91d11cc708062cb170b494402585ae7056f2f285bc5b43914705bdf76d6a728f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
revised order qty for CP024.js
Size 1.1MB
Sample260804-p6pr6sbc45
SHA256 91d11cc708062cb170b494402585ae7056f2f285bc5b43914705bdf76d6a728f
MD5 4ddf6896dd06dad8cdccc908ddcd9eb2
SHA1 a2a29043106888e88d12b2fb79c96afd2b86bb46
SHA512 c7e045c84c8bbcf648b83ae89666f06f0d065d90c3a24e07d50e95255ce236a883649174e1638f566d6cafe098f28352c436b6b0aac35b4e91b3e97f3cdefbb5
SSDEEP 24576:7UWUH0PoHSRY5/1xde/dk2pJl7ENwb+IiPoYSqV7MIEN8WupKNtvdb:OH9VNxo/dk6hJigs1k8HpWt
TLSH
T12D4522C10FC2ADBE2C0CD114A122B96E0777BAD31916D85B3A1578675FDB207BE8E784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4616	powershell.exe
3448	powershell.exe
1124	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3444	cmd.exe
1984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3148	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4616	powershell.exe
4616	powershell.exe
3448	powershell.exe
3448	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
4944	chrome.exe
4944	chrome.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
4100	chrome.exe
5052	prevhost.exe
4100	chrome.exe
5052	prevhost.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
4100	chrome.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe
5052	prevhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeIncreaseQuotaPrivilege	1124	powershell.exe
Token: SeSecurityPrivilege	1124	powershell.exe
Token: SeTakeOwnershipPrivilege	1124	powershell.exe
Token: SeLoadDriverPrivilege	1124	powershell.exe
Token: SeSystemProfilePrivilege	1124	powershell.exe
Token: SeSystemtimePrivilege	1124	powershell.exe
Token: SeProfSingleProcessPrivilege	1124	powershell.exe
Token: SeIncBasePriorityPrivilege	1124	powershell.exe
Token: SeCreatePagefilePrivilege	1124	powershell.exe
Token: SeBackupPrivilege	1124	powershell.exe
Token: SeRestorePrivilege	1124	powershell.exe
Token: SeShutdownPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeSystemEnvironmentPrivilege	1124	powershell.exe
Token: SeRemoteShutdownPrivilege	1124	powershell.exe
Token: SeUndockPrivilege	1124	powershell.exe
Token: SeManageVolumePrivilege	1124	powershell.exe
Token: 33	1124	powershell.exe
Token: 34	1124	powershell.exe
Token: 35	1124	powershell.exe
Token: 36	1124	powershell.exe
Token: SeIncreaseQuotaPrivilege	1124	powershell.exe
Token: SeSecurityPrivilege	1124	powershell.exe
Token: SeTakeOwnershipPrivilege	1124	powershell.exe
Token: SeLoadDriverPrivilege	1124	powershell.exe
Token: SeSystemProfilePrivilege	1124	powershell.exe
Token: SeSystemtimePrivilege	1124	powershell.exe
Token: SeProfSingleProcessPrivilege	1124	powershell.exe
Token: SeIncBasePriorityPrivilege	1124	powershell.exe
Token: SeCreatePagefilePrivilege	1124	powershell.exe
Token: SeBackupPrivilege	1124	powershell.exe
Token: SeRestorePrivilege	1124	powershell.exe
Token: SeShutdownPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeSystemEnvironmentPrivilege	1124	powershell.exe
Token: SeRemoteShutdownPrivilege	1124	powershell.exe
Token: SeUndockPrivilege	1124	powershell.exe
Token: SeManageVolumePrivilege	1124	powershell.exe
Token: 33	1124	powershell.exe
Token: 34	1124	powershell.exe
Token: 35	1124	powershell.exe
Token: 36	1124	powershell.exe
Token: SeIncreaseQuotaPrivilege	1124	powershell.exe
Token: SeSecurityPrivilege	1124	powershell.exe
Token: SeTakeOwnershipPrivilege	1124	powershell.exe
Token: SeLoadDriverPrivilege	1124	powershell.exe
Token: SeSystemProfilePrivilege	1124	powershell.exe
Token: SeSystemtimePrivilege	1124	powershell.exe
Token: SeProfSingleProcessPrivilege	1124	powershell.exe
Token: SeIncBasePriorityPrivilege	1124	powershell.exe
Token: SeCreatePagefilePrivilege	1124	powershell.exe
Token: SeBackupPrivilege	1124	powershell.exe
Token: SeRestorePrivilege	1124	powershell.exe
Token: SeShutdownPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeSystemEnvironmentPrivilege	1124	powershell.exe
Token: SeRemoteShutdownPrivilege	1124	powershell.exe
Token: SeUndockPrivilege	1124	powershell.exe
Token: SeManageVolumePrivilege	1124	powershell.exe
Token: 33	1124	powershell.exe
Token: 34	1124	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4944	chrome.exe
4944	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3444	4588	wscript.exe	90
PID 3444 wrote to memory of 4616	3444	cmd.exe	92
PID 4616 wrote to memory of 1984	4616	powershell.exe	93
PID 1984 wrote to memory of 3448	1984	cmd.exe	95
PID 1984 wrote to memory of 3832	1984	cmd.exe	96
PID 1984 wrote to memory of 1124	1984	cmd.exe	97
PID 1124 wrote to memory of 5052	1124	powershell.exe	99
PID 1124 wrote to memory of 5052	1124	powershell.exe	99
PID 1124 wrote to memory of 5052	1124	powershell.exe	99
PID 5052 wrote to memory of 4944	5052	prevhost.exe	100
PID 4944 wrote to memory of 5992	4944	chrome.exe	101
PID 4944 wrote to memory of 3884	4944	chrome.exe	102
PID 4944 wrote to memory of 3148	4944	chrome.exe	103
PID 4944 wrote to memory of 936	4944	chrome.exe	104
PID 4944 wrote to memory of 1768	4944	chrome.exe	105
PID 4944 wrote to memory of 1104	4944	chrome.exe	106
PID 4944 wrote to memory of 2256	4944	chrome.exe	107
PID 4944 wrote to memory of 4100	4944	chrome.exe	108
PID 4944 wrote to memory of 5016	4944	chrome.exe	109
PID 4944 wrote to memory of 2016	4944	chrome.exe	110
PID 4944 wrote to memory of 4248	4944	chrome.exe	112
PID 5052 wrote to memory of 4100	5052	prevhost.exe	108
PID 5052 wrote to memory of 4100	5052	prevhost.exe	108

