91d11cc708062cb170b494402585ae7056f2f285bc5b43914705bdf76d6a728f

Analysis

max time kernel
149s
max time network
37s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91d11cc708062cb170b494402585ae7056f2f285bc5b43914705bdf76d6a728f.js
Size 1.1MB
Sample260806-ekc65sdk2x
SHA256 91d11cc708062cb170b494402585ae7056f2f285bc5b43914705bdf76d6a728f
MD5 4ddf6896dd06dad8cdccc908ddcd9eb2
SHA1 a2a29043106888e88d12b2fb79c96afd2b86bb46
SHA512 c7e045c84c8bbcf648b83ae89666f06f0d065d90c3a24e07d50e95255ce236a883649174e1638f566d6cafe098f28352c436b6b0aac35b4e91b3e97f3cdefbb5
SSDEEP 24576:7UWUH0PoHSRY5/1xde/dk2pJl7ENwb+IiPoYSqV7MIEN8WupKNtvdb:OH9VNxo/dk6hJigs1k8HpWt
TLSH
T12D4522C10FC2ADBE2C0CD114A122B96E0777BAD31916D85B3A1578675FDB207BE8E784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4924	powershell.exe
468	powershell.exe
856	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
720	cmd.exe
5496	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2104	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
468	powershell.exe
468	powershell.exe
856	powershell.exe
856	powershell.exe
4924	powershell.exe
4924	powershell.exe
4924	powershell.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
6084	chrome.exe
6084	chrome.exe
6084	chrome.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1964	chrome.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe
1796	prevhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	468	powershell.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeIncreaseQuotaPrivilege	4924	powershell.exe
Token: SeSecurityPrivilege	4924	powershell.exe
Token: SeTakeOwnershipPrivilege	4924	powershell.exe
Token: SeLoadDriverPrivilege	4924	powershell.exe
Token: SeSystemProfilePrivilege	4924	powershell.exe
Token: SeSystemtimePrivilege	4924	powershell.exe
Token: SeProfSingleProcessPrivilege	4924	powershell.exe
Token: SeIncBasePriorityPrivilege	4924	powershell.exe
Token: SeCreatePagefilePrivilege	4924	powershell.exe
Token: SeBackupPrivilege	4924	powershell.exe
Token: SeRestorePrivilege	4924	powershell.exe
Token: SeShutdownPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeSystemEnvironmentPrivilege	4924	powershell.exe
Token: SeRemoteShutdownPrivilege	4924	powershell.exe
Token: SeUndockPrivilege	4924	powershell.exe
Token: SeManageVolumePrivilege	4924	powershell.exe
Token: 33	4924	powershell.exe
Token: 34	4924	powershell.exe
Token: 35	4924	powershell.exe
Token: 36	4924	powershell.exe
Token: SeIncreaseQuotaPrivilege	4924	powershell.exe
Token: SeSecurityPrivilege	4924	powershell.exe
Token: SeTakeOwnershipPrivilege	4924	powershell.exe
Token: SeLoadDriverPrivilege	4924	powershell.exe
Token: SeSystemProfilePrivilege	4924	powershell.exe
Token: SeSystemtimePrivilege	4924	powershell.exe
Token: SeProfSingleProcessPrivilege	4924	powershell.exe
Token: SeIncBasePriorityPrivilege	4924	powershell.exe
Token: SeCreatePagefilePrivilege	4924	powershell.exe
Token: SeBackupPrivilege	4924	powershell.exe
Token: SeRestorePrivilege	4924	powershell.exe
Token: SeShutdownPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeSystemEnvironmentPrivilege	4924	powershell.exe
Token: SeRemoteShutdownPrivilege	4924	powershell.exe
Token: SeUndockPrivilege	4924	powershell.exe
Token: SeManageVolumePrivilege	4924	powershell.exe
Token: 33	4924	powershell.exe
Token: 34	4924	powershell.exe
Token: 35	4924	powershell.exe
Token: 36	4924	powershell.exe
Token: SeIncreaseQuotaPrivilege	4924	powershell.exe
Token: SeSecurityPrivilege	4924	powershell.exe
Token: SeTakeOwnershipPrivilege	4924	powershell.exe
Token: SeLoadDriverPrivilege	4924	powershell.exe
Token: SeSystemProfilePrivilege	4924	powershell.exe
Token: SeSystemtimePrivilege	4924	powershell.exe
Token: SeProfSingleProcessPrivilege	4924	powershell.exe
Token: SeIncBasePriorityPrivilege	4924	powershell.exe
Token: SeCreatePagefilePrivilege	4924	powershell.exe
Token: SeBackupPrivilege	4924	powershell.exe
Token: SeRestorePrivilege	4924	powershell.exe
Token: SeShutdownPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeSystemEnvironmentPrivilege	4924	powershell.exe
Token: SeRemoteShutdownPrivilege	4924	powershell.exe
Token: SeUndockPrivilege	4924	powershell.exe
Token: SeManageVolumePrivilege	4924	powershell.exe
Token: 33	4924	powershell.exe
Token: 34	4924	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6084	chrome.exe
6084	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 720	2388	wscript.exe	90
PID 720 wrote to memory of 468	720	cmd.exe	92
PID 468 wrote to memory of 5496	468	powershell.exe	93
PID 5496 wrote to memory of 856	5496	cmd.exe	95
PID 5496 wrote to memory of 2708	5496	cmd.exe	96
PID 5496 wrote to memory of 4924	5496	cmd.exe	97
PID 4924 wrote to memory of 1796	4924	powershell.exe	99
PID 4924 wrote to memory of 1796	4924	powershell.exe	99
PID 4924 wrote to memory of 1796	4924	powershell.exe	99
PID 1796 wrote to memory of 6084	1796	prevhost.exe	100
PID 6084 wrote to memory of 1144	6084	chrome.exe	101
PID 6084 wrote to memory of 3220	6084	chrome.exe	102
PID 6084 wrote to memory of 2104	6084	chrome.exe	103
PID 6084 wrote to memory of 3608	6084	chrome.exe	104
PID 6084 wrote to memory of 1320	6084	chrome.exe	105
PID 6084 wrote to memory of 2772	6084	chrome.exe	106
PID 6084 wrote to memory of 1964	6084	chrome.exe	107
PID 6084 wrote to memory of 6108	6084	chrome.exe	108
PID 6084 wrote to memory of 2244	6084	chrome.exe	109
PID 6084 wrote to memory of 5876	6084	chrome.exe	110
PID 1796 wrote to memory of 1964	1796	prevhost.exe	107
PID 6084 wrote to memory of 5328	6084	chrome.exe	112
PID 1796 wrote to memory of 1964	1796	prevhost.exe	107

