91d11cc708062cb170b494402585ae7056f2f285bc5b43914705bdf76d6a728f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
revised order qty for CP024.js
Size 1.1MB
Sample260804-p6pr6sbc45
SHA256 91d11cc708062cb170b494402585ae7056f2f285bc5b43914705bdf76d6a728f
MD5 4ddf6896dd06dad8cdccc908ddcd9eb2
SHA1 a2a29043106888e88d12b2fb79c96afd2b86bb46
SHA512 c7e045c84c8bbcf648b83ae89666f06f0d065d90c3a24e07d50e95255ce236a883649174e1638f566d6cafe098f28352c436b6b0aac35b4e91b3e97f3cdefbb5
SSDEEP 24576:7UWUH0PoHSRY5/1xde/dk2pJl7ENwb+IiPoYSqV7MIEN8WupKNtvdb:OH9VNxo/dk6hJigs1k8HpWt
TLSH
T12D4522C10FC2ADBE2C0CD114A122B96E0777BAD31916D85B3A1578675FDB207BE8E784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4332	powershell.exe
3228	powershell.exe
4544	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	wscript.exe

Accesses Microsoft Outlook profiles 1 TTPs 39 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2304	cmd.exe
3272	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1096	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4332	powershell.exe
4332	powershell.exe
3228	powershell.exe
3228	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
1728	chrome.exe
1728	chrome.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
1968	chrome.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe
228	prevhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeIncreaseQuotaPrivilege	4544	powershell.exe
Token: SeSecurityPrivilege	4544	powershell.exe
Token: SeTakeOwnershipPrivilege	4544	powershell.exe
Token: SeLoadDriverPrivilege	4544	powershell.exe
Token: SeSystemProfilePrivilege	4544	powershell.exe
Token: SeSystemtimePrivilege	4544	powershell.exe
Token: SeProfSingleProcessPrivilege	4544	powershell.exe
Token: SeIncBasePriorityPrivilege	4544	powershell.exe
Token: SeCreatePagefilePrivilege	4544	powershell.exe
Token: SeBackupPrivilege	4544	powershell.exe
Token: SeRestorePrivilege	4544	powershell.exe
Token: SeShutdownPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeSystemEnvironmentPrivilege	4544	powershell.exe
Token: SeRemoteShutdownPrivilege	4544	powershell.exe
Token: SeUndockPrivilege	4544	powershell.exe
Token: SeManageVolumePrivilege	4544	powershell.exe
Token: 33	4544	powershell.exe
Token: 34	4544	powershell.exe
Token: 35	4544	powershell.exe
Token: 36	4544	powershell.exe
Token: SeIncreaseQuotaPrivilege	4544	powershell.exe
Token: SeSecurityPrivilege	4544	powershell.exe
Token: SeTakeOwnershipPrivilege	4544	powershell.exe
Token: SeLoadDriverPrivilege	4544	powershell.exe
Token: SeSystemProfilePrivilege	4544	powershell.exe
Token: SeSystemtimePrivilege	4544	powershell.exe
Token: SeProfSingleProcessPrivilege	4544	powershell.exe
Token: SeIncBasePriorityPrivilege	4544	powershell.exe
Token: SeCreatePagefilePrivilege	4544	powershell.exe
Token: SeBackupPrivilege	4544	powershell.exe
Token: SeRestorePrivilege	4544	powershell.exe
Token: SeShutdownPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeSystemEnvironmentPrivilege	4544	powershell.exe
Token: SeRemoteShutdownPrivilege	4544	powershell.exe
Token: SeUndockPrivilege	4544	powershell.exe
Token: SeManageVolumePrivilege	4544	powershell.exe
Token: 33	4544	powershell.exe
Token: 34	4544	powershell.exe
Token: 35	4544	powershell.exe
Token: 36	4544	powershell.exe
Token: SeIncreaseQuotaPrivilege	4544	powershell.exe
Token: SeSecurityPrivilege	4544	powershell.exe
Token: SeTakeOwnershipPrivilege	4544	powershell.exe
Token: SeLoadDriverPrivilege	4544	powershell.exe
Token: SeSystemProfilePrivilege	4544	powershell.exe
Token: SeSystemtimePrivilege	4544	powershell.exe
Token: SeProfSingleProcessPrivilege	4544	powershell.exe
Token: SeIncBasePriorityPrivilege	4544	powershell.exe
Token: SeCreatePagefilePrivilege	4544	powershell.exe
Token: SeBackupPrivilege	4544	powershell.exe
Token: SeRestorePrivilege	4544	powershell.exe
Token: SeShutdownPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeSystemEnvironmentPrivilege	4544	powershell.exe
Token: SeRemoteShutdownPrivilege	4544	powershell.exe
Token: SeUndockPrivilege	4544	powershell.exe
Token: SeManageVolumePrivilege	4544	powershell.exe
Token: 33	4544	powershell.exe
Token: 34	4544	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2304	2740	wscript.exe	85
PID 2304 wrote to memory of 4332	2304	cmd.exe	87
PID 4332 wrote to memory of 3272	4332	powershell.exe	88
PID 3272 wrote to memory of 3228	3272	cmd.exe	90
PID 3272 wrote to memory of 2544	3272	cmd.exe	91
PID 3272 wrote to memory of 4544	3272	cmd.exe	92
PID 4544 wrote to memory of 228	4544	powershell.exe	95
PID 4544 wrote to memory of 228	4544	powershell.exe	95
PID 4544 wrote to memory of 228	4544	powershell.exe	95
PID 228 wrote to memory of 1728	228	prevhost.exe	100
PID 1728 wrote to memory of 1872	1728	chrome.exe	101
PID 1728 wrote to memory of 732	1728	chrome.exe	102
PID 1728 wrote to memory of 1096	1728	chrome.exe	103
PID 1728 wrote to memory of 4912	1728	chrome.exe	104
PID 1728 wrote to memory of 3220	1728	chrome.exe	105
PID 1728 wrote to memory of 2856	1728	chrome.exe	106
PID 1728 wrote to memory of 1968	1728	chrome.exe	107
PID 1728 wrote to memory of 2560	1728	chrome.exe	108
PID 1728 wrote to memory of 2428	1728	chrome.exe	109
PID 1728 wrote to memory of 2484	1728	chrome.exe	110
PID 1728 wrote to memory of 3300	1728	chrome.exe	111
PID 228 wrote to memory of 1968	228	prevhost.exe	107
PID 228 wrote to memory of 1968	228	prevhost.exe	107