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3832	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\revised order qty for CP024.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:QJJJYBW))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd" NHJOXIU"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1984
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:MRKVYH))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3448
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\shellbag_tmp\shellbag_tmp.cfg"
        5⤵
        Views/modifies file attributes
        
        PID:3832
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:WWXEIJQLXOX))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1124
      - C:\Windows\SysWOW64\prevhost.exe
        
        "C:\Windows\SysWOW64\prevhost.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:5052
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xa4,0x138,0x7ffc6f0cc728,0x7ffc6f0cc734,0x7ffc6f0cc740
        8⤵
        
        PID:5992
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,13454475843712009491,1345350363586075950,262144 --field-trial-handle=1900,i,2582286425605670392,15186947850647721216,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
        8⤵
        
        PID:3884
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin" --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,5530664992940268831,14158477956963712611,524288 --field-trial-handle=1900,i,2582286425605670392,15186947850647721216,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:3148
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin" --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,2129827095306377766,6087578656035861107,524288 --field-trial-handle=1900,i,2582286425605670392,15186947850647721216,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:13
        8⤵
        
        PID:936
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2976,i,4560369878798077895,3430092600887356862,2097152 --field-trial-handle=1900,i,2582286425605670392,15186947850647721216,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:1
        8⤵
        
        PID:1768
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2996,i,11126392007494423791,824436256980420366,2097152 --field-trial-handle=1900,i,2582286425605670392,15186947850647721216,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
        8⤵
        
        PID:1104
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3220,i,698981612435626320,6671715496805075771,2097152 --field-trial-handle=1900,i,2582286425605670392,15186947850647721216,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
        8⤵
        
        PID:2256
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3236,i,17340065896261879320,495740133232269103,2097152 --field-trial-handle=1900,i,2582286425605670392,15186947850647721216,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:9
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4100
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4112,i,5201759627648537988,105540416735883455,2097152 --field-trial-handle=1900,i,2582286425605670392,15186947850647721216,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:9
        8⤵
        
        PID:5016
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4348,i,3731356487422652377,16970940176858350117,2097152 --field-trial-handle=1900,i,2582286425605670392,15186947850647721216,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
        8⤵
        
        PID:2016
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin" --force-high-res-timeticks=disabled --metrics-shmem-handle=4376,i,6898710758342359711,18056055272003745732,524288 --field-trial-handle=1900,i,2582286425605670392,15186947850647721216,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:14
        8⤵
        