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2708	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\91d11cc708062cb170b494402585ae7056f2f285bc5b43914705bdf76d6a728f.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:QJJJYBW))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd" NHJOXIU"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5496
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:MRKVYH))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\shellbag_tmp\shellbag_tmp.cfg"
        5⤵
        Views/modifies file attributes
        
        PID:2708
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:WWXEIJQLXOX))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4924
      - C:\Windows\SysWOW64\prevhost.exe
        
        "C:\Windows\SysWOW64\prevhost.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:1796
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:6084
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff992e6c728,0x7ff992e6c734,0x7ff992e6c740
        8⤵
        
        PID:1144
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,8149863057667274817,8687455634934522843,262144 --field-trial-handle=2004,i,7756269127602448804,1066949410112456203,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
        8⤵
        
        PID:3220
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1852,i,3632876123734652046,15618847297009188789,524288 --field-trial-handle=2004,i,7756269127602448804,1066949410112456203,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:2104
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi" --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,17049595759000797741,5722824832872336765,524288 --field-trial-handle=2004,i,7756269127602448804,1066949410112456203,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:13
        8⤵
        
        PID:3608
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2940,i,3152128009181020279,4897379653583216171,2097152 --field-trial-handle=2004,i,7756269127602448804,1066949410112456203,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
        8⤵
        
        PID:1320
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2968,i,12487812209433302740,2145681764502184098,2097152 --field-trial-handle=2004,i,7756269127602448804,1066949410112456203,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:1
        8⤵
        
        PID:2772
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3252,i,11169778741799461853,6357048274410365512,2097152 --field-trial-handle=2004,i,7756269127602448804,1066949410112456203,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1964
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3312,i,16027795572527731425,12899850248625769016,2097152 --field-trial-handle=2004,i,7756269127602448804,1066949410112456203,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:9
        8⤵
        
        PID:6108
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3992,i,17843773241226663377,11777327215582833969,2097152 --field-trial-handle=2004,i,7756269127602448804,1066949410112456203,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:9
        8⤵
        