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2544	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\revised order qty for CP024.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:QJJJYBW))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd" NHJOXIU"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3272
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:MRKVYH))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3228
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\shellbag_tmp\shellbag_tmp.cfg"
        5⤵
        Views/modifies file attributes
        
        PID:2544
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:WWXEIJQLXOX))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4544
      - C:\Windows\SysWOW64\prevhost.exe
        
        "C:\Windows\SysWOW64\prevhost.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:228
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffb4e63c728,0x7ffb4e63c734,0x7ffb4e63c740
        8⤵
        
        PID:1872
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1676,i,667607744064826616,15362888987157409607,262144 --field-trial-handle=2068,i,2457335202148869920,14452523747749890988,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
        8⤵
        
        PID:732
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk" --force-high-res-timeticks=disabled --metrics-shmem-handle=1928,i,11545924147242853889,14224430888123474669,524288 --field-trial-handle=2068,i,2457335202148869920,14452523747749890988,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:1096
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk" --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,3739629254211692849,4582435156969530531,524288 --field-trial-handle=2068,i,2457335202148869920,14452523747749890988,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:8
        8⤵
        
        PID:4912
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2812,i,10314851096963881821,15930079526041292314,2097152 --field-trial-handle=2068,i,2457335202148869920,14452523747749890988,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
        8⤵
        
