67e91defa449abcbcc0df237c1db78b3f63753ccdca88b4fdb50d3eb27a23dc4

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW ORDER-SUNNY 5916081940.js
Size 1.4MB
Sample260804-n7mtjaaf66
SHA256 67e91defa449abcbcc0df237c1db78b3f63753ccdca88b4fdb50d3eb27a23dc4
MD5 44fd8f8fed2ee73ff173b1904f10ccb4
SHA1 c12b1340bf1294d6e3d55212b24f5248d6679e42
SHA512 6b361a4a623980a22ed59c8ab4e03c5ef4ef63bf26e645590f4309f14d8cd50f3de3759ea543ae46a6c0bdda35456784af0d627b24b5a06f3dd42eb79330c112
SSDEEP 24576:DOZPGh43so97ZNveUdvHC6aPtY+rNtKE6Lt2dxeUJDaa0x8XpWs7QbDtY:jh01hHKWzmMUaYg3u
TLSH
T1A5652321AF8A68FF8A085061A50BC6540536EEC15066FC6E3B863DF5EA29F473FC5B05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1920	powershell.exe
624	powershell.exe
3764	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\prevhost.lnk	prevhost.exe

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4736	cmd.exe
4384	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4480	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
1920	powershell.exe
1920	powershell.exe
624	powershell.exe
624	powershell.exe
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
5788	chrome.exe
5788	chrome.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4480	chrome.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe
4256	prevhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeIncreaseQuotaPrivilege	3764	powershell.exe
Token: SeSecurityPrivilege	3764	powershell.exe
Token: SeTakeOwnershipPrivilege	3764	powershell.exe
Token: SeLoadDriverPrivilege	3764	powershell.exe
Token: SeSystemProfilePrivilege	3764	powershell.exe
Token: SeSystemtimePrivilege	3764	powershell.exe
Token: SeProfSingleProcessPrivilege	3764	powershell.exe
Token: SeIncBasePriorityPrivilege	3764	powershell.exe
Token: SeCreatePagefilePrivilege	3764	powershell.exe
Token: SeBackupPrivilege	3764	powershell.exe
Token: SeRestorePrivilege	3764	powershell.exe
Token: SeShutdownPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeSystemEnvironmentPrivilege	3764	powershell.exe
Token: SeRemoteShutdownPrivilege	3764	powershell.exe
Token: SeUndockPrivilege	3764	powershell.exe
Token: SeManageVolumePrivilege	3764	powershell.exe
Token: 33	3764	powershell.exe
Token: 34	3764	powershell.exe
Token: 35	3764	powershell.exe
Token: 36	3764	powershell.exe
Token: SeIncreaseQuotaPrivilege	3764	powershell.exe
Token: SeSecurityPrivilege	3764	powershell.exe
Token: SeTakeOwnershipPrivilege	3764	powershell.exe
Token: SeLoadDriverPrivilege	3764	powershell.exe
Token: SeSystemProfilePrivilege	3764	powershell.exe
Token: SeSystemtimePrivilege	3764	powershell.exe
Token: SeProfSingleProcessPrivilege	3764	powershell.exe
Token: SeIncBasePriorityPrivilege	3764	powershell.exe
Token: SeCreatePagefilePrivilege	3764	powershell.exe
Token: SeBackupPrivilege	3764	powershell.exe
Token: SeRestorePrivilege	3764	powershell.exe
Token: SeShutdownPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeSystemEnvironmentPrivilege	3764	powershell.exe
Token: SeRemoteShutdownPrivilege	3764	powershell.exe
Token: SeUndockPrivilege	3764	powershell.exe
Token: SeManageVolumePrivilege	3764	powershell.exe
Token: 33	3764	powershell.exe
Token: 34	3764	powershell.exe
Token: 35	3764	powershell.exe
Token: 36	3764	powershell.exe
Token: SeIncreaseQuotaPrivilege	3764	powershell.exe
Token: SeSecurityPrivilege	3764	powershell.exe
Token: SeTakeOwnershipPrivilege	3764	powershell.exe
Token: SeLoadDriverPrivilege	3764	powershell.exe
Token: SeSystemProfilePrivilege	3764	powershell.exe
Token: SeSystemtimePrivilege	3764	powershell.exe
Token: SeProfSingleProcessPrivilege	3764	powershell.exe
Token: SeIncBasePriorityPrivilege	3764	powershell.exe
Token: SeCreatePagefilePrivilege	3764	powershell.exe
Token: SeBackupPrivilege	3764	powershell.exe
Token: SeRestorePrivilege	3764	powershell.exe
Token: SeShutdownPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeSystemEnvironmentPrivilege	3764	powershell.exe
Token: SeRemoteShutdownPrivilege	3764	powershell.exe
Token: SeUndockPrivilege	3764	powershell.exe
Token: SeManageVolumePrivilege	3764	powershell.exe
Token: 33	3764	powershell.exe
Token: 34	3764	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5788	chrome.exe
5788	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 4736	3868	wscript.exe	89
PID 4736 wrote to memory of 1920	4736	cmd.exe	91
PID 1920 wrote to memory of 4384	1920	powershell.exe	92
PID 4384 wrote to memory of 624	4384	cmd.exe	94
PID 4384 wrote to memory of 124	4384	cmd.exe	95
PID 4384 wrote to memory of 3764	4384	cmd.exe	96
PID 3764 wrote to memory of 4256	3764	powershell.exe	99
PID 3764 wrote to memory of 4256	3764	powershell.exe	99
PID 3764 wrote to memory of 4256	3764	powershell.exe	99
PID 4256 wrote to memory of 5788	4256	prevhost.exe	101
PID 5788 wrote to memory of 1044	5788	chrome.exe	102
PID 5788 wrote to memory of 2292	5788	chrome.exe	103
PID 5788 wrote to memory of 4480	5788	chrome.exe	104
PID 5788 wrote to memory of 5392	5788	chrome.exe	105
PID 5788 wrote to memory of 5032	5788	chrome.exe	106
PID 5788 wrote to memory of 4800	5788	chrome.exe	107
PID 5788 wrote to memory of 3252	5788	chrome.exe	108
PID 5788 wrote to memory of 4956	5788	chrome.exe	109
PID 5788 wrote to memory of 2660	5788	chrome.exe	110
PID 5788 wrote to memory of 1512	5788	chrome.exe	111
PID 5788 wrote to memory of 124	5788	chrome.exe	112
PID 4256 wrote to memory of 4480	4256	prevhost.exe	104
PID 4256 wrote to memory of 4480	4256	prevhost.exe	104