        PID:4248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e14a7b28afff95b70ba849207619ff903c6ea821b8cf2c12b589579a7d7d3af
MD5 099f7306d2e129f2a3dd4a124f5e9f61
SHA1 d5f10a991ea12b52de9b43832ff344766835e8a1
SHA512 9914dea58ce264b1a34f795aa57129779222f50fd7f4c658a649e1cfc84042af732389bfff477919dc04b802c28ff404225883f52a43fce8da7c5b0ee550054c
TLSH
T108215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 4e4fcbc54cd01d56aaf299605ad0ae5582507a7adf9d950e0d8e4e9fc8261b32
MD5 a7de72b5ac2afb5e7bed8275db527879
SHA1 2d20a6a1ed5c8569e3833d398d2fb5e4184eb201
SHA512 89a884d12aacdc088dfc38a6a6442fa1fbb30dc6e9ec53bcca7dca29dac2687e2d61d1e47cd017d0d7ff038b03e905ce9d241ed8dbe4741f62ad1c9c3ef699fb
SSDEEP 384:31TBaGV1i3y4bbzNZs+y0M9eCerpvPnP/IAbk4caGNIW/q76okAjNnzHsbhNn0/A:lTnferH5Zs+ynQxfIAbkBaGN7a6okMrk
TLSH
T19D828768523FBDC7D8D122B411D602E7FBE4E048DA7551A4EF2BDE2B1C90BBB4E61520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FPSBRXPD.cmd