        PID:3220
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2820,i,9797737687972167226,11832191488170989884,2097152 --field-trial-handle=2068,i,2457335202148869920,14452523747749890988,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
        8⤵
        
        PID:2856
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3140,i,16531661910385841663,8599340932628776569,2097152 --field-trial-handle=2068,i,2457335202148869920,14452523747749890988,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1968
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3172,i,11718310433117366765,16719095382768858947,2097152 --field-trial-handle=2068,i,2457335202148869920,14452523747749890988,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:2
        8⤵
        
        PID:2560
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3264,i,13187614217745071917,4516191000651147582,2097152 --field-trial-handle=2068,i,2457335202148869920,14452523747749890988,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
        8⤵
        
        PID:2428
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4132,i,16278553640831189449,636601604453630524,2097152 --field-trial-handle=2068,i,2457335202148869920,14452523747749890988,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:2
        8⤵
        
        PID:2484
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk" --force-high-res-timeticks=disabled --metrics-shmem-handle=4192,i,880055561806615891,712274991170426636,524288 --field-trial-handle=2068,i,2457335202148869920,14452523747749890988,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
        8⤵
        
        PID:3300

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8e7a3c31c491ae5b03b0b494b106369c8d22b0a80d3e399adff5e6e0147b9f71
MD5 3fa9ee7fe663ea396046c700ff03f727
SHA1 c2adc8667ca1693947f3238a9370b3b08cfd59f9
SHA512 9730719477b493452f709258b61f839468355c3ffbbc24537418f1cb873c8d892b2bff97cb98490178befa09900581c57ef025080b2881b2da03ba9f54293884
TLSH
T13A117623F39C8921CC96563A509D9C2172B683DB819FDF9F7FC0D205A5BF988CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 f193367aa3e542569c80ed8b8d910364f883f47734d5f72dbd436bdeadea8fe7
MD5 c766e289fd0e40efa9dab8dbc8eae9ba
SHA1 907f50c3ce591c21d4f82970d4458b7a3f49a575
SHA512 ee41c9ad192c01de69ce9929d5e59a53599944215065e8e251846844b0379e6781686daf30bcc97b0d0a7c208f0a5a8b074974b375157f25637bdc82ca4e7182
SSDEEP 384:Lrf+jI9p+FwysFMCBiefk+o9o2ToH6seYWZe2l/+C3Sof19u7DQFYcfrX3lVds8/:ffOmFjoNjo2To4ZpBSmu7DQFYcDFTsiH
TLSH
T12882C56E600F66C3C8D59378D007055FE4F2DE8D531A03D87B6E6E3B8AACA9ED02D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FPSBRXPD.cmd

