81875cf965875c6374ecc1d6730ba629f463f00fbb6b695be1587b3103f97659

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO-0481664.js
Size 2.7MB
Sample260807-mbwacsbr21
SHA256 81875cf965875c6374ecc1d6730ba629f463f00fbb6b695be1587b3103f97659
MD5 5b74f62315bd5dba42169868407fae94
SHA1 1b427d8ef19e0165f66b8a80973cb35cef110dd1
SHA512 640cc20104bed069cf99c83541fa325c76a2fd6df0a12dcf80f8980773f1ddb04339a087aa70cb0362390782f45abe915af0488359a38c7214e71d38f82fe299
SSDEEP 24576:BgWjWfb8oeWrk9TqDs+5mQrdlvBJunH5Xd/9RG2aNjphFOrGhx0ZWmoXO96VL1z/:Y
TLSH
T1D4D5863A872A3D2A61F610A5ED1751C03F986C99D1A2C8B3D06C2B3324A75FDED93477
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5968	powershell.exe
1780	powershell.exe
2352	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\prevhost.lnk	prevhost.exe

Accesses Microsoft Outlook profiles 1 TTPs 39 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2888	cmd.exe
5132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
344	chrome.exe
5248	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5968	powershell.exe
5968	powershell.exe
1780	powershell.exe
1780	powershell.exe
2352	powershell.exe
2352	powershell.exe
2352	powershell.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
4456	chrome.exe
4456	chrome.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
952	chrome.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
2712	prevhost.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	5968	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeIncreaseQuotaPrivilege	2352	powershell.exe
Token: SeSecurityPrivilege	2352	powershell.exe
Token: SeTakeOwnershipPrivilege	2352	powershell.exe
Token: SeLoadDriverPrivilege	2352	powershell.exe
Token: SeSystemProfilePrivilege	2352	powershell.exe
Token: SeSystemtimePrivilege	2352	powershell.exe
Token: SeProfSingleProcessPrivilege	2352	powershell.exe
Token: SeIncBasePriorityPrivilege	2352	powershell.exe
Token: SeCreatePagefilePrivilege	2352	powershell.exe
Token: SeBackupPrivilege	2352	powershell.exe
Token: SeRestorePrivilege	2352	powershell.exe
Token: SeShutdownPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeSystemEnvironmentPrivilege	2352	powershell.exe
Token: SeRemoteShutdownPrivilege	2352	powershell.exe
Token: SeUndockPrivilege	2352	powershell.exe
Token: SeManageVolumePrivilege	2352	powershell.exe
Token: 33	2352	powershell.exe
Token: 34	2352	powershell.exe
Token: 35	2352	powershell.exe
Token: 36	2352	powershell.exe
Token: SeDebugPrivilege	2712	prevhost.exe
Token: SeShutdownPrivilege	4456	chrome.exe
Token: SeCreatePagefilePrivilege	4456	chrome.exe
Token: SeDebugPrivilege	952	chrome.exe
Token: SeShutdownPrivilege	4456	chrome.exe
Token: SeCreatePagefilePrivilege	4456	chrome.exe
Token: SeDebugPrivilege	4912	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4456	chrome.exe
4456	chrome.exe
5192	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 5132	4728	wscript.exe	84
PID 5132 wrote to memory of 5968	5132	cmd.exe	86
PID 5968 wrote to memory of 2888	5968	powershell.exe	87
PID 2888 wrote to memory of 1780	2888	cmd.exe	89
PID 2888 wrote to memory of 2352	2888	cmd.exe	94
PID 2352 wrote to memory of 2712	2352	powershell.exe	98
PID 2352 wrote to memory of 2712	2352	powershell.exe	98
PID 2352 wrote to memory of 2712	2352	powershell.exe	98
PID 2712 wrote to memory of 4456	2712	prevhost.exe	99
PID 4456 wrote to memory of 4452	4456	chrome.exe	100
PID 4456 wrote to memory of 3436	4456	chrome.exe	101
PID 4456 wrote to memory of 344	4456	chrome.exe	102
PID 4456 wrote to memory of 4300	4456	chrome.exe	103
PID 4456 wrote to memory of 5336	4456	chrome.exe	104
PID 4456 wrote to memory of 952	4456	chrome.exe	105
PID 4456 wrote to memory of 5152	4456	chrome.exe	106
PID 4456 wrote to memory of 5172	4456	chrome.exe	107
PID 4456 wrote to memory of 5068	4456	chrome.exe	108
PID 4456 wrote to memory of 1400	4456	chrome.exe	109
PID 2712 wrote to memory of 952	2712	prevhost.exe	105
PID 2712 wrote to memory of 952	2712	prevhost.exe	105
PID 2712 wrote to memory of 5192	2712	prevhost.exe	111
PID 5192 wrote to memory of 3828	5192	msedge.exe	112
PID 5192 wrote to memory of 2284	5192	msedge.exe	113
PID 5192 wrote to memory of 5248	5192	msedge.exe	114
PID 5192 wrote to memory of 4896	5192	msedge.exe	115
PID 5192 wrote to memory of 4936	5192	msedge.exe	116
PID 5192 wrote to memory of 4972	5192	msedge.exe	117
PID 5192 wrote to memory of 2140	5192	msedge.exe	118
PID 5192 wrote to memory of 4656	5192	msedge.exe	119
PID 5192 wrote to memory of 5428	5192	msedge.exe	120
PID 5192 wrote to memory of 4912	5192	msedge.exe	121
PID 5192 wrote to memory of 1360	5192	msedge.exe	122
PID 5192 wrote to memory of 448	5192	msedge.exe	123
PID 5192 wrote to memory of 3928	5192	msedge.exe	124
PID 5192 wrote to memory of 4092	5192	msedge.exe	125
PID 5192 wrote to memory of 3212	5192	msedge.exe	126
PID 5192 wrote to memory of 4572	5192	msedge.exe	127
PID 5192 wrote to memory of 4076	5192	msedge.exe	129
PID 2712 wrote to memory of 4912	2712	prevhost.exe	121
PID 2712 wrote to memory of 4912	2712	prevhost.exe	121