Path C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd
Size 1.1MB
SHA256 db58a27399f1b15ebf0a7add7bc22e43c090ac2c7f62854279e911dd53bef48c
MD5 d67ec445aa68a97b8c7d296e180a0df9
SHA1 b2a6f935cc152de96f35a63bb6c2b3351c39ba7b
SHA512 5e8101eca48d1144d72c010abf813649bc9a0475596add4f182807822ba8f46df53d53a42d172dcc108998e178409776576013d4c2b0fe6e4d628d298a61c061
SSDEEP 24576:pai3A9udSTyt/TPdQnlyYpBlVMdA/SwEZAweKxlC+ofW4+1eXJ5Xv:F3bhLP6nlyoH9EGEbGWl1G/
TLSH
T1AA4523910FC2FD9D345852282143B9651B7BEFD72A6BE8DE3211B8A7658E203DF4E704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tjkfkhwt.4pz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tjkfkhwt.4pz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Crashpad\settings.dat
Size 40B
SHA256 1720f8def6818ccb68b93527090cd5afdec0bccdab222b43791c22814bfee58d
MD5 e00ac92fec0becf4026195817c673767
SHA1 cfea1c0a69ba2e875f85b817e3fd027cec6731e7
SHA512 99865df8f13882399a0b43d18c7ed358c43d7c94b8cfd8f7cad09e133a5b160c97d2c08587f7916d0f6b16e7f4d18de910f9225e4afa6825f1ebfa7fe97052d8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 a9fe7eafdd75c0fae649eb03f2f7218a50777834d86ea8a6e999188e49d42e49
MD5 2ee3010027d91b949ec7712db36f36df
SHA1 62ff71136c627f656424975a546b932fb8ef3dd2
SHA512 dff4fac662ce87907e8bf6992045ba9a1f7c5bd0160788638631d64641a9ed8bfc86c834c649af143c6ef52e2871be8111d657ea952c82a5a3126cf722a8fac6
SSDEEP 6:/FoEXE75kkNoO6I+rgZC9QEkEXnuUkll8KurK64BtSV:d7XC5tNoxf/yEkEul/83rst
TLSH
T17E13A7BD86841FDAF3A5107D485B37704BB1884ADB2243130220BD31FA08366884E200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 80d2351e02239c081bbe1b955c60ef1636e1fdd9200a4124f64d6e8bcfab7e81
MD5 ecc420b135c020d850fe9e73fa5728cb
SHA1 de82d803a00a23439cde76279d0f99519d48c1c0
SHA512 1352533e5cca894cf45d8cb6381861a57c4b8a49616ae40b68ae1d29a97a707ee1d5068cf6249b91cac4f68452600be2da2492e3f7d42319cc552b271bbb5e3e
SSDEEP 48:TMolevSY/sVP3zlblQIdM1XgUXNUgTTMmXJ2dVEPLVBKWwtl:PE/sthblQ8ugUNbTTjeVOLHKWol
TLSH
T12544A9FB2C05DEC6EB18CBB45D41923C8E3292163C9AED79F67944B145509E331285B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 0624b23fa80113eafaea3ffc300fa2722ed7dd6993c7b78c9c5ce971d89c37aa
MD5 0c49195c54cb5eb972067cfbb87903a0
SHA1 6928027a8fa7eee725cec0a991d9c8bb986d8d75
SHA512 36b3f11a0ae761a042bad149be623542f6d71ee016b5e0758d0e09b888373449c9c3b22a08080eb11e5fd209c9f082878d6674bcabf64a753a6097bd96b7bd24
SSDEEP 768:SUfDPLSgcRUv+i4vUfDPLSgcRUv+J45UfDPLSgcRUv+c4AfDPLSgcRUv+c4CFz4Q:xuxXbz7zd/REzrz
TLSH
T1DA165DA74F647946E785EFB0BBC9DD1C3CB02386EC936892F11292695AE0FC41B8511E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 7b9412c26767b7376b4c1edb13355396174afdc41eeb2796e349f767bb5fc277
MD5 44eaf2bc3401b486aa37789bcf39cf8b
SHA1 ad9977f54249e51cbae518d257ec08c771fc602a
SHA512 db00f22beae9f2e1771516876612e115ae1f11b5772c97d8956a1a280baa2840fa0898036cdb0aae3dbe5e2887f09d347d329491271003e50bbdc1fabff29c58
SSDEEP 768:oKxUmn+MLLn+gLyBE0LxzpclN6DCodTb9OmUHLWR1yA1grEd7gI9UVk:oKxU6+0zR0TclNZiMmb3ysgrw9UC
TLSH
T12F03018081EEB734185BD3FE80DAA0CBADB8C5A551275290C13D46B4079DB1FAD36F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Cache\Cache_Data\f_000002
Size 71KB
SHA256 99ff0be776dea84eaa37ec69b52f6304cd4b37a60677782d9b505b70183b8de4
MD5 9cabca241ae51db3e05f219326a7f445
SHA1 7242a774a9abca60ad895da8e88691b963bc9a43
SHA512 f121a88d2869d4ecb7c3daa69938d7116f237060ff4126e9f9eb3a7ef2f2e8e041a6b1399f8042e9c3560fc1930249add9662d56088e32c739e8210489094b14
SSDEEP 1536:4W7XKPClEZFrypihpDlvQ3Q1WIk4Yfzea3ajKp7FJlcvyPy1:4W7aayl1Wf4SOj1KPy1
TLSH
T1056302C496F6CB8AE7F320CFC84802A6FF045BEEDDD434A9BA791894E990605FF85145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Cache\Cache_Data\index
Size 256KB
SHA256 cc3f041d0bc1762e0ef546037471903a4795b27ab2789fca12b91b2f147559a1
MD5 6248462e76b4e7c02ba627f7ecffa3a0
SHA1 6891e7b0da8855a973cf30848e1753e6389fd31d
SHA512 750e5620f64586ed96da0738638128e2d7bfe5d93cbbf2dad4cd0322e97792bc3a57e55addbf6762f8d215363bee3e68b63fda15d0d91b62af20aeac127407bd