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
124	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\NEW ORDER-SUNNY 5916081940.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\KCXEHFUNHU.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:QQIQNDKZDMCN))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Temp\KCXEHFUNHU.cmd" YGGRTYFL"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:PUPGAH))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\net_profile\net_profile.cfg"
        5⤵
        Views/modifies file attributes
        
        PID:124
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:LMRQVAO))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3764
      - C:\Windows\SysWOW64\prevhost.exe
        
        "C:\Windows\SysWOW64\prevhost.exe"
        6⤵
        Creates a file in the Startup directory
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:4256
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5788
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd8c80c728,0x7ffd8c80c734,0x7ffd8c80c740
        8⤵
        
        PID:1044
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1628,i,10308036688870205087,16365497510841440472,262144 --field-trial-handle=2004,i,5722543674396762467,3798083553751754315,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
        8⤵
        
        PID:2292
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,8580439700673220538,13869833366009781256,524288 --field-trial-handle=2004,i,5722543674396762467,3798083553751754315,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
        8⤵
        System Time Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4480
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg" --force-high-res-timeticks=disabled --metrics-shmem-handle=2096,i,670780061184906157,1218875287459276911,524288 --field-trial-handle=2004,i,5722543674396762467,3798083553751754315,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:13
        8⤵
        
        PID:5392
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2956,i,17214218907560258557,11733448330268262922,2097152 --field-trial-handle=2004,i,5722543674396762467,3798083553751754315,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:1
        8⤵
        
        PID:5032
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2960,i,17480136648701214128,16267467352907988701,2097152 --field-trial-handle=2004,i,5722543674396762467,3798083553751754315,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:1
        8⤵
        
        PID:4800
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3200,i,4627081880696101879,2149539127799553179,2097152 --field-trial-handle=2004,i,5722543674396762467,3798083553751754315,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
        8⤵
        
        PID:3252
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3212,i,13938557072111550149,2419573469213299409,2097152 --field-trial-handle=2004,i,5722543674396762467,3798083553751754315,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:9
        8⤵
        
        PID:4956
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3704,i,11025861051994903053,17494344488840165342,2097152 --field-trial-handle=2004,i,5722543674396762467,3798083553751754315,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:9
        8⤵
        
