attributes
        
        PID:2128
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:LMRQVAO))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4324
      - C:\Windows\SysWOW64\prevhost.exe
        
        "C:\Windows\SysWOW64\prevhost.exe"
        6⤵
        Creates a file in the Startup directory
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:4972
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff96aec728,0x7fff96aec734,0x7fff96aec740
        8⤵
        
        PID:4364
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1764,i,2409510968205657650,17303840835018469683,262144 --field-trial-handle=1988,i,5888554245920618776,7588937685970338000,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
        8⤵
        
        PID:4636
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj" --force-high-res-timeticks=disabled --metrics-shmem-handle=2036,i,4431397293026307754,8225121033495230707,524288 --field-trial-handle=1988,i,5888554245920618776,7588937685970338000,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:4984
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj" --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,6624487422519131714,7493313031306214454,524288 --field-trial-handle=1988,i,5888554245920618776,7588937685970338000,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:8
        8⤵
        
        PID:4016
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2956,i,8729717395514440966,10788438734911409212,2097152 --field-trial-handle=1988,i,5888554245920618776,7588937685970338000,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
        8⤵
        
        PID:3208
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2968,i,16149315184826802847,11962947386986626486,2097152 --field-trial-handle=1988,i,5888554245920618776,7588937685970338000,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:1
        8⤵
        
        PID:4408
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3404,i,6342711258987891756,15075659612882395454,2097152 --field-trial-handle=1988,i,5888554245920618776,7588937685970338000,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
        8⤵
        
        PID:3992
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3400,i,955278237287358480,10141270060426733632,2097152 --field-trial-handle=1988,i,5888554245920618776,7588937685970338000,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:2
        8⤵
        
        PID:4572
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3948,i,8919445449740212963,1788367852439834548,2097152 --field-trial-handle=1988,i,5888554245920618776,7588937685970338000,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:2
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4136
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4036,i,10422886157527071437,7736832204897274528,2097152 --field-trial-handle=1988,i,5888554245920618776,7588937685970338000,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
        8⤵
        
        PID:4376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj" --force-high-res-timeticks=disabled --metrics-shmem-handle=3532,i,1981021618652971192,16093572774859876056,524288 --field-trial-handle=1988,i,5888554245920618776,7588937685970338000,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
        8⤵
        
