91d11cc708062cb170b494402585ae7056f2f285bc5b43914705bdf76d6a728f

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
revised order qty for CP024.js
Size 1.1MB
Sample260804-rwlc4ssfpa
SHA256 91d11cc708062cb170b494402585ae7056f2f285bc5b43914705bdf76d6a728f
MD5 4ddf6896dd06dad8cdccc908ddcd9eb2
SHA1 a2a29043106888e88d12b2fb79c96afd2b86bb46
SHA512 c7e045c84c8bbcf648b83ae89666f06f0d065d90c3a24e07d50e95255ce236a883649174e1638f566d6cafe098f28352c436b6b0aac35b4e91b3e97f3cdefbb5
SSDEEP 24576:7UWUH0PoHSRY5/1xde/dk2pJl7ENwb+IiPoYSqV7MIEN8WupKNtvdb:OH9VNxo/dk6hJigs1k8HpWt
TLSH
T12D4522C10FC2ADBE2C0CD114A122B96E0777BAD31916D85B3A1578675FDB207BE8E784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1852	powershell.exe
2692	powershell.exe
6020	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1644	cmd.exe
2476	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2700	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
6020	powershell.exe
6020	powershell.exe
1852	powershell.exe
1852	powershell.exe
2692	powershell.exe
2692	powershell.exe
2692	powershell.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3752	chrome.exe
3752	chrome.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe
3452	prevhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeIncreaseQuotaPrivilege	2692	powershell.exe
Token: SeSecurityPrivilege	2692	powershell.exe
Token: SeTakeOwnershipPrivilege	2692	powershell.exe
Token: SeLoadDriverPrivilege	2692	powershell.exe
Token: SeSystemProfilePrivilege	2692	powershell.exe
Token: SeSystemtimePrivilege	2692	powershell.exe
Token: SeProfSingleProcessPrivilege	2692	powershell.exe
Token: SeIncBasePriorityPrivilege	2692	powershell.exe
Token: SeCreatePagefilePrivilege	2692	powershell.exe
Token: SeBackupPrivilege	2692	powershell.exe
Token: SeRestorePrivilege	2692	powershell.exe
Token: SeShutdownPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeSystemEnvironmentPrivilege	2692	powershell.exe
Token: SeRemoteShutdownPrivilege	2692	powershell.exe
Token: SeUndockPrivilege	2692	powershell.exe
Token: SeManageVolumePrivilege	2692	powershell.exe
Token: 33	2692	powershell.exe
Token: 34	2692	powershell.exe
Token: 35	2692	powershell.exe
Token: 36	2692	powershell.exe
Token: SeIncreaseQuotaPrivilege	2692	powershell.exe
Token: SeSecurityPrivilege	2692	powershell.exe
Token: SeTakeOwnershipPrivilege	2692	powershell.exe
Token: SeLoadDriverPrivilege	2692	powershell.exe
Token: SeSystemProfilePrivilege	2692	powershell.exe
Token: SeSystemtimePrivilege	2692	powershell.exe
Token: SeProfSingleProcessPrivilege	2692	powershell.exe
Token: SeIncBasePriorityPrivilege	2692	powershell.exe
Token: SeCreatePagefilePrivilege	2692	powershell.exe
Token: SeBackupPrivilege	2692	powershell.exe
Token: SeRestorePrivilege	2692	powershell.exe
Token: SeShutdownPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeSystemEnvironmentPrivilege	2692	powershell.exe
Token: SeRemoteShutdownPrivilege	2692	powershell.exe
Token: SeUndockPrivilege	2692	powershell.exe
Token: SeManageVolumePrivilege	2692	powershell.exe
Token: 33	2692	powershell.exe
Token: 34	2692	powershell.exe
Token: 35	2692	powershell.exe
Token: 36	2692	powershell.exe
Token: SeIncreaseQuotaPrivilege	2692	powershell.exe
Token: SeSecurityPrivilege	2692	powershell.exe
Token: SeTakeOwnershipPrivilege	2692	powershell.exe
Token: SeLoadDriverPrivilege	2692	powershell.exe
Token: SeSystemProfilePrivilege	2692	powershell.exe
Token: SeSystemtimePrivilege	2692	powershell.exe
Token: SeProfSingleProcessPrivilege	2692	powershell.exe
Token: SeIncBasePriorityPrivilege	2692	powershell.exe
Token: SeCreatePagefilePrivilege	2692	powershell.exe
Token: SeBackupPrivilege	2692	powershell.exe
Token: SeRestorePrivilege	2692	powershell.exe
Token: SeShutdownPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeSystemEnvironmentPrivilege	2692	powershell.exe
Token: SeRemoteShutdownPrivilege	2692	powershell.exe
Token: SeUndockPrivilege	2692	powershell.exe
Token: SeManageVolumePrivilege	2692	powershell.exe
Token: 33	2692	powershell.exe
Token: 34	2692	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3752	chrome.exe
3752	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 1644	1188	wscript.exe	88
PID 1644 wrote to memory of 6020	1644	cmd.exe	90
PID 6020 wrote to memory of 2476	6020	powershell.exe	92
PID 2476 wrote to memory of 1852	2476	cmd.exe	94
PID 2476 wrote to memory of 4396	2476	cmd.exe	95
PID 2476 wrote to memory of 2692	2476	cmd.exe	96
PID 2692 wrote to memory of 3452	2692	powershell.exe	99
PID 2692 wrote to memory of 3452	2692	powershell.exe	99
PID 2692 wrote to memory of 3452	2692	powershell.exe	99
PID 3452 wrote to memory of 3752	3452	prevhost.exe	101
PID 3752 wrote to memory of 5204	3752	chrome.exe	102
PID 3752 wrote to memory of 5588	3752	chrome.exe	103
PID 3752 wrote to memory of 2700	3752	chrome.exe	104
PID 3752 wrote to memory of 2428	3752	chrome.exe	105
PID 3752 wrote to memory of 2908	3752	chrome.exe	106
PID 3752 wrote to memory of 4380	3752	chrome.exe	107
PID 3752 wrote to memory of 4656	3752	chrome.exe	108
PID 3752 wrote to memory of 4284	3752	chrome.exe	109
PID 3752 wrote to memory of 1148	3752	chrome.exe	110
PID 3752 wrote to memory of 5696	3752	chrome.exe	111
PID 3752 wrote to memory of 3448	3752	chrome.exe	112
PID 3452 wrote to memory of 1148	3452	prevhost.exe	110
PID 3452 wrote to memory of 1148	3452	prevhost.exe	110