        PID:2660
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4224,i,9539875103411347112,267075543176514861,2097152 --field-trial-handle=2004,i,5722543674396762467,3798083553751754315,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
        8⤵
        
        PID:1512
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg" --force-high-res-timeticks=disabled --metrics-shmem-handle=4348,i,17758817762784763051,12938529925993673073,524288 --field-trial-handle=2004,i,5722543674396762467,3798083553751754315,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
        8⤵
        
        PID:124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3016

C:\Windows\SysWOW64\prevhost.exe
C:\Windows\SysWOW64\prevhost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e14a7b28afff95b70ba849207619ff903c6ea821b8cf2c12b589579a7d7d3af
MD5 099f7306d2e129f2a3dd4a124f5e9f61
SHA1 d5f10a991ea12b52de9b43832ff344766835e8a1
SHA512 9914dea58ce264b1a34f795aa57129779222f50fd7f4c658a649e1cfc84042af732389bfff477919dc04b802c28ff404225883f52a43fce8da7c5b0ee550054c
TLSH
T108215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 eccb06072d8ae2a50bc475b4830840f8d1bdc9a2cf5e09040a04522638697095
MD5 835a56cf19b16d58f6b9002c87f1746b
SHA1 aa6e21ea0ca3549b565b1e6ff339110559093903
SHA512 0d2b5994e41ef9672023e4a385f8772f265009901d5ba2db20a9e7edd5a89d74233642ad2108045a797384b3ec2e42749f168d32189b0280bc61fd80f0588c1f
SSDEEP 384:M1TBaGV1iXy4b0yxh6F+gFW0zCar8xntIAbk4caGtIWjq76okwjNRFzvsbhNnk/A:oTnfOroEh6F+XgQvIAbkBaGt/a6ok2Fo
TLSH
T18D829768123FBDC7D8D126B411D602E7FBE4E048DA7551A4EF2BDE2B1C90BBB4E61520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KCXEHFUNHU.cmd