        PID:2244
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4256,i,11782042145943153078,10381928634421554280,2097152 --field-trial-handle=2004,i,7756269127602448804,1066949410112456203,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
        8⤵
        
        PID:5876
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi" --force-high-res-timeticks=disabled --metrics-shmem-handle=4400,i,15250459655342150213,16978517054524115828,524288 --field-trial-handle=2004,i,7756269127602448804,1066949410112456203,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
        8⤵
        
        PID:5328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 454153d6d8c4996e8b6b4f1b662f318dbefc539871866a68f2afda1a6bf1e628
MD5 5a048fb6010ab00473ceae3a9af88868
SHA1 f00a4d63643ad89470aacbfcce7676437d59b3e4
SHA512 eb76197eb545d4647502113e079df33cae1da5e2ff8779f6bf2d3bdfbc2a0ebd0a0b3305eb70af58100c48a2214b9d3e3d38f325c2012229c463bb7a914321cb
TLSH
T1C4215733B3CC8624C89A403A50CEAC1036B687DB419EDF6B7B84D155A43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 4b31a67304f8b82d10fbd9a3f63ad75e17eccffc086cd21a52a30c14faf9fad8
MD5 416087418f4b4a597edf35e6068d4e53
SHA1 72ecebdbf15d758a6e506ad2b928dc9dc80c557c
SHA512 300c1439239c2201c05a90868f47b8dd9f39d3db3428d458245cd06607b741affa2eac6564d71c806892edcfbac4c0e9b0fe66da97675229dcc2acc58b3f3953
SSDEEP 384:M8mcGV1i3y4bbzTxbu+H0+6eCirZp3tIAbk4caGtIWjqj6oowjNnzvsbhNnk/pdQ:0/ferHXxbu+HnN3IAbkBaGt/C6oocjsV
TLSH
T169829768523F7DC7D8D112B410D602E7FBE4E048DA7551A4FF2BDE2B1C90ABB4E61520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FPSBRXPD.cmd