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4396	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\revised order qty for CP024.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:QJJJYBW))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd" NHJOXIU"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2476
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:MRKVYH))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\shellbag_tmp\shellbag_tmp.cfg"
        5⤵
        Views/modifies file attributes
        
        PID:4396
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:WWXEIJQLXOX))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2692
      - C:\Windows\SysWOW64\prevhost.exe
        
        "C:\Windows\SysWOW64\prevhost.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:3452
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ffbe0e8c728,0x7ffbe0e8c734,0x7ffbe0e8c740
        8⤵
        
        PID:5204
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1628,i,12109715752004862487,2175903128441503064,262144 --field-trial-handle=2016,i,7918052646556390872,4769849041416229890,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
        8⤵
        
        PID:5588
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1848,i,16418497675691560202,5669929869139261018,524288 --field-trial-handle=2016,i,7918052646556390872,4769849041416229890,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:2700
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o" --force-high-res-timeticks=disabled --metrics-shmem-handle=2076,i,14794924038140232238,17107992273093150601,524288 --field-trial-handle=2016,i,7918052646556390872,4769849041416229890,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
        8⤵
        
        PID:2428
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2976,i,13356936344791234299,7059258705634390201,2097152 --field-trial-handle=2016,i,7918052646556390872,4769849041416229890,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
        8⤵
        
        PID:2908
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2980,i,11321423478899438858,8646467603747667121,2097152 --field-trial-handle=2016,i,7918052646556390872,4769849041416229890,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1
        8⤵
        
        PID:4380
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3180,i,17796019987166512128,3411960321748140008,2097152 --field-trial-handle=2016,i,7918052646556390872,4769849041416229890,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
        8⤵
        
        PID:4656
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3196,i,15834750218058304759,16880526784117182251,2097152 --field-trial-handle=2016,i,7918052646556390872,4769849041416229890,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:9
        8⤵
        