Path C:\Users\Admin\AppData\Local\Temp\KCXEHFUNHU.cmd
Size 1.4MB
SHA256 56f9838fc2f71362f5f108538918a81aeaf9f6d0c31b285837661148cbb0f98e
MD5 58916b956311b5218adae332b1f36fb6
SHA1 2f0a46d93f6834bf3c57a36f6bc3923f254ec13f
SHA512 953e283c8495fd75e23fbce2c391a9dae16912b38e0cf1379a7d9e5f1da87e3812490585aa272a6e3bbf6769456bd2b0e9265ea6cda1e472695284b47abbde21
SSDEEP 24576:VmxhMRSjkoHbHxfeydZr2QKrRsUj3l0wKLtYn5eKJxEcERud9c+TCZ7tk:nRCDFtgmT6U+EkuhS
TLSH
T10F652330BF8E5DEF8A4C5466721A8A480226EFD1537BE8FE33843AD55D09B575E06F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_33krnjsy.jx3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_33krnjsy.jx3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Crashpad\settings.dat
Size 40B
SHA256 0e8866fbf507e25ffbed533fefce121afadadda989c5e91720ca1f1b1ebcefc0
MD5 7195d290dc24037b3e2bf10537cf6255
SHA1 b5ec11a4799f343e368a0ce1bfacbdfb050112cf
SHA512 b0d1ab5755f7e1920c5a5fdec3958430082d6317f3eec407135f4d141243945a573bae3550335746615f9c1142d1385cf41dc604b063ad967cacb132519efe25
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 71ed3000a258baafb197e3bb39de85db2df422403c6c4878c517ec49e8fbd98c
MD5 932aa5b04a3c5439a4dcb627f43499ca
SHA1 6ee7cc0fb1a2a8ae755978832ba2b9436011593b
SHA512 6885855f38c68bab6c5ee9699bf374cea8a090f620ca29008234c112f8b05225bc0f9ae818f133ec6e9950d04ca4df20544aa3b3c2662e10a6f65a78befbb303
SSDEEP 6:/FoEXErdO3kNYBPP3+IoToE3kx65ycSRFGckEXeKuqk4qGOkllkCFGPp:d7XCMUNYBPP3+IocX8y5HkEeE/9Y
TLSH
T131135E2D9B411E0AFA8B313F498B1FB057B1541CC25297434034B420E01AB63D01E030
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 421664f551c8351435f795470831ef423999b19833839bd724d88d43a165a4a0
MD5 e9ba91bfcbe18b82420b63d52de4cbd2
SHA1 88ed9b64f8b443d068fc413e408362708e598af0
SHA512 39b9c534dedf55a10f26f5739243b544e68ec819c5b47858613b63dca45ff609ce1f88955ad8995cc0c4d8a59b5934f2ecfbe8d9905152dec074993de495dad0
SSDEEP 48:folKNYriP3zNblQaVM1XgUXxUMXTOMmXJ2dVEPLVBKWwtl:QRrw5blQqugUxrXTOjeVOLHKWol
TLSH
T1E444D9F72C09DEC6EB19CAB85D41523C8E3286162C99FDB9F53844F291509E371386B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 5c530d4d12fc3327148854196e99be84f2d8fbe4cc0bc457fb81fa4032828136
MD5 7b922ef2807e0229a6d3475e82e49639
SHA1 3f755950cdd53d059e333343d5513e44a0e0a863
SHA512 8c68ec2387cb45bcbff67fa60f3b41d323f3187812d06416d0b46899a738fd06d3b1a30a90d031477ed5af2ed95ca6c2e3271963c4d67a1b8d97d3e99ebcef87
SSDEEP 768:iUfDPLSgcRUv+X4iUfDPLSgcRUv+M4UWfDPLSgcRUv+B4dUfDPLSgcRUv+g4ffza:QCV58z7zd/RxzHz
TLSH
T189165DB74F686946E785EFB0BBC9DD1C3CB02396EC935892F11392694AE0FC41B8511E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 6201ec5754ae3b3f007126180e200b35de452e0106779a04a02814028ca30c2d
MD5 ab45fc51f89893a7e07d31158f4e0849
SHA1 4e49ef5c6724565f973168234e0d241caeda09a3
SHA512 c0bb0a2d36e4c68109d9e1de6998e7652450507b4d4ed58bb942c59d4b4be0a05bc16c66888f2f5ec89d308d62159b4b4230c03e415ac749545711444b5df846
SSDEEP 768:pWjPVVVSkI0O/tR3m7RZ+uukiXddZ2SodvDz95lUCdZAGYtKXv:poWaL+uukgkS2vDlUsv
TLSH
T1F003F12C7A45A16BE9A0B47F14F345CB46E5B1F8964745D2CA37418C07CE2A30E4BEFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Cache\Cache_Data\f_000002
Size 71KB
SHA256 99ff0be776dea84eaa37ec69b52f6304cd4b37a60677782d9b505b70183b8de4
MD5 9cabca241ae51db3e05f219326a7f445
SHA1 7242a774a9abca60ad895da8e88691b963bc9a43
SHA512 f121a88d2869d4ecb7c3daa69938d7116f237060ff4126e9f9eb3a7ef2f2e8e041a6b1399f8042e9c3560fc1930249add9662d56088e32c739e8210489094b14
SSDEEP 1536:4W7XKPClEZFrypihpDlvQ3Q1WIk4Yfzea3ajKp7FJlcvyPy1:4W7aayl1Wf4SOj1KPy1
TLSH
T1056302C496F6CB8AE7F320CFC84802A6FF045BEEDDD434A9BA791894E990605FF85145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Cache\Cache_Data\index
Size 256KB
SHA256 b68d4d0d9ea3b912f41a3289f20ae9266d5c23457591035cfd867a6c6360cc76
MD5 9c90b69455208208af914ca2dc9657ec
SHA1 fd83c2e5489a117d2bf066928fea55c888169957