Path C:\Users\Admin\AppData\Local\Temp\FPSBRXPD.cmd
Size 1.1MB
SHA256 db58a27399f1b15ebf0a7add7bc22e43c090ac2c7f62854279e911dd53bef48c
MD5 d67ec445aa68a97b8c7d296e180a0df9
SHA1 b2a6f935cc152de96f35a63bb6c2b3351c39ba7b
SHA512 5e8101eca48d1144d72c010abf813649bc9a0475596add4f182807822ba8f46df53d53a42d172dcc108998e178409776576013d4c2b0fe6e4d628d298a61c061
SSDEEP 24576:pai3A9udSTyt/TPdQnlyYpBlVMdA/SwEZAweKxlC+ofW4+1eXJ5Xv:F3bhLP6nlyoH9EGEbGWl1G/
TLSH
T1AA4523910FC2FD9D345852282143B9651B7BEFD72A6BE8DE3211B8A7658E203DF4E704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4tbgv4vc.00k.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4tbgv4vc.00k.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Crashpad\settings.dat
Size 40B
SHA256 18d25ea33b88ef9ef692b57f50e036d977b681c6efb1384abad7fec61297fbf7
MD5 49f64a03b1eee6e342e687d5fda2648a
SHA1 fdb013410f64f0e28a1ca3d4b4bf9a043ad41181
SHA512 82ee0e893da1652b176a6a6fc62ecc53acb8c493c556f21320bb5d435eef348291dfe0a233062e7f38f20450c212ef66562356b3019192280a29bd1bfd810e0b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 58532f182e73b26cd433042afee331bbbc1ad105b976947da0caf7c738077938
MD5 9f75376f069f3176940be39457aa957a
SHA1 62b6793fe0ac417975b3c108c3b5ca5af8caa489
SHA512 db1c478fabbe1284e9f1775d99f598b4c913935988566fdca3460f2286f7f1e3d9dbf0f28985cbecd3da495d038fb078c7c94617a28158db69a9458f3c0e7fba
SSDEEP 6:/FoEXEHtKfkNq+mDIjw2a4BY8kC9Em+qPT+ptFRXZkirT1cFOl:d7XmtKMNZmDsmmPm/JrrJ0Ol
TLSH
T1F7135E7D58902C12C2C40E3C855BF7351372F840A6D1026702353290F418B31895F294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 dea5f08882af8412a78bd7f2085bd69f520a2401b7e58b33869ec370eb756c7b
MD5 4769be6c7a82865e3b8ef0065082d738
SHA1 d6de6aecc4e1a304db7e54081d1284de606b63c9
SHA512 bc384cdf44688a6cd958ead4a5ae42c51f387bab0e3b845c9caf963ea3271534f90455d8ec59ebabd48f42b11566a8db15658d81a60dff7b591f48368d469443
SSDEEP 48:holk00YgP3zlblQYhM1XgTUWSMmXJCXFdVEPLVBKWwtl:27hGhblQ8ugTjSjkrVOLHKWol
TLSH
T1134486F72D05DEC6EB18CAB85C41923C8E3296162CAAFD79F53944E295509E331285A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f9420976f7478af33e59f3ec97f903dcc862a4f148de66b36b4c82511e4e6e4a
MD5 7075a2b319e01fd464f753b47c4f0794
SHA1 301e2d8f71056cea5cb5e70f58fa2948d8ac2c36
SHA512 b6d5e2418f6a05e036e66f8a71a1a65e92d8e7277096c77bdf3217a9117eecf3a754082794f192fc8800736a8658c4c909c3149e9e0a46bd4e8cfb95e40f716d
SSDEEP 768:bUfDPLSgcRUv+K4UUfDPLSgcRUv+l4BUfDPLSgcRUv+H43fDPLSgcRUv+I4tzz4t:oRuEGz7zd/Ruz8z
TLSH
T190165CA74F687A46D785EFB0BBC9DD1C3CB02396EC925892F11352694AE0FC01B8511E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 9b64076de46e2a9bde1c9fbb38b5dd197b3182c661a01fc169c0ad1ea58b8832
MD5 f20b51a92b5a30b16e3a3ad08869ba1c
SHA1 53a11a1fcf5f6dd2274b1247fc71edee365b2ea5
SHA512 459488a1e3e80fa7d6cdd506110ad828806fb60efb0b0b472167bf72cd4ff75a9ba52c03ab04284f3de8901a2b27986d125f958c6091c879808beee06b4a3a12
SSDEEP 768:ZKSNVf0zF8+biVOne7ueUKjsZBRyI5OmUD6oejwb+MVxjMu:bNVMzSp7uqYjRVi+zjwFLMu
TLSH
T19803F2702A33B983CBE7123A2C6D12E37584943C3457C7A26D9437DE52E5E2A12D8FD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Cache\Cache_Data\f_000002
Size 71KB
SHA256 99ff0be776dea84eaa37ec69b52f6304cd4b37a60677782d9b505b70183b8de4
MD5 9cabca241ae51db3e05f219326a7f445
SHA1 7242a774a9abca60ad895da8e88691b963bc9a43
SHA512 f121a88d2869d4ecb7c3daa69938d7116f237060ff4126e9f9eb3a7ef2f2e8e041a6b1399f8042e9c3560fc1930249add9662d56088e32c739e8210489094b14
SSDEEP 1536:4W7XKPClEZFrypihpDlvQ3Q1WIk4Yfzea3ajKp7FJlcvyPy1:4W7aayl1Wf4SOj1KPy1
TLSH
T1056302C496F6CB8AE7F320CFC84802A6FF045BEEDDD434A9BA791894E990605FF85145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Cache\Cache_Data\index
Size 256KB
SHA256 3383b3e5474323bcb38fdd3cd03c2badad945496f8dc8a58ad87cfdc1ec55816
MD5 52fb030bbea2ae6181b3f3c08a3ae9ab
SHA1 8e2e955ebd7ea60905fc97f27e78a39d8580afd5