        PID:4284
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3856,i,12883135944461204577,13542254204271811260,2097152 --field-trial-handle=2016,i,7918052646556390872,4769849041416229890,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:9
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1148
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4324,i,8884927312062700157,12578193866702931135,2097152 --field-trial-handle=2016,i,7918052646556390872,4769849041416229890,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
        8⤵
        
        PID:5696
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o" --force-high-res-timeticks=disabled --metrics-shmem-handle=4376,i,10685815703453244804,4244434216776076822,524288 --field-trial-handle=2016,i,7918052646556390872,4769849041416229890,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
        8⤵
        
        PID:3448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e14a7b28afff95b70ba849207619ff903c6ea821b8cf2c12b589579a7d7d3af
MD5 099f7306d2e129f2a3dd4a124f5e9f61
SHA1 d5f10a991ea12b52de9b43832ff344766835e8a1
SHA512 9914dea58ce264b1a34f795aa57129779222f50fd7f4c658a649e1cfc84042af732389bfff477919dc04b802c28ff404225883f52a43fce8da7c5b0ee550054c
TLSH
T108215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 c0c00221371e3a3bd11232fc93729c1b3d019d9f8140b362660563204315d88d
MD5 3ccea94716bedfbc9e85649b0deb2bde
SHA1 6b5248ad5f11420daddc95f443fba21af53e8b02
SHA512 c8a59f4c6d19ab5743dd476a02bd95fa97d1b900a03993a40aae29bc5d7506e0346c93d0254653cd1301e282463247e8ee868d7b289390963fd10ef0ef462eb0
SSDEEP 384:M1TBaGV1i3y4bbzEu693QX+geC2r2PntIAbk4caGtIWjq76oUwjNfzvsbhNnk/pC:oTnferHIu6qX+F6FIAbkBaGt/a6oU0jE
TLSH
T10E828768523FBDC7D8D112B411D602E7FBE4E048DA7551A4EF2BDE2B1C90BB74E61520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FPSBRXPD.cmd