Path C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd
Size 1.1MB
SHA256 db58a27399f1b15ebf0a7add7bc22e43c090ac2c7f62854279e911dd53bef48c
MD5 d67ec445aa68a97b8c7d296e180a0df9
SHA1 b2a6f935cc152de96f35a63bb6c2b3351c39ba7b
SHA512 5e8101eca48d1144d72c010abf813649bc9a0475596add4f182807822ba8f46df53d53a42d172dcc108998e178409776576013d4c2b0fe6e4d628d298a61c061
SSDEEP 24576:pai3A9udSTyt/TPdQnlyYpBlVMdA/SwEZAweKxlC+ofW4+1eXJ5Xv:F3bhLP6nlyoH9EGEbGWl1G/
TLSH
T1AA4523910FC2FD9D345852282143B9651B7BEFD72A6BE8DE3211B8A7658E203DF4E704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_y1tk0ecn.y1k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y1tk0ecn.y1k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Crashpad\settings.dat
Size 40B
SHA256 3c801259636d05a3f087545811ee3e9cebc9dba1288e58e9f172d71eee9f2056
MD5 5a3cb02953c7455adaa4339b4acef4fd
SHA1 65cdf6216a6642e5db2353bd2cad0f7ec549ebd2
SHA512 93ed00b135d1d30cc90ebc33feced31c66ba97b015c32607101b52d12e80b122e698d62d8b3f51de69b4d4aadab6c6e9b1877c4c0675bb5ef20f25a104ec8363
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 62fbacf2efe6d6e899598a5898febbc6f4c4f3d50493721351c8677c99e37a81
MD5 5b90884ba29e4777a116850a3020206a
SHA1 5a490d42743fedd3272de83dbdf120fba82b5cd7
SHA512 03bd274ce07047cb1ac63298e3029de1b44bbfac25ddd1df3b9834a18af7709898026fc976afde9e5179b377665f5e36c1a75b721b32f96f303d5de9172e30bf
SSDEEP 6:/FoEXEmlkNw0x1Au5El55QkvkEXqMkllydfsn:d7Xr+Nw4Su6XQ6kEqN/
TLSH
T19D135E2D87602D93C38424BCAD475B7C0373B225C26A4A1B4CB33A20E005B100C0D116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 811597904677529f856bbdf119f8d0a65edd5d9b41afe5a5ebae087fa2cc920c
MD5 7095cdde45c7e5d1014c4e4cdfece982
SHA1 e6d0d8b831478ff04dea912bf97852296b75272a
SHA512 91e14a52cfdaaf6ed40c26ddc1449305bc9b2b75524fd35cfda9e5d28cdcc773ae2c29d74ef460d1e2b5684f8db7cfd2bfdacf8e7d6bef24ee1f5bd0655fe335
SSDEEP 48:TMlyeYQT0P3zlblQaiM1XgUXCUfmMmXJ2dVEPLVBKWwtl:oc8yhblQFugUC+mjeVOLHKWol
TLSH
T14D44B6F72805DFC6DF18CAB81D41922C8E3256262CAAEDB9F53948E245509E771385B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f5835d5e3267f59435ffa4fff978725d9802989d5bd16cd87bd9f74087307fa0
MD5 b979f1dbbf7d229787e50100f5834a94
SHA1 3db2d94ff3deb678699bc813a554acfce5f897f4
SHA512 0623ef67c5578701be084497bd3bcfc7e990244826ef0d5f4a5615ec06e5cb3b288ffb907d80e1abcb4e57063d4084b8b429481967e99a81d6fc4d73831f70f2
SSDEEP 768:7fDPLSgcRUv+H4sUfDPLSgcRUv+94yUfDPLSgcRUv+S4ZUfDPLSgcRUv+C4QBz4h:GNA7Vz7zd/R+zYz
TLSH
T14C165CA64F687986D785EFB0BBC9DD1C3CB023D6EC925892F11392694AE0FC41B8511E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 19b52f4210e8e08ffd8a51bde3be63eced9fb8d49c5f6e3732109cdec853f49f
MD5 f1b06f3c2b7b5e2576f5d285426329cb
SHA1 b7ec56e92e084cdc2d60ef23de02eb65d8eee0ac
SHA512 432d1f101b4f17c4e62b9bb45f26134af64af5d2370e2706f30c17a1e28114824e34c71e1a47a26ae2cc29531de21bf6df340922deef195cf82687d2dacf0b6b
SSDEEP 768:Tx2OsbMr8ngObW6yGFQAalpSC6pxMo9PgmHRKQ+Yqac+cD:1WoiXbxFPaXSq2oQ+Yqac+cD
TLSH
T1E803F1E1FCC2725CC1D596F0240366D59B0BA8AC1C8057FC37B20C996B8F82FE6A7964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Cache\Cache_Data\f_000002