        PID:4192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4144

C:\Windows\SysWOW64\prevhost.exe
C:\Windows\SysWOW64\prevhost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 07a894c424be711e7244a966a5f40ef6ffdca7c12d4bac0676f8434f2854b296
MD5 dfe913bb96726f26a06935f93baae10a
SHA1 115ea2e02727c68cf7ef31ad8871b787219faa1f
SHA512 9146ad0414517fbbab0e76e73eb341fb9d8865e54d1be71228d228144410a5f545d9da98c6e038532a058627ff7a3ecc35b79c67a2dd4985b21501583c9b6054
TLSH
T181117623F39C8921CC96163A509D9C2172B683DB819FDF9F7FC0D205A5BF988CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 6d345f0849608658bf7206d7ee1ac9eaf44a351ee0c548130b5018c51e747d41
MD5 1c1e555592bcf588dab0a6263f963f1e
SHA1 fc7da81c2109f405fd98b1e90e4760fdeb4f816b
SHA512 a8c10358c7aaecf9eb5d08b24fd6444bab4754183a8c54bc5865ee92ca4bbf537f8e4f230701595dcf008d380da5036ac7c47aa53ddce56f5f655dcd112e352f
SSDEEP 384:Lrf+jc9p+duMuZ42nh28kUo9o2ToH6seYWZe2l/+C3Sof19u7DQtYcfrX3lVds8/:ffquDeAhy5o2To4ZpBSmu7DQtYcDFTs8
TLSH
T13982D66D600F66C3C8D59338D007055FE4F2DE8D531A13D8BB5EAE3B8AAC69ED02D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Crashpad\settings.dat
Size 40B
SHA256 41f696545618ffbac1c251d17a0b90c7cc5c7a548d4ee199800d5f936ea8a4b3
MD5 b623c5f9d686087d998e506500c62365
SHA1 9921f8217241aa4bce4ac4d20495112672229bcc
SHA512 c733c09d657429d989eb504c0832421e60371cfb9d5b3592471634175665260e4d9b0167dc35defa587c2a07aba6c2d99c056fa49d5a75e3d36179eade34aa51
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 24ce51627b5059588c2100349d17585ea1f076e45589fbb7c4b66086cbcbacd2
MD5 7eedd4601e8eb16284947b7718ac6165
SHA1 2b8aa730b6c0c76ba9d9e3d9a62dfe46aaba5b4a
SHA512 a19b732694064fc7130ee720517bd5bfd97bae3704b5685bc0f95195f4503dbcf583ed1b08d338b87ff89e008bf05a91fbf678ae744ebc672ec873deb22ab59c
SSDEEP 6:/FoEXEXYHMNhVvYVVNco15qWGzNEs82mttPlxX:d7XC/NhSvND5rtPX
TLSH
T13213172EDB412E17F88BA0B857A69BB033B04404CAA14AA386B1A414F988B80169B5C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b40da42b37383b5d1cc9aca87df8c35d8e25535d93b35e1f0ee61c751481352e
MD5 7ef37f215b6311ec19f5e75745eff4e1
SHA1 6617a18fff213942dd05aeb6ccba6f4d496ec47f
SHA512 d2a4f7c48e0b9a581cc89aaa07764167534c7c51c3505ce224911a9ae73053912c6b0164c7134021370033237602f413525416fecbf76cfa71ef8f8fd774b6c6
SSDEEP 48:Yzol6FWYSP3zlblQp4M1XgUXs6U8XMmXJ:YU6NAhblQuugUs6pXj
TLSH
T1CA4442F72805D6CAEA19CEF41D40523CCD3392162CAAEDBAF62904F292559E631385E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 0fe5b2c8acfda1cc8eeaa6ad1bab2a306d30740043024f4d4ad82cae54ec98e2
MD5 5bc200edbf61a778b50d56b2054190a7
SHA1 35850cbf2aa6a424ca3d2e04eecf1855ab29077f
SHA512 abccccb58134af5d58d3db08f0cb80e1b1a67ed2f4e2a4ea58c4051ea318fa4b5e95dc1da47e3f074a3bc02edff2e6a8d188a3673f9b4b51d290bda6ac1f9a06
SSDEEP 768:cUfDPLSgcRUv+w4hUfDPLSgcRUv+b4kfDPLSgcRUv+u4AUfDPLSgcRUv+S4:ZOxa
TLSH
T1D0161CB64E647947D782EEB0BBC8DE183C7122CDEC925C91F522A2694BE0FC41BC525D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 667e64b876a7d65c200c26650cd13e77cb04a64ffea964febeba035b414834b0
MD5 65aa15c29f1ba89be27bd1804b29b20f
SHA1 44290d6ec9a9364dc4010ecb34bd3b0bb5dbf475
SHA512 e8cbc244ce81395455ae7ab991d02e47d3d684be610df9df4980e8aa07b286df6593f534740a2fb7b63f04489c7c9dcceb7c504ac71a246930acb62634807607
SSDEEP 768:R5HyPpO2q46FrvF8MRFN5Qfbgl/aKNhGDwaKx3Yq0QaM9D0nDIvk4pex:/yptq46FGMRFN5Qf0NcDwrxYq0lqQEsV
TLSH