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PO-0481664.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\wq7kwm84zda2.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:BGEIMOKOHX))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\wq7kwm84zda2.cmd" WNMFJCDA"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:UJOIBRASLJPD))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:DRMKOI))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2352
      - C:\Windows\SysWOW64\prevhost.exe
        
        "C:\Windows\SysWOW64\prevhost.exe"
        6⤵
        Creates a file in the Startup directory
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:2712
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff97a36c728,0x7ff97a36c734,0x7ff97a36c740
        8⤵
        
        PID:4452
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1720,i,4059668915874938873,10745355827456425925,262144 --field-trial-handle=1956,i,11753204427713627501,13745479149893777165,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
        8⤵
        
        PID:3436
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40" --force-high-res-timeticks=disabled --metrics-shmem-handle=2004,i,9737459474134053283,4861588043414387719,524288 --field-trial-handle=1956,i,11753204427713627501,13745479149893777165,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:344
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40" --force-high-res-timeticks=disabled --metrics-shmem-handle=2084,i,10835359500860186633,15256202170801230811,524288 --field-trial-handle=1956,i,11753204427713627501,13745479149893777165,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:8
        8⤵
        
        PID:4300
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2984,i,13694189779232468604,16703148405189230435,2097152 --field-trial-handle=1956,i,11753204427713627501,13745479149893777165,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
        8⤵
        
        PID:5336
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2988,i,10847202615965779224,8032449663948913703,2097152 --field-trial-handle=1956,i,11753204427713627501,13745479149893777165,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:952
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3224,i,5851467424060662298,9777176020432642672,2097152 --field-trial-handle=1956,i,11753204427713627501,13745479149893777165,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
        8⤵
        
        PID:5152
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3252,i,16485353254825893787,14892865651637285418,2097152 --field-trial-handle=1956,i,11753204427713627501,13745479149893777165,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:2
        8⤵
        
        PID:5172
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3940,i,15194272894920443554,8580846582309676600,2097152 --field-trial-handle=1956,i,11753204427713627501,13745479149893777165,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:2
        8⤵
        
        PID:5068
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4116,i,9885799563267046031,4974643202233786716,2097152 --field-trial-handle=1956,i,11753204427713627501,13745479149893777165,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
        8⤵
        
        PID:1400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y"
        7⤵
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ff964bfc188,0x7ff964bfc194,0x7ff964bfc1a0
        8⤵
        
        PID:3828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1744,i,5389460727366328704,10034235612031998220,262144 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
        8⤵
        
        PID:2284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,14192201834351403444,7315964543548278532,524288 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:5248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,12085008759733346252,10122963996657148962,524288 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
        8⤵
        
        PID:4896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3108,i,12450069320500114138,757720281696961104,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
        8⤵
        
        PID:4936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3112,i,4087217886886390910,12380602990647940800,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
        8⤵
        
        PID:4972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3444,i,15713484617373183624,126706539577316596,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
        8⤵
        
        PID:2140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3448,i,9291900068691102523,9102731386139340093,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:2
        8⤵
        
        PID:4656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3496,i,7901109262741212173,16061120374185358192,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        8⤵
        
        PID:5428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3528,i,12983556045422202575,17956335380647018529,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:2
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3532,i,3159791589729627058,15811748737552437158,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
        8⤵
        
        PID:1360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3576,i,14901457677364837546,9839194948253331986,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:2
        8⤵
        
        PID:448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3632,i,12504789427114762825,1845488044522082791,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
        8⤵
        
        PID:3928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3656,i,13658298810222134729,912078819714098300,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:2
        8⤵
        
        PID:4092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3680,i,17697958214479661680,7551825227424012047,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
        8⤵
        
        PID:3212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3728,i,8462853288483452728,6465871525389816953,2097152 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:2
        8⤵
        
        PID:4572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,13522100108900452458,10470853091985669444,524288 --field-trial-handle=2304,i,15147786120724969120,12021615496516763921,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
        8⤵
        