Path C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd
Size 1.1MB
SHA256 db58a27399f1b15ebf0a7add7bc22e43c090ac2c7f62854279e911dd53bef48c
MD5 d67ec445aa68a97b8c7d296e180a0df9
SHA1 b2a6f935cc152de96f35a63bb6c2b3351c39ba7b
SHA512 5e8101eca48d1144d72c010abf813649bc9a0475596add4f182807822ba8f46df53d53a42d172dcc108998e178409776576013d4c2b0fe6e4d628d298a61c061
SSDEEP 24576:pai3A9udSTyt/TPdQnlyYpBlVMdA/SwEZAweKxlC+ofW4+1eXJ5Xv:F3bhLP6nlyoH9EGEbGWl1G/
TLSH
T1AA4523910FC2FD9D345852282143B9651B7BEFD72A6BE8DE3211B8A7658E203DF4E704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xn1g2glt.czx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xn1g2glt.czx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Crashpad\settings.dat
Size 40B
SHA256 3f8c9c6e0316e2de907a4b452f0afaf3045c4d21c86de6e567f72af973558a43
MD5 9f2801652dec1c0c53f19c109d8edc8d
SHA1 4184ded6b041e17e5e583094ee1e9ee39fc48b3a
SHA512 a97a3e7e4b899947a738b05f23ff02e7f27a4b0348c510027badc2757d853218da70a2106857bfcde71d36127d64cdc0ce8b315af55a144ca413075d27e39a19
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 419fe1ceb419092ee8c44f0d33448f86ff6d48e392c04b76870faa75164038cb
MD5 51e6248eda1b84bcd67bad5c643c24a6
SHA1 99639e6a815f0cf54ec1096bcfc0a7bfe5dad90f
SHA512 62f91d9f3d109d0a38ee866462293f10dd314fa245e79fd926100139465eccc2669fe8b55ffedf31b051e05ff9595000a67f8019ec3bcdc786ced3bf0f75cf05
SSDEEP 6:/FoEXERGq0KkNiUiqGnMGa4fphY+elYEwltUdKldl34VJTNcFGA:d7XRq0/NUqGMQLZelGU4ATq
TLSH
T1DF135E7C4D480B5AD2E8907D098E1B3023F8B80A9756732315737924F4487B253CB100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 a1ad3f5db2f674df8dca22d0aaaca8bbd3d3c5c31d2c0c1744a2e9ec8e66e4f3
MD5 32b8045acfd9fa32992781b3e88d222d
SHA1 20d080c33758ad5cf9c14063176a55f928976207
SHA512 a1f52ea5409f97118abc4284cdf02e3e586103464b8866c9efbcf2030468149be9812f867d3f16eb58882aed407d4adc4730a39771a885325c87127c307d28e4
SSDEEP 48:Nolar9YbP3zlblQfhM1XgTU4jIMmXJCXpdVEPLVBKWwtl:iaGrhblQpugTljIjkvVOLHKWol
TLSH
T18D4487F71809DAC6EB18CBB45D81913C8E33A6262C59FDB9F57548F145509E332246B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 eec89d2db0ade47939f4701d57073125f945baa3fb2ec42b8aa540ef218c1c2a
MD5 03fd8e1433052fb9c9cef7febd57ac5c
SHA1 64e97ed3fb4ca9b923943f4473e69c1ae9955952
SHA512 be100772ca8fd54aa154c35620022ac3317056a9c27b569f6b8f7cd69820c79a3cae57670699e2636cea7f1e72c0425847a5a761c4011a42ca6155054f50b1b0
SSDEEP 768:GUfDPLSgcRUv+D44UfDPLSgcRUv+I4hUfDPLSgcRUv+64pRz44vzdaoRqz4Vz4:MEr8z7zd/Rqziz
TLSH
T10F165EA74F686946D785EFB0BBC9DD1C3CB02396EC936C92F11392694AE0FC41B8511E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 79e8df6244ed2358e3e1dfd02dcaa3e8bff114d579bf0daa277e8ba592aa99d3
MD5 089a29f39bce4c59eecd5bccd53b8d5a
SHA1 a33d2909f4df25cbb599eb842736b88601782e24
SHA512 80fdca5b9fc76417369fcd8041f6e8f2b188120a45523eb7f82ff095f6a51afa246f994e23eedcb59421ed62b533951b9c703330126deb828e4f937a244dff88
SSDEEP 768:+yzbmskTC+Y7rURQ6qE1G6zrOI2B3zShYz7lYsHZyRjnvXy+qB/43SgiV:CxTsURsEc6HOdtGhi6ssRL/yNZR
TLSH
T14003F14012D630CFF45C16A53F3034736D2220A730669BCDB2532E5A1ED7D72AE65B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Cache\Cache_Data\f_000002
Size 71KB
SHA256 99ff0be776dea84eaa37ec69b52f6304cd4b37a60677782d9b505b70183b8de4
MD5 9cabca241ae51db3e05f219326a7f445
SHA1 7242a774a9abca60ad895da8e88691b963bc9a43
SHA512 f121a88d2869d4ecb7c3daa69938d7116f237060ff4126e9f9eb3a7ef2f2e8e041a6b1399f8042e9c3560fc1930249add9662d56088e32c739e8210489094b14
SSDEEP 1536:4W7XKPClEZFrypihpDlvQ3Q1WIk4Yfzea3ajKp7FJlcvyPy1:4W7aayl1Wf4SOj1KPy1
TLSH
T1056302C496F6CB8AE7F320CFC84802A6FF045BEEDDD434A9BA791894E990605FF85145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Cache\Cache_Data\index
Size 256KB
SHA256 e58f0420ebb628a6eb2cd1256b48cbd2c47e0b14c6f0a695cc14b19925e02b0c
MD5 95d60366e56ec5cd88f12b271125a0a0
SHA1 84a983b82129d51b5cf3aae365e60ec10f478cbe