T14103013C06618807BD09375D58002045E246B35782E9F628FD9471B3EB7BAD4FCEAD96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Cache\Cache_Data\index
Size 256KB
SHA256 d5039b85147bea2f732c99b7de4d4abaa04002e32d36097329d5a8db73401767
MD5 2b4ac7a92f59a53c4568ed86f53331b2
SHA1 61dbe8bf1ec95b26c4f9a56dd99a7b05ce441142
SHA512 506d96468bf339783868656d7c27ce896eff02b9df3282f82557dcbb0fd4bd6006be079d6693c03164dd88ed52862c3289da00734ce659b119c9009c41054a10
SSDEEP 3:LsLllfltlNllklkXlpvSODVllllSllx/mltcNtlNlXl3Nl/lOll//5Ntl5llll/g:LsRt13lPBRueWNt0ltBtlll
TLSH
T19D44016EA399AE26D6D501FD85038B609374C805D99F8B43574865202DD1B916E0F5E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 5b7271ee4da2006cdef996bdac0521077e591f5a3f10a75fd2cf5b0937cf0f1e
MD5 ae36c4202ee7aaf142861552712cf559
SHA1 838dab342b39b43c125ca966a95bc2f2e9019e8f
SHA512 6713feb9e793735b108e67944f3c9b0ff8ba85205895d612e820109eabd3717a57f0e0554c67a734806410d49beeff24eff16126eb50425aa6f28618d38220b5
TLSH
T101E02B81834C0F1DD33E96F7CDA603094A0B52C42ABE3603A980C2C133164281288122
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 b21acf8b5da64763ffb90065adf616737d6b9b197aa8f5639f860b4be5870df4
MD5 85db20c2f3bdcca4a25bd93530cc030b
SHA1 2c27dfadf4ce4b3d7facb1ee984a46fd6af36430
SHA512 474f02289ad590a133de1de6a1ae8d7672f5c355e6f6d0f31dd18bd095279c21c5d3c5b9a982698ed7b56af0e8f788fc883e3d3510ff08419f6f9199d3b28116
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 6aeb52da0de3b6c5e2e853e4991895bf06ce5bf63357622b3305d20c3997047d
MD5 dd7e20bc3a52227b7f0e837b7840375c
SHA1 508bb21b2b616c559ff2500f0591edf38085a490
SHA512 dffdc405747a7b826fdba5479ed7d702991b33828d959c0b033f7fae865de5f7ef537cb1058d6ccf15a6c5210a0e59b2e4d0f0fd346e8fed2048e40c10e491d0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\DawnGraphiteCache\index
Size 256KB
SHA256 85ac7561b9251670fe814723678a7990310dbbfcb31d2acd998cd37586515bbc
MD5 0c2c37c152e77e601ad4112ad03b97a6
SHA1 8ab7acf8b8f644967366c9614d0bf48848857d49
SHA512 e9868a04684045c987b1757c6bd01e946deb87d16ab88d427b3168959ac7042d10e2860af0c1b8d0e7818a8cc2061894fd8a31a4c0eda454cfca441b8f4f54f5
SSDEEP 3:LstlNllklkXlvh6X:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\GPUCache\index
Size 256KB
SHA256 e9d8146eff24c93f3af9885aca91c1b1a4f25d944450a9134c7d73691f753b7c
MD5 7c7ff913004df76c2c5d712300157e9a
SHA1 c3499358694c818eca2cc1c2fd8bee5409aceef6
SHA512 0c61bfd3561f01d9d5464b135e93057c08444b2de4125b3a61c90b0df1ca00ce3d2fce3beefa6db84680336be2fddacdb5c10ef2dd4a88f706ec038234022351
SSDEEP 3:LstlNllklkXlubyt:LsX3lPub
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 deb24e16da589a991635b252311d775e049bccb965f2f734d5b16f7614a31b68
MD5 67d6aec0b06b357540887a3052a7144a
SHA1 b45fd1861b6305365328bb2af74282b59e91ead2
SHA512 470281f492f43c3ffc50cd607b98dc98ffabf6a87864e16dfd854e6c75fd01d755f0dcf5de2bf185c7e16aee3ff0bc9890f8abd1ef2897ae84c330d45cd6c313
TLSH
T108A0021103408154D14302B4394393C81240BD358144425376F00346DDB125169235D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 ceef47f8825ee455c7447da77a61434c2d9c3f614443d4b964980c6cc201ffdb
MD5 9ca7bc874d1ab2ee504bc16be6e508c7
SHA1 13a93a40c8beb623eaae768b165cb100023a3b0c
SHA512 9bc3c2d10bcf11fe7ee045ba25b727f76cd18c558a2f40323aefd6bb220352f42bb9c6403aa3a670d285102d48cd7cef91ea7dff4d0fe1f97a01ce9f2df38653
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\ShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\2yanuamm.soj\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