SHA512 ecd31a7effc358112e06b1a2b488593a77de6919f5dc4fbd6ca52a4a7ce54e998c84c4d5680d9150e152b4b167505ef90871ba9cbbe5ff57cd34ecce84e73b63
SSDEEP 3:LsLllFlklNllklkXl8KXHL//ollLll/njNtlmNtl3Nl/lOll//Al5llll/9lXl:LsRa3lP8KXMdkNH0lt6lll
TLSH
T1D744125F87441E05C3C401FD804347207334C404DB4FC303030031102CC13401D0F054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 1e53364d0ad730fbd73402bfcbad57338c944967946d83a08cfbb5f3e0d6e458
MD5 3a6c310d2b56706365ddc818bcac4360
SHA1 ca5ecd1ec583bf0597a8720a5bd5399c1aa4d939
SHA512 51a9038fbd1cff2bc430b9a8fdeb8e68d006af71939d7ada0098d05a0ee48c12d4ad9a16d3d0b9e851aa2e5a4f42a8a849f3740ec800b688355182404140d10c
TLSH
T1F0E02B81868C0F1DD32D96F7CDE603054B0B43D429BE3A03A980C6C637128381248123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 67d18139a13f5f6ddc7c734821e75380723c3f59aed383cd1023a10775930b3b
MD5 8562c6f601a0bfac0b58fae3ea42dbdd
SHA1 a19f805097485c77701aa5f64a6bab5be88e6e43
SHA512 392dac2c5927e5d0e1203c1b001d8a35a2fad9ff83d300146b0706cc83e585318db07c69f68320974b1c9950a5c1864101b3108dad7022c2b9a2a65b3818239f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 334a833367415d2d4fc01c0f21bc2e3225964d11968d195f5e73340506a3544a
MD5 2d9705cbd93a3c6904e555ecb75369b1
SHA1 8e341e6803951c1cbc05d6fbd4d6eb8db65f2a1e
SHA512 be21e80992aa5069d5beaccf23f5fa70ec842e1fe78d97bb803f7ae9b517fd4bbfcf8cef38ebdfccddfeec46a2ff34dde239c434878e4818cd496c6c759671f5
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\DawnGraphiteCache\index
Size 256KB
SHA256 e1757d268cf627954f72685a571547592907d024326fa57a91250214838f8b19
MD5 c88c169e91c15a1a5a277746b5f15a70
SHA1 e5186e5aa7106728f2677c1be1d7de5ed9d0d882
SHA512 67231e310db03d96c2caacb03c493b9cf23f9cee765c2cd5242e490dcf10ee616eeef7acb075db72950913a10026837c805a68d5f637a318ef0824351ae4b720
SSDEEP 3:LstlNllklkXl7TKlt:LsX3lPX+
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\DawnWebGPUCache\index
Size 256KB
SHA256 8a6e989e77a924fbd22281ffd4452b74f8776ae6a21c2583f601cb299dafae3c
MD5 8d87bacc2aa2472210fe97e1922ccb6c
SHA1 b477a247903a24c98cc8bc5c0cc4cba0539afa05
SHA512 181edf35142d5161971916443a99ce1b1ddc132c1b9ce4bf68fb022bba1b1b87da350885b0b01c4ff7f8e946d6ace1f0e6e0f793048a6787a51273d579589cde
SSDEEP 3:LstlNllklkXl+PoTK//:LsX3lP+PoG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\GPUCache\index
Size 256KB
SHA256 e470a6779abc50f3413ba8b0dd75da00494f8b3aed9921cff68b62cd16ef43de
MD5 3d1337204e9b3b5e9d57a03ed98c59bc
SHA1 291957cf5eaaf1d89966f99b15ecf891eb379441
SHA512 0108f5c5fc7fd5421e332af9e077cc0cc5d530a60ee939f7021837108b03e26a699e60a210dfdf3d1eaf4a7ce1e5d2e19ae0b5a577331945686616c6f07c75ad
SSDEEP 3:LstlNllklkXl2dOq:LsX3lP2o
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 fa009e497358dac8229118436212ad5a17efcbd49126968980778f490858c18c
MD5 1063f49574904619b97a3ad8be866c49
SHA1 799ecd9b511f8341b7471242155a2a23e99eaced
SHA512 35d5a7194ad685eda8e0d8fe2f45b60018823b26542cd1ab785f60c53910091e089381463a823f6c9f27790fffa0f4a56c8acae3ffd9f05619c09fff7e309589
TLSH
T1A7A0022507519211D10203B17C0193C81200BD25C500061376D14387CCA00508915588
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 328218dbd716515c24248b4f7c0ad97ebc4560a7e14473904343ef78f1bf3774
MD5 fbd3fd8203c445c0897c35b112ec79da
SHA1 7cb5a504ffcf600da52c0ba701032311a56205bc
SHA512 47e5354fe000dbb0a18b8b7072b6f3e03f739a79596b1c186095f90b060ecbf50a66c52cced280d77f91d2ddae376bc65149f3716fbcd258b7dd90e9fa509d05
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mii5iabx.uzg\GraphiteDawnCache\index
Size 256KB
SHA256 3a072335aef3bcab5c241444d7932b901979120b3eda30df20b916652a86cd2a
MD5 03c549692e6d1476f6566d832bd58f53
SHA1 83c0240dce8b3c64de3e322fd29ee50e4e9eb402
SHA512 ef9dfcedf09f6f6b30b1683df67a61a16ed597f9519328c080a551a138ba896dd598217716ed5a1c134cce3701375fb441c2b0a82c5a09e311edd501ac097c20
SSDEEP 3:LstlNllklkXlzOq:LsX3lP6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/624-28-0x0000000005BE0000-0x0000000005BFE000-memory.dmp