        PID:4076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5164

C:\Windows\SysWOW64\prevhost.exe
C:\Windows\SysWOW64\prevhost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

wq7kwm84zda2.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\wq7kwm84zda2.cmd
Size 1.4MB
SHA256 edde4a2f78f48e0cf63a02e130042bd85284d4de1704990ba491d90e1a708b94
MD5 59fb5cb8088fe12eb4b6798af27678a6
SHA1 c6dbf74e6060e199d204d202d7f88e1b85b151f2
SHA512 951fd1fc16ed335dbd2ab90e04b8109a076217315460024a6c991418be6ce2555a012559c87d6707879b2eaeac34fad0fdcba0c2cdb034d533d6a9350c70f3c9
SSDEEP 24576:hLzty40lVlbmnYgOCrjBAgtzBBhTRCE+3dh4mY8xQJSaQKhTRv:iLqnh3/9Q4Tt
TLSH
T1676523305F0C2A74A1BE0739BA5F8EC92B5EEDE2C2A1D4FD748132C65178A02D55D72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5861c6b89c7190f563d8a09161365f4aad835a2ea2b8d63c555746473395a4c5
MD5 fb3fd1c67494ef93eb6cda2216e148a6
SHA1 4fcc4c4e37a11e3cf6c6a6fc76cab7f93d6dbede
SHA512 2ffc3e02ac9cedd82aa18082c7b83a25ae1948d5962db403cfa8f95177fdda76280c9a4d6bbe26cd6519789c2080af925a1033cf97c5494caf7462764f956c78
TLSH
T100115323B39C8921CC96163A509D9C2176B682DB819EDF9F7BC0D205A5BF988CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 45c2a3348fba93228e41abe18bbf5772607e93f34f2d3fe762cd40f9d5e32b79
MD5 b84f8d480a24e422552d0bc1bccec3bf
SHA1 8a1524eb04beea1d8f6e8b674bf6cf2044848d1a
SHA512 a1d9bb6ffa79ba5e53659eb3a6fbad792bb8f56a1fa34a55f325525fb25179b77a85bfe4b08787ba8d5e91019bcf7035a0d0e5ee75cd5fcffe3da10acf31fdb8
SSDEEP 384:Prf+jI9p+tABVVFvkzcCbkso9opToH6seYWZe2l/+C3Sof19u7DQRYcfrT3lVdsX:DfWapMFwRopTo4ZpBSmu7DQRYcDxTsKE
TLSH
T1A682D76D604F66C3C8C59378D107055FE4F2EE8D531A03D8BB5E5E3B8AACA9ED02D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_tvbqhnpm.bbv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tvbqhnpm.bbv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Crashpad\settings.dat
Size 40B
SHA256 fec0a13e711067a22e36143aa4a8683c39b85547bf4e33f4ebbeb97c8650d6a4
MD5 f3e58d4df87b7f60cc3a0f1fee8823f8
SHA1 5ac5f10052231b0a8037362f4946ec0a59d382d3
SHA512 e833991ec4e408a0c20a098ee38038fbe18bf1afaaf8069a6b70d4d2a89b0a62e2a1c9d4a7342cea2847270ab891ed605e1a8265e865d1bda3665c928e3a532e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f356a24d5d6f9d7206860b93522f41a00d05c30a9250d7876f75975fc2c94045
MD5 08c8f1076e0793502386e5767fad0599
SHA1 d6743e8f0599056c249395f4364809aef5f9abff
SHA512 65a4c7af59b180e6ba73eaa73efa30218526a5b371d7853bdd86576f9251a4130bc3c62c00fdb111038a29bff6dc0de08e29f736f73059a90dd154dcaaa8d722
SSDEEP 6:/FoEXE290vikN07BNuv1DPS6575qCUv4kEXtgSEZlskllBg5al:d7X7EHN0jO1DPP59qVwkEoD/Bk
TLSH
T16D13C97DB64C1E1FC6C9A07ECD879FB443F68544EA978A7B153834207A473520A6D304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 31371ce04bebbfb173576cdd8d3bd9013ef4553d2ee21081b3cd3842e05ad367
MD5 9d4f3ff308e86306a0fef193fbc721a1
SHA1 a07a7d18544a6eb417f6c15d8d84155c9317bb9d
SHA512 bdf936b1408a85b0bea9bd67ebdf9692e6356b07696760a8ab93a845086aa3f7c3e9ffb6da4a573005671c02e09e83ef447c009ac0db433d4ae71b1461b3ac8f
SSDEEP 48:6flwEYTo1bP3zlblQFjMyM1Xg4XqUagMmXJ2dVEPLVBKWwtl:swx81rhblQFAyug4qrgjeVOLHKWol
TLSH
T1814488F73D05DEC6DA14CBB85C41923C8E3385162C6AFD79F52444A10651AE731285B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 e7b7fb3aebd3646a7971e2403887eb7ffa38eed2a476f4b5e220998bbd21930a
MD5 1d9dc11b61613aee4bf8de3c7802cb3f
SHA1 0dfd9ac027826f7732e1c808df3b271e67a0481d
SHA512 0d