SHA512 c5fa9907a28853d6ade4b33e19211ba6aecd591bb5507465b395edb12552c429c47bbe1c05c7bf5da10d6b6ad883676820952109cde0fb843381a6022a0452ed
SSDEEP 3:LsLllFlklNllklkXlw0llLll/EjNtlmNtlYlXlcE/Alr/9lXl:LsRa3lPBGkNIEEI
TLSH
T1F344026F47854E0AD6D046FD884757607334D509DE5BD347034525252DD17511F1F054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 478023e04532e7e54877d79e841c0435e7c00a94e15e8144254826be2f7cf6c7
MD5 03b06fdc04037420cf192f3c70fe00c8
SHA1 8e15e93ede05d9364d3d7b6e9c3ae7927b372ed4
SHA512 7401e3b81a68ee3172a664499dac34ecd3700db9610f696660b3e74bb78f8954170b4ada3ca124501aabd2b8409e9469805f6aa9b8eeeee40e7b27865c325b9f
TLSH
T1C4E02B81828D0F0ED32D96F7CDAA03058A0A43C429BF3603A980C2C133124341288223
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 3301a5d80c92661ce565a6b30b80c27d1fef342c2a3206fc9d11014ac4222154
MD5 3ae321cb1acc1263be22a4826af7e5e8
SHA1 ef5c7addc791ce8337f32f602979c8276c7ab521
SHA512 f19cb7d84f2d05da672cbc9341bd4c546e687c42cc9e438850e0176c2472fd8dceb3c53642759c54666a2e881b410ce311f48521298b3efd0797fa07a30f28f6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 2eceba3eef8be2ae8e137b3654966c2e9c5dfb56c6f22f20189a8252b117accd
MD5 cc04ecdaa0acbc3763c06fa31bccff0b
SHA1 3dc59994672db6ca4818a795d53cb71037fddf09
SHA512 708fd9058531dc8802d1edd14a39ec33f0f148f051644da7c8360bd60ff58d1f720002ab65f0eb437d45e27b23901836d1873a32087f0bf9d76f9beab6b872af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\DawnGraphiteCache\index
Size 256KB
SHA256 a445cbc6f736031415ad71dc7b58cbcce92922eaf269d528b6c6cfe4cba1b9e2
MD5 6cc2ee6236f7dcab344fcea01f4aedf6
SHA1 1173ef352727991655ce4f95986aa8f163dd5b5d
SHA512 b57a7205e5bb0032c24c830f4e65c0eaccc0432776cb7f67a06217be35685a766fac4a0435cf741611db32d9e0854b20ce4c687a7f054aa81df762b56b1e5be5
SSDEEP 3:LstlNllklkXl+itl:LsX3lP+
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\DawnWebGPUCache\index
Size 256KB
SHA256 3b7f42e4df2ce5eced23c2b933e70ecd5462cce84848821f9efd8ad10219b81e
MD5 babc07b0dd684bd584da7bde9b030162
SHA1 00e6672e4ad0079bc41e5c3ddf45abb0c284da53
SHA512 31a954e0797027ca1920e9e059b4ddbc2ab805776115d83b87d35904e49c4dee9652815586fd9c9b44ccae73a5af524a4a7fb90881006514cc3d2210757751d2
SSDEEP 3:LstlNllklkXlUrCl:LsX3lPUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\GPUCache\index
Size 256KB
SHA256 0a78e0479da3cfdfbec6a78abb1ae5fce07d00719bf5d604c0adc7b2389dc7b7
MD5 7a9843a67c32cfa5e5b96a54941b98a5
SHA1 76b6283c951396dcc66ff2332f81f6c1c368ebeb
SHA512 e621e6ec7d2cacef9b59ed203aa45deaec6914b6e94e26bf0f007ae9e81cb805a9f63a84e67bb6b164fec6e42f49cac84663c3f6aa5b331bf5d1c6d0029edcbe
SSDEEP 3:LstlNllklkXlO0vll:LsX3lPbv
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 a54ab7dda7026f5585ef6152f5aec1a3e312872c65770f29f5340e5a12727b40
MD5 768b84db2c542bf6a5362767bfb631b7
SHA1 75ac5a5661e29a8f68b867c367a76dfc1772ab19
SHA512 5aca0efb5791d4c74db7cccdaad09088ba57c86dd94b83fbcb5a0d1ff398d3b86f3253e6b41f4b40ad85b3b88ae418f92d251292feb1176e68911edd0505c7dc
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 acd6330a440ac952ce06349cae8d7411d5d7606a3e3181c483c8a634a269f7bc
MD5 febaa953d2236b0e5abacee10db46d0f
SHA1 8b677217e16ae8d0be0ef2f13634b5613c808e5c
SHA512 f35e6c6f173b65b5235f51823f0b209550536632e8c2c63b535ebc4c75e8b8f914292ba3b9e4587480c0f37ad8a77be61f707c6d8983809262bb9537fa322c09
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dsf1fudv.s1o\GraphiteDawnCache\index
Size 256KB
SHA256 91b93292de225f6bb9d4250948ed2450941be2f442be8f972709e489f093a0a9
MD5 685934b7c4d3d68677dd7e384fae9786
SHA1 970f89f0d06a0a3b0b542b8afc850f6d5301836a
SHA512 0dc177728de0c00b3344f9f5dd6e6fc5b34dd4e6627dc7c53332e5d852a939973e19aedf3f8a39c3e2bd088c369a338391fd7ba33b7edcbe225c2be0fed759e8
SSDEEP 3:LstlNllklkXlv9l:LsX3lPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1148-210-0x000001E29DD60000-0x000001E29DE52000-memory.dmp