Size 71KB
SHA256 99ff0be776dea84eaa37ec69b52f6304cd4b37a60677782d9b505b70183b8de4
MD5 9cabca241ae51db3e05f219326a7f445
SHA1 7242a774a9abca60ad895da8e88691b963bc9a43
SHA512 f121a88d2869d4ecb7c3daa69938d7116f237060ff4126e9f9eb3a7ef2f2e8e041a6b1399f8042e9c3560fc1930249add9662d56088e32c739e8210489094b14
SSDEEP 1536:4W7XKPClEZFrypihpDlvQ3Q1WIk4Yfzea3ajKp7FJlcvyPy1:4W7aayl1Wf4SOj1KPy1
TLSH
T1056302C496F6CB8AE7F320CFC84802A6FF045BEEDDD434A9BA791894E990605FF85145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Cache\Cache_Data\index
Size 256KB
SHA256 0bbe23c73f05cb258ca120cc07321f0b1379b60e878414fe23fe27ad38ee03bc
MD5 0172475f6779f6853362a5b05d9f17a6
SHA1 da3b3711197f1caa1f186e992383789cf4856075
SHA512 58ed91a47f182ecbad15ff3566e243dba2d7dc96b0cab30590b7034ab3755db430db85760cdbe23d5c37fe37dd9ff59d4ad538488e8290b41afdcab892b444a4
SSDEEP 3:LsLllFlklNllklkXl2YllLll/ncNtlNlXl3Nl/lOll//Al5llll/ZNtl:LsRa3lPVyNt0lt6lllh
TLSH
T1CE4401AE9386AE1AD2D402FD84478B64A378D809DE8FC753570526202CC17956E0F264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 97271af811930c1b61c09c5625bed7a530a2a72afa49c3f079aa23ae083fe9cf
MD5 39300aed6a907c4251e97858c8b5ccf7
SHA1 b465a28afdab25ce8f87052e60483b99d0fbdc35
SHA512 6398d17a3960876e28696055503d1736ea01b514d26d36c3e0d4943bd54afd4e8a0d03d86af14a46c5b72ca66f02a4f30d56828c5ec0116c5a6de073d71b7082
TLSH
T164E02B81C68C1F1DD32DD6F7CDF643044A0A52C42ABE3603AC80C2C133528641248122
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6776c343130874cfbdea89aae5f643f44d23414659c8ea843f9d045935c695b6
MD5 82846975e1384ef1149175fcf0189b51
SHA1 0ab57decf7549865523869741c3fe3018d7be81c
SHA512 96106879d62e43542db8ae9219249f29467d672b468107d57001ed0924bbe2c8a4452566f2f88a9833ba7e018bbaeb126c229d2e7d2247e118aef18226c8deec
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 51cfd2633fe2b029eeca35d8b3a9a9f2a20c9ba082f3a45650387c5b1a618d67
MD5 1b3fc9caf8fb61b60d1c40e35a0a525f
SHA1 be0cdbdd5be5af151bdda658543d99dea1bc2015
SHA512 5e1a1605da46c28627b14acaef55227e41b0145acc6413d2faa46ce36de9a0fe0042dd977803e13fa06aef617caa22240d3131d018c048ba18d13566ac7f281c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\DawnGraphiteCache\index
Size 256KB
SHA256 9b1ef47ebf272076ceac14bba621c4f612b2073d3569e40258d13713566ac950
MD5 142b5325d52f9b01384fbd1c8b51ecfa
SHA1 89e42e118c8eddcc39be06b092baf8b3a833eafb
SHA512 c4c8af74fa25b52263e09c2117c536b092f37cc862a75cd59431e418ef8bdb7a1e4618a937fc5295fa6bdd25b39dd83c35964013d4ad41b6eed66867716d5668
SSDEEP 3:LstlNllklkXl:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\DawnWebGPUCache\index
Size 256KB
SHA256 90d69230317fc0b13d865d007ef84666acb628f586ccd2f30810a470db1ef9c3
MD5 41a4c252148549efe759f6802ba1c158
SHA1 210678db8c44d4a4cb807b12f9bd379cbacb41e6
SHA512 d350b612218ad4fb80fcc288188697bccb2067bd6aad9318e1bbc115eb579b8c9d02e123ee12389932746d1d639e028acc4f7a987b620cccf8566991d2ade38a
SSDEEP 3:LstlNllklkXlzK:LsX3lPz
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Extension Rules\LOG
Size 265B