KCXEHFUNHU.cmd

Path C:\Users\Admin\AppData\Local\Temp\KCXEHFUNHU.cmd
Size 1.4MB
SHA256 56f9838fc2f71362f5f108538918a81aeaf9f6d0c31b285837661148cbb0f98e
MD5 58916b956311b5218adae332b1f36fb6
SHA1 2f0a46d93f6834bf3c57a36f6bc3923f254ec13f
SHA512 953e283c8495fd75e23fbce2c391a9dae16912b38e0cf1379a7d9e5f1da87e3812490585aa272a6e3bbf6769456bd2b0e9265ea6cda1e472695284b47abbde21
SSDEEP 24576:VmxhMRSjkoHbHxfeydZr2QKrRsUj3l0wKLtYn5eKJxEcERud9c+TCZ7tk:nRCDFtgmT6U+EkuhS
TLSH
T10F652330BF8E5DEF8A4C5466721A8A480226EFD1537BE8FE33843AD55D09B575E06F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_l0p3azwu.btj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l0p3azwu.btj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1896-4-0x00000193D5650000-0x00000193D5672000-memory.dmp

Download

memory/1896-14-0x00000193D7720000-0x00000193D793C000-memory.dmp

Download

memory/1896-3-0x00000193D56A0000-0x00000193D56B0000-memory.dmp

Download

memory/1896-2-0x00000193D56A0000-0x00000193D56B0000-memory.dmp

Download

memory/4136-224-0x000001A424DA0000-0x000001A424E92000-memory.dmp

Download

memory/4324-39-0x0000000005E60000-0x00000000061B4000-memory.dmp

Download

memory/4324-64-0x0000000007D10000-0x0000000007D3A000-memory.dmp

Download

memory/4324-48-0x0000000007630000-0x00000000076C6000-memory.dmp

Download

memory/4324-75-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4324-49-0x00000000076F0000-0x0000000007712000-memory.dmp

Download

memory/4324-50-0x0000000008460000-0x0000000008A04000-memory.dmp

Download

memory/4324-51-0x00000000077A0000-0x00000000077D2000-memory.dmp

Download

memory/4324-52-0x00000000702D0000-0x000000007031C000-memory.dmp

Download

memory/4324-53-0x0000000070A70000-0x0000000070DC4000-memory.dmp

Download

memory/4324-61-0x0000000007BA0000-0x0000000007BBE000-memory.dmp

Download

memory/4324-62-0x0000000007BD0000-0x0000000007C73000-memory.dmp

Download

memory/4324-63-0x0000000007CD0000-0x0000000007CDA000-memory.dmp

Download

memory/4324-72-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4324-73-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4324-74-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4324-67-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4324-66-0x0000000007BB0000-0x0000000007BB8000-memory.dmp

Download

memory/4324-65-0x0000000007D40000-0x0000000007D64000-memory.dmp

Download

memory/4600-30-0x00000000063D0000-0x000000000641C000-memory.dmp

Download

memory/4600-32-0x0000000006900000-0x000000000691A000-memory.dmp

Download

memory/4600-15-0x0000000002E40000-0x0000000002E76000-memory.dmp

Download

memory/4600-16-0x0000000005730000-0x0000000005D58000-memory.dmp

Download

memory/4600-17-0x00000000055F0000-0x0000000005612000-memory.dmp

Download

memory/4600-18-0x0000000005690000-0x00000000056F6000-memory.dmp

Download

memory/4600-19-0x0000000005D60000-0x0000000005DC6000-memory.dmp

Download

memory/4600-27-0x0000000005E50000-0x00000000061A4000-memory.dmp

Download

memory/4600-29-0x0000000006380000-0x000000000639E000-memory.dmp

Download

memory/4600-31-0x0000000007D30000-0x00000000083AA000-memory.dmp

Download

memory/4972-81-0x0000000005110000-0x000000000515C000-memory.dmp

Download

memory/4972-276-0x0000000006380000-0x0000000006392000-memory.dmp

Download

memory/4972-78-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/4972-77-0x0000000004B90000-0x0000000004C60000-memory.dmp

Download

memory/4972-79-0x0000000004E40000-0x0000000004EBC000-memory.dmp

Download

memory/4972-80-0x0000000004EC0000-0x0000000004F98000-memory.dmp

Download

memory/4972-76-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/4972-83-0x0000000005A30000-0x0000000005B22000-memory.dmp

Download

memory/4972-84-0x0000000005BE0000-0x0000000005C12000-memory.dmp

Download

memory/4972-86-0x0000000006160000-0x00000000061F2000-memory.dmp

Download

memory/4972-87-0x00000000063B0000-0x0000000006400000-memory.dmp

Download

memory/4972-277-0x0000000006590000-0x0000000006606000-memory.dmp

Download

memory/4972-278-0x00000000064C0000-0x00000000064DE000-memory.dmp

Download