Download

memory/1852-24-0x00000000053D0000-0x00000000053F2000-memory.dmp

Download

memory/1852-34-0x0000000006750000-0x000000000676A000-memory.dmp

Download

memory/1852-22-0x0000000002DA0000-0x0000000002DD6000-memory.dmp

Download

memory/1852-23-0x0000000005600000-0x0000000005C4A000-memory.dmp

Download

memory/1852-26-0x00000000054E0000-0x0000000005546000-memory.dmp

Download

memory/1852-25-0x0000000005470000-0x00000000054D6000-memory.dmp

Download

memory/1852-29-0x0000000005C90000-0x0000000005FEB000-memory.dmp

Download

memory/1852-31-0x00000000061C0000-0x00000000061DE000-memory.dmp

Download

memory/1852-32-0x0000000006200000-0x000000000624C000-memory.dmp

Download

memory/1852-33-0x0000000007A10000-0x000000000808C000-memory.dmp

Download

memory/2692-40-0x0000000007860000-0x00000000078F6000-memory.dmp

Download

memory/2692-38-0x0000000005FE0000-0x000000000633B000-memory.dmp

Download

memory/2692-59-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2692-61-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2692-60-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2692-62-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2692-43-0x0000000007980000-0x00000000079B6000-memory.dmp

Download

memory/2692-44-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

Download

memory/2692-48-0x0000000007C30000-0x0000000007C50000-memory.dmp

Download

memory/2692-45-0x0000000071130000-0x000000007148B000-memory.dmp

Download

memory/2692-49-0x0000000007C60000-0x0000000007D03000-memory.dmp

Download

memory/2692-50-0x0000000007D50000-0x0000000007D5A000-memory.dmp

Download

memory/2692-54-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2692-51-0x0000000009B20000-0x0000000009B4A000-memory.dmp

Download

memory/2692-52-0x0000000009B50000-0x0000000009B74000-memory.dmp

Download

memory/2692-53-0x0000000007BF0000-0x0000000007BF8000-memory.dmp

Download

memory/2692-41-0x00000000077A0000-0x00000000077C2000-memory.dmp

Download

memory/2692-42-0x0000000008560000-0x0000000008B1A000-memory.dmp

Download

memory/3452-70-0x0000000005B40000-0x0000000005B72000-memory.dmp

Download

memory/3452-266-0x0000000006270000-0x0000000006282000-memory.dmp

Download

memory/3452-73-0x0000000006090000-0x0000000006122000-memory.dmp

Download

memory/3452-71-0x0000000005B70000-0x0000000005BBC000-memory.dmp

Download

memory/3452-69-0x0000000005560000-0x0000000005566000-memory.dmp

Download

memory/3452-68-0x0000000005910000-0x0000000005A02000-memory.dmp

Download

memory/3452-66-0x0000000004E10000-0x0000000004ED8000-memory.dmp

Download

memory/3452-64-0x0000000004C20000-0x0000000004CC2000-memory.dmp

Download

memory/3452-65-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/3452-63-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/3452-74-0x0000000006300000-0x0000000006350000-memory.dmp

Download

memory/6020-21-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-11-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-17-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-16-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-15-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-14-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-13-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-12-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-18-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-10-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-19-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-9-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-8-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-7-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-5-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/6020-6-0x0000029A212A0000-0x0000029A212C2000-memory.dmp

Download

memory/6020-2-0x00007FFBE067F000-0x00007FFBE0680000-memory.dmp

Download