SSDEEP 3:LsLllFlklNllklkXlfH+kl/allLll/njNtlmNtl3Nl/lOll//Al5llll/9lXl:LsRa3lPPnudkNH0lt6lll
TLSH
T16744125E83411E05C2C002FC84434B146334C805CB4FC303030421102CC03401D0F150
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 439b78f3517564ada80b5c4a0ca162ce009b8c21cef57a6ce8cec7e791a0f439
MD5 bb31e1edc22bf5c7871fc8e5f563d293
SHA1 818a9515d538860648605600ab85f33e45979279
SHA512 f112a58733fb701658452ea3ef2b4ac18474485cdca84eb06757910f34046e897ae21d2e790e399b200bcf54b42a362ca84aaeb894386d2ea712549a30af89a8
TLSH
T198E02B91834C0F1DD32DA6F7CEA703448A0E43C429BE3603A880C2C233164342248123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7dc5d8edf6c1837c1333c6d40141a44936875d3e6fef7a9268f50f483890b853
MD5 4f70fcee8da9880e6b0955981815e5f0
SHA1 0668dc089e53c0aea92b1ee0887b99413dc54c53
SHA512 3a14ea669a33801d578d6c26e098f147a584f5b5b74d9165a7edcc147afdaa4a412206bfd588c0f3e5e39c5c84a488ee158a4afe4ed9c94f9a8b379061b950c1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 22c4e4c4dfa3ea5386bca84d7ac60c1246f655836587fc9355b9b1cad93927a1
MD5 6b05c56d33387e308d4613bdd5451f4a
SHA1 ec8f724b0fdb98361786dfc1dcec0993736b837a
SHA512 0a05e0e1a9f829d246013b54fe634e77967b9380d9ca91e20a64c73ec17a7e29a1fcc0163ffa327e1d62939a551009fe4980d62d6199cd84d8ea48b5c707a1a4
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\DawnGraphiteCache\index
Size 256KB
SHA256 c90c8a92dffe6cc7a3cbac26ce086cc3f49c8fdefaa88a215eb4748f8a763f4d
MD5 480196328785b7d461b4a4e69da5ea00
SHA1 42dc3df184926bbbe434440efdfbb50a698806a5
SHA512 01fbca968342a166aa0bd4d27f238338f08743b9e41cbd36134f3d3ff7fcd26bd972f4bfcf57a211e573bb4a35f7cd3f4b7b18a4e68e814d7ad8cf96fa517596
SSDEEP 3:LstlNllklkXloK:LsX3lPoK
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\DawnWebGPUCache\index
Size 256KB
SHA256 20f0c670ef11b194eab3291febe001cbbd23d8de37476fe6a3c6789c482b264f
MD5 00233362148ce4da84837b03da47140a
SHA1 18cc85241d6bc29d34033ba77e7119bf31573bdf
SHA512 ce4777dbdbd0c3e2bf3019dd580eab178dcb58236ef060a436cd3f3b06dda0e7e55b22ff1a5c29e7213b50b226c3b2a3baba81067a3d12cd95161b52ffa1948e
SSDEEP 3:LstlNllklkXlRG/:LsX3lPA/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\GPUCache\index
Size 256KB
SHA256 7e341e93f4be27cbaa0dd1001cb2b1540bc8a14f29b9be871c916cec8ba17f6e
MD5 3ae902e0273ddc1b9e6f19e593932def
SHA1 eb658205b685cb6637dc52b3b8cd8fe7cb22497d
SHA512 e655dff7c2592bd2395fce1d72f2628dc7fe1fc4cc73c80dab5ae9ec5066eead3cfd21d9ccdd5c586426eb4d5cca2d820c35c689bcf6a553a7d947d8eeb9a0a5
SSDEEP 3:LstlNllklkXl:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3b0df8c993897c01a54c403e1cc24367d7bbd87ea31c6d3d64dd0f642b2cd86a
MD5 c005bda62ac2ebf89b152da252addd6e
SHA1 0fff3f5819133b06eb2a362fe3d85eef29196468
SHA512 ed64172c88217260a71af5f0c140cc8024b53235b44398bab8d98367da56fd01d9aed84024d4ff759f467b19342612406a9ad4f12fda2da39c9e62e3bca26dd9
TLSH
T1DDA0025103848211D1441BF0295593882201B9258001136B76D203468E600A0D911154
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 46e73905d40d2154af77fc7b11ead5b1c9eff15bc14c700b0509bf50be2b43b9
MD5 3948b3212dadeba445161166b03c47d5
SHA1 1c9d27e039a1d42816d62a72a4d30250617f6d9a
SHA512 c4bd3087b0043309712077329ac2b4fbe0c4ca0e8f20b6f3e2e6cc56fac55668bd2fea26298af1b3d5079994f15ffc9a54305ab9058c776cfe0ccb13c03a9d8b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\vhktc5pe.xin\GraphiteDawnCache\index
Size 256KB
SHA256 306fbd95f7a30ca357043d83291a4e8b227dbb6959beb42111cae2d1eaee1be7
MD5 2fa7d21ce8b6c4cbaba898dd68f47937
SHA1 b0f34282bc66e44150d1cc414e0d74f11c616087
SHA512 2de4238f4ad76221dab21e73a7a927f04c498314ec0b5ec4d3787f95eb3f8e0212bd8591ed02f2b542e35ed6cfcbc2a4c0d0cd79a35721e6735e9a140be6cb07
SSDEEP 3:LstlNllklkXle6:LsX3lPe6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1124-55-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/1124-54-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/1124-40-0x0000000071010000-0x000000007136B000-memory.dmp