SHA512 9100a3eff3546b9afc9fb27b7cee3780282e798aa7cfb0ea673de58c479f6803a4b85b4088c5bc8e24787104996e8d84a4487840e7da944b8e7f438748641a86
SSDEEP 3:LsLllFlklNllklkXlJDGGLnlillLll/njNtlmNtlYlXlcE/Alr/9lXl:LsRa3lPNlGdkNIEEI
TLSH
T15D44029E474D5E0DC6C005FC84479B647339D505DE9BC743535435116CC17655E1F154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 97b9aee0eb1539f3aed6e75fcbd99917420e6813e409df1f43455fd87ae133a5
MD5 c4e97d13fc38181dd91d94b6e9fe0e12
SHA1 062100ce0ed849a761106f9d771bc39d041a104e
SHA512 e974c4a5ae7441fff6440d21e4dfa3a9e3d6e0ef7306179a44b644f0d6f586eca388f32e99384d9996e49c69339a02bdfdc31649fd8bfd83ba4090821ef0cb15
TLSH
T135E02B81828C0F0DD32D96F7CDAA03098A0E42C439BE3603A980C2C133124341298622
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 e9d7caf15dbdd71e97ee8ff026646dd7e49f1bf7b3b99a8167172ee5146f0765
MD5 7680a616004610041cf905210453b03e
SHA1 6804dd03f9a70d46faba1f6f73d0021073af172e
SHA512 2c017cac80810ddc65455f87c4e2b7e095c92aee45ec0998e803ab20b577231aa53a06b2d3db595d1cf2d47bf0098021c7aa8b71c53efabf309702342af8d471
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 edd1894008d05564db15ac99bb5c7cc4d5f2a68514b82c88af1d6f06edac018c
MD5 25ff025dea3d48f8703f1bfc89e1de85
SHA1 8846aa8c35b8ad6e3d3bbd14b132aaac5862f690
SHA512 25c40089d554026bf9a697d1699b70d57b4dbf509459481b274ef29a8078436071b638a03913017f2fd2a155789d4325a42da4bb2aa59c2fa8f18f6399bb7eb1
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\DawnGraphiteCache\index
Size 256KB
SHA256 9560a4f42933e8d7e8265c4c2670d708154f490bd6436a1d89d8b3acade8fd63
MD5 31c0cab8e22ca23df3d31b7b9106b88b
SHA1 ff5faeb25ee7651b4d2b0cd6e80d420a52de8f70
SHA512 b7bd301f9b41879ea4e7be24e9f57cf6a4d5e0d2d5d6e345afcf8247ab723f354ed06bfa4a77d0ef1a30f8c5c95dfaa2da3ee69c813a963812bdff4096df3213
SSDEEP 3:LstlNllklkXlhG/l:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\DawnWebGPUCache\index
Size 256KB
SHA256 4d5bc6d96bce39526307f6c80dbc6475971ef22818da59476be1120ce4deaf96
MD5 4d2d33973548218c5f1347b4f6ad5cba
SHA1 5aeb21cf4246269efb1924004402a2f6764e5d0e
SHA512 07ef51474006ba6244e7762e21dce7e1335ab62b3fc5a529df592d082ee428148e5a82b1517d0ceee8032e00503b1764fad6ba4a0b7a18d4ee5a264e93af724b
SSDEEP 3:LstlNllklkXl7Kt:LsX3lP7
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\GPUCache\index
Size 256KB
SHA256 9f8a6cecf7b5cc22b33913b5375b87dca2e44a1646ec0609f9f175c315bbfe6a
MD5 a4701cc72e207a2e1b3e4ae68a610e75
SHA1 2589c5e96c6b014ab820dce4baecbeeedb51baa4
SHA512 f0a013e66f1ffe77fa41e4d672360bedc3ae6873944cee82df50eb321ca6bbec6489c407ad6e4bd950d64f371db5530270aae79072667f3c63106a0209826f57
SSDEEP 3:LstlNllklkXld3t:LsX3lPF
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3f31a5032d031fb4841147fbfd7701d235abb7896d0c09b7dc8a5c14cbf1685a
MD5 84f113fe8ada413adaf204eb63bf6f89
SHA1 8fdcf3ad1b7e4863c39ca4e7f6c3c544039bbdf4
SHA512 35b030dcba1af3633d0583e7890a24e6aaf741754fc7c462362148693990262fdb77af5272c05d827655d97de2e3e582873da67d66955a4140cddb988eaf70a6
TLSH
T16AA0021113508350C30002B16803C38A1601BB6DC1054A13B7F01346CCE00988A61295
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 344bdcf9ff91fda0d3bac6b5790d8f681c3c0d1c3cbaf16ed4d9c3683d6454ec
MD5 9c75b57b350376651c8843401ff060c9
SHA1 b5347482047e0ce571c2605ffb6212e80d01cfc3
SHA512 605025b89b8a8617850360fe78d9708b0144d47f8676dee5eb102b9a300ad8eca28917941cbad4ba647ba670c4e15a4d4d9d53dd0224197c78bbb5a213fc65a8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\t0agna52.pzi\GraphiteDawnCache\index
Size 256KB
SHA256 232791273c174a05a789c723b8de2090b07f48f985b553b502a0e146adc71883
MD5 0178123f065d38579ee7eea3817c5716
SHA1 96f3bf2b847eba7a2ae01ad24213400bed67c3a8
SHA512 15c0f5ca83bfe165f3147603bf14aaee78d76010007353aef826c6aea5babd1e11b9631b35ca172a93a22465b577cba401803c878a065e724c4201b44d4481ca
SSDEEP 3:LstlNllklkXl4u:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/468-9-0x00007FF98B1E0000-0x00007FF98BB84000-memory.dmp