SHA256 5243de99bcbb6559db4fd3d27ffb40b21c93e4d5304c4dfa8f58f7cc05aa6dff
MD5 f8695de5167b96ace0fff4aac56a8e05
SHA1 d667f864843170a7a2695e968cfa19a9de487424
SHA512 b2ac364e96cbd9cfd27a02eeecb7bdd227a380c9cfa7ddc348023db37724bb11c0f653fced13c5db9da6bb8561d798d378ccbd9e220cfa7128b2b748bf23482c
TLSH
T1DFD0120164978575065894B7FEB5A31DC790390CEF9977084B79C488301340DA759B59
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Favicons
Size 20KB
SHA256 02f23cca3ede27fcacdde46682238216ef51d66ca1a1da9dab48d9b0e9163f15
MD5 198e1617955c70ad9263e5ae041f3c36
SHA1 623233da85a56e3b75fbd55f5159d83f764db270
SHA512 ca7a586adc01389778c75ac85b1968f8604f39138362db57684b0ff7099be46653f8f98706b0f9aec9059d437a604b82021bc7be8c18dff6a7e60df89c40d2f0
SSDEEP 24:LLiwExh0GY/l1rWR1PmCx9fZjsBYuI+Qo66UwcEv+75fBmI:NeBmw6P1U1kmBmI
TLSH
T1F592AA075E387407EBA11E7D266A183A9E3FE26D9FA29CA4347410618CF8582D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\GPUCache\index
Size 256KB
SHA256 344a1f63268be212fe51ef665bafdb8d9715c94eaae7eb13a5187f5224df94dc
MD5 32d8e116b69f797cb6b03d10e46f2607
SHA1 059ef3d74c6ec6e086a444bc0526294961ed97f1
SHA512 f57c1a0a1c2d2032a0f1af017d4e0f41aeb6bed0152ecb27e80bc37a645cff30d226a7309e03fd0a3ced083ada5e3d28e6906fa54a1ed14cf061d5b3a3c8a56d
SSDEEP 3:LstlNllklkXlC:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\History
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Local Storage\leveldb\LOG
Size 279B
SHA256 18cee538f22001038f65e2b9db1bcd4dacf1e962cba8a9d96ff7cf2f0fbe2c55
MD5 7a3f1bbdbcc3f83e75e0e766c737d744
SHA1 9ed6be20a409d29d7229c5b516f416efa0b7333b
SHA512 97c3a46de987c7c06adc27065a890008fa9ae1070441290728fd7256c18b7cf93e445cc8405ae140fb7623e264c0309fa1b51f703b48dcc491cc04622056e6ad
TLSH
T109D0C210E09B86691708806BB72AB30DC774340CAF8ABB5D8FA5E88874464088750A87
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Login Data For Account
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Network\Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Network\Reporting and NEL
Size 36KB
SHA256 473cee21f162f3a7a25635fadf8a9264238ac53cf89f7bb67ede9fbcdc676cfc
MD5 56e8276cedbc027359e31311dd2f91ed
SHA1 5aead8213b1fdeb895b9d51975126c5527ed8949
SHA512 c6ae5450f3ec31cb87fe6deb33b79c9c7919f637343e93cd0866d52c9fdaf674ab82eec261d77aeb0da4a5ed9f2960431657474cde55067a8b49c58c5a12888b
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:uIEumQv8m1ccnvS6
TLSH
T195F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\Default\Network\Trust Tokens
Size 36KB
SHA256 61747eae344a1ed6b1bea06522e094eba6879049db5f918e55423dbd8981a881
MD5 f2a84020dd3bf7c981b9b69dc6b8951e
SHA1 362b54cbf3c0ad6473ca595d4b72930ad9268890
SHA512 75ef07c38033b51286eb208d494d3856e7238bf0b1e928c8c35b5ececa05e8b591fc908ff83f89a1695ba74ed2bd155e49d35222a8cfdf8dbe936daeed7ae1f9
SSDEEP 24:TLn3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T731DtX5nDOvyKDhU1cSB
TLSH
T1A5F2469BA93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\j3c4svmv.luk\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-76-0x0000000005240000-0x00000000052E2000-memory.dmp