Download

memory/1124-44-0x00000000081C0000-0x0000000008263000-memory.dmp

Download

memory/1124-45-0x00000000082B0000-0x00000000082BA000-memory.dmp

Download

memory/1124-46-0x0000000008440000-0x000000000846A000-memory.dmp

Download

memory/1124-47-0x0000000008470000-0x0000000008494000-memory.dmp

Download

memory/1124-48-0x0000000008080000-0x0000000008088000-memory.dmp

Download

memory/1124-49-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/1124-38-0x0000000007EA0000-0x0000000007ED6000-memory.dmp

Download

memory/1124-56-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/1124-39-0x0000000070E90000-0x0000000070EDC000-memory.dmp

Download

memory/1124-57-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/1124-43-0x00000000081A0000-0x00000000081C0000-memory.dmp

Download

memory/1124-35-0x0000000007D60000-0x0000000007DF6000-memory.dmp

Download

memory/1124-36-0x0000000007D20000-0x0000000007D42000-memory.dmp

Download

memory/1124-37-0x0000000008B20000-0x00000000090DA000-memory.dmp

Download

memory/3448-19-0x0000000005D10000-0x000000000635A000-memory.dmp

Download

memory/3448-22-0x0000000005B30000-0x0000000005B96000-memory.dmp

Download

memory/3448-25-0x0000000006360000-0x00000000066BB000-memory.dmp

Download

memory/3448-27-0x00000000067F0000-0x000000000680E000-memory.dmp

Download

memory/3448-21-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Download

memory/3448-20-0x0000000005A20000-0x0000000005A42000-memory.dmp

Download

memory/3448-28-0x0000000006830000-0x000000000687C000-memory.dmp

Download

memory/3448-18-0x0000000003400000-0x0000000003436000-memory.dmp

Download

memory/3448-30-0x0000000006DA0000-0x0000000006DBA000-memory.dmp

Download

memory/3448-29-0x0000000008020000-0x000000000869C000-memory.dmp

Download

memory/4100-192-0x000001E4A1680000-0x000001E4A16B2000-memory.dmp

Download

memory/4100-190-0x000001E4BA0E0000-0x000001E4BA1D2000-memory.dmp

Download

memory/4616-16-0x00007FFC69E30000-0x00007FFC6A7D4000-memory.dmp

Download

memory/4616-14-0x00007FFC69E30000-0x00007FFC6A7D4000-memory.dmp

Download

memory/4616-2-0x00007FFC69FBF000-0x00007FFC69FC0000-memory.dmp

Download

memory/4616-5-0x0000027BCD750000-0x0000027BCD772000-memory.dmp

Download

memory/4616-6-0x00007FFC69E30000-0x00007FFC6A7D4000-memory.dmp

Download

memory/4616-7-0x00007FFC69E30000-0x00007FFC6A7D4000-memory.dmp

Download

memory/4616-8-0x00007FFC69E30000-0x00007FFC6A7D4000-memory.dmp

Download

memory/4616-9-0x00007FFC69E30000-0x00007FFC6A7D4000-memory.dmp

Download

memory/4616-10-0x00007FFC69E30000-0x00007FFC6A7D4000-memory.dmp

Download

memory/4616-11-0x00007FFC69E30000-0x00007FFC6A7D4000-memory.dmp

Download

memory/4616-12-0x00007FFC69E30000-0x00007FFC6A7D4000-memory.dmp

Download

memory/4616-13-0x00007FFC69E30000-0x00007FFC6A7D4000-memory.dmp

Download

memory/4616-17-0x00007FFC69E30000-0x00007FFC6A7D4000-memory.dmp

Download

memory/5052-63-0x0000000005D80000-0x0000000005E72000-memory.dmp

Download

memory/5052-58-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/5052-59-0x00000000050B0000-0x0000000005152000-memory.dmp

Download

memory/5052-60-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/5052-61-0x0000000005280000-0x0000000005348000-memory.dmp

Download

memory/5052-252-0x00000000066F0000-0x0000000006702000-memory.dmp

Download

memory/5052-69-0x0000000006770000-0x00000000067C0000-memory.dmp

Download

memory/5052-64-0x0000000005F10000-0x0000000005F16000-memory.dmp

Download

memory/5052-66-0x0000000006060000-0x00000000060AC000-memory.dmp

Download

memory/5052-65-0x0000000005F20000-0x0000000005F52000-memory.dmp

Download

memory/5052-68-0x0000000006500000-0x0000000006592000-memory.dmp

Download