Download

memory/624-19-0x0000000004840000-0x0000000004876000-memory.dmp

Download

memory/624-30-0x0000000007410000-0x0000000007A8C000-memory.dmp

Download

memory/624-29-0x0000000005C40000-0x0000000005C8C000-memory.dmp

Download

memory/624-26-0x0000000005830000-0x0000000005B8B000-memory.dmp

Download

memory/624-23-0x0000000005590000-0x00000000055F6000-memory.dmp

Download

memory/624-31-0x0000000006190000-0x00000000061AA000-memory.dmp

Download

memory/624-22-0x0000000005520000-0x0000000005586000-memory.dmp

Download

memory/624-21-0x0000000004CD0000-0x0000000004CF2000-memory.dmp

Download

memory/624-20-0x0000000004ED0000-0x000000000551A000-memory.dmp

Download

memory/1920-6-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-11-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-13-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-15-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-18-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-16-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-12-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-14-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-10-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-9-0x00000254497E0000-0x0000025449802000-memory.dmp

Download

memory/1920-5-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-4-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-3-0x00007FFD8AEA0000-0x00007FFD8B844000-memory.dmp

Download

memory/1920-2-0x00007FFD8B02F000-0x00007FFD8B030000-memory.dmp

Download

memory/3764-37-0x0000000007860000-0x00000000078F6000-memory.dmp

Download

memory/3764-46-0x0000000007C30000-0x0000000007CD3000-memory.dmp

Download

memory/3764-38-0x0000000007790000-0x00000000077B2000-memory.dmp

Download

memory/3764-45-0x0000000007C00000-0x0000000007C20000-memory.dmp

Download

memory/3764-35-0x0000000005F70000-0x00000000062CB000-memory.dmp

Download

memory/3764-40-0x0000000007900000-0x0000000007936000-memory.dmp

Download

memory/3764-41-0x0000000070830000-0x000000007087C000-memory.dmp

Download

memory/3764-42-0x0000000070A90000-0x0000000070DEB000-memory.dmp

Download

memory/3764-39-0x0000000008560000-0x0000000008B1A000-memory.dmp

Download

memory/3764-56-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/3764-47-0x0000000007D20000-0x0000000007D2A000-memory.dmp

Download

memory/3764-48-0x0000000007EB0000-0x0000000007EDA000-memory.dmp

Download

memory/3764-49-0x0000000009F20000-0x0000000009F44000-memory.dmp

Download

memory/3764-50-0x0000000007AF0000-0x0000000007AF8000-memory.dmp

Download

memory/3764-51-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/3764-59-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/3764-58-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/3764-57-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4256-71-0x00000000069F0000-0x0000000006A40000-memory.dmp

Download

memory/4256-67-0x0000000006040000-0x0000000006132000-memory.dmp

Download

memory/4256-62-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/4256-61-0x0000000005060000-0x0000000005130000-memory.dmp

Download

memory/4256-63-0x0000000005390000-0x000000000540C000-memory.dmp

Download

memory/4256-64-0x0000000005410000-0x00000000054E8000-memory.dmp

Download

memory/4256-65-0x0000000005690000-0x00000000056DC000-memory.dmp

Download

memory/4256-60-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/4256-264-0x0000000006990000-0x00000000069A2000-memory.dmp

Download

memory/4256-68-0x00000000061F0000-0x0000000006222000-memory.dmp

Download

memory/4256-70-0x0000000006780000-0x0000000006812000-memory.dmp

Download

memory/4256-266-0x0000000006A80000-0x0000000006A9E000-memory.dmp

Download

memory/4256-265-0x0000000006BA0000-0x0000000006C16000-memory.dmp

Download

memory/4480-206-0x0000024173860000-0x0000024173952000-memory.dmp

Download