Download

memory/228-75-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/228-77-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/228-276-0x00000000065F0000-0x0000000006602000-memory.dmp

Download

memory/228-78-0x00000000054B0000-0x0000000005578000-memory.dmp

Download

memory/228-79-0x0000000005E10000-0x0000000005F02000-memory.dmp

Download

memory/228-80-0x0000000005AB0000-0x0000000005AB6000-memory.dmp

Download

memory/228-81-0x00000000060D0000-0x0000000006102000-memory.dmp

Download

memory/228-82-0x0000000006100000-0x000000000614C000-memory.dmp

Download

memory/228-84-0x0000000006630000-0x00000000066C2000-memory.dmp

Download

memory/228-86-0x0000000006840000-0x0000000006890000-memory.dmp

Download

memory/1968-224-0x0000019BF7080000-0x0000019BF7172000-memory.dmp

Download

memory/3228-18-0x00000000054C0000-0x0000000005526000-memory.dmp

Download

memory/3228-14-0x0000000004640000-0x0000000004676000-memory.dmp

Download

memory/3228-15-0x0000000004CB0000-0x00000000052D8000-memory.dmp

Download

memory/3228-16-0x0000000004C40000-0x0000000004C62000-memory.dmp

Download

memory/3228-17-0x0000000005450000-0x00000000054B6000-memory.dmp

Download

memory/3228-26-0x00000000055C0000-0x0000000005914000-memory.dmp

Download

memory/3228-28-0x0000000005B90000-0x0000000005BAE000-memory.dmp

Download

memory/3228-29-0x0000000005BC0000-0x0000000005C0C000-memory.dmp

Download

memory/3228-30-0x0000000007530000-0x0000000007BAA000-memory.dmp

Download

memory/3228-31-0x0000000006100000-0x000000000611A000-memory.dmp

Download

memory/4332-4-0x000001E4C6C20000-0x000001E4C6C42000-memory.dmp

Download

memory/4332-2-0x000001E4DF090000-0x000001E4DF0A0000-memory.dmp

Download

memory/4332-3-0x000001E4DF090000-0x000001E4DF0A0000-memory.dmp

Download

memory/4544-71-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4544-49-0x0000000008910000-0x0000000008EB4000-memory.dmp

Download

memory/4544-48-0x00000000076D0000-0x00000000076F2000-memory.dmp

Download

memory/4544-47-0x0000000007700000-0x0000000007796000-memory.dmp

Download

memory/4544-45-0x0000000005F10000-0x0000000006264000-memory.dmp

Download

memory/4544-50-0x0000000007830000-0x0000000007862000-memory.dmp

Download

memory/4544-51-0x0000000070B80000-0x0000000070BCC000-memory.dmp

Download

memory/4544-52-0x0000000071320000-0x0000000071674000-memory.dmp

Download

memory/4544-60-0x0000000007C40000-0x0000000007C5E000-memory.dmp

Download

memory/4544-61-0x0000000008360000-0x0000000008403000-memory.dmp

Download

memory/4544-62-0x0000000007CC0000-0x0000000007CCA000-memory.dmp

Download

memory/4544-63-0x0000000008580000-0x00000000085AA000-memory.dmp

Download

memory/4544-64-0x00000000085B0000-0x00000000085D4000-memory.dmp

Download

memory/4544-65-0x0000000007C50000-0x0000000007C58000-memory.dmp

Download

memory/4544-66-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4544-73-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4544-72-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4544-74-0x0000000010000000-0x0000000010060000-memory.dmp

Download