Download

memory/468-12-0x00007FF98B1E0000-0x00007FF98BB84000-memory.dmp

Download

memory/468-2-0x00007FF98B36F000-0x00007FF98B370000-memory.dmp

Download

memory/468-5-0x000001E0BA690000-0x000001E0BA6B2000-memory.dmp

Download

memory/468-8-0x00007FF98B1E0000-0x00007FF98BB84000-memory.dmp

Download

memory/468-7-0x00007FF98B1E0000-0x00007FF98BB84000-memory.dmp

Download

memory/468-11-0x00007FF98B1E0000-0x00007FF98BB84000-memory.dmp

Download

memory/468-6-0x00007FF98B1E0000-0x00007FF98BB84000-memory.dmp

Download

memory/856-25-0x0000000006830000-0x000000000684A000-memory.dmp

Download

memory/856-20-0x0000000005DA0000-0x00000000060FB000-memory.dmp

Download

memory/856-24-0x0000000007AC0000-0x000000000813C000-memory.dmp

Download

memory/856-23-0x00000000062C0000-0x000000000630C000-memory.dmp

Download

memory/856-22-0x0000000006280000-0x000000000629E000-memory.dmp

Download

memory/856-16-0x0000000005540000-0x00000000055A6000-memory.dmp

Download

memory/856-17-0x00000000055B0000-0x0000000005616000-memory.dmp

Download

memory/856-15-0x00000000054A0000-0x00000000054C2000-memory.dmp

Download

memory/856-14-0x0000000005690000-0x0000000005CDA000-memory.dmp

Download

memory/856-13-0x0000000004E90000-0x0000000004EC6000-memory.dmp

Download

memory/1796-54-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/1796-56-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/1796-65-0x0000000006540000-0x0000000006590000-memory.dmp

Download

memory/1796-64-0x00000000062E0000-0x0000000006372000-memory.dmp

Download

memory/1796-62-0x0000000005E40000-0x0000000005E8C000-memory.dmp

Download

memory/1796-61-0x0000000005D70000-0x0000000005DA2000-memory.dmp

Download

memory/1796-257-0x00000000063C0000-0x00000000063D2000-memory.dmp

Download

memory/1796-60-0x0000000005780000-0x0000000005786000-memory.dmp

Download

memory/1796-55-0x0000000004F80000-0x0000000005022000-memory.dmp

Download

memory/1796-59-0x0000000005BE0000-0x0000000005CD2000-memory.dmp

Download

memory/1796-57-0x0000000005160000-0x0000000005228000-memory.dmp

Download

memory/1964-200-0x000001DCFE590000-0x000001DCFE682000-memory.dmp

Download

memory/4924-42-0x0000000008360000-0x000000000838A000-memory.dmp

Download

memory/4924-36-0x0000000071330000-0x000000007168B000-memory.dmp

Download

memory/4924-35-0x00000000711B0000-0x00000000711FC000-memory.dmp

Download

memory/4924-34-0x0000000007DC0000-0x0000000007DF6000-memory.dmp

Download

memory/4924-33-0x0000000008A20000-0x0000000008FDA000-memory.dmp

Download

memory/4924-32-0x0000000007C40000-0x0000000007C62000-memory.dmp

Download

memory/4924-31-0x0000000007D20000-0x0000000007DB6000-memory.dmp

Download

memory/4924-29-0x00000000064A0000-0x00000000067FB000-memory.dmp

Download

memory/4924-39-0x00000000080B0000-0x00000000080D0000-memory.dmp

Download

memory/4924-40-0x00000000080E0000-0x0000000008183000-memory.dmp

Download

memory/4924-41-0x00000000081D0000-0x00000000081DA000-memory.dmp

Download

memory/4924-43-0x0000000009FE0000-0x000000000A004000-memory.dmp

Download

memory/4924-44-0x0000000008070000-0x0000000008078000-memory.dmp

Download

memory/4924-45-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4924-53-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4924-52-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4924-50-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/4924-51-0x0000000010000000-0x0000000010060000-memory.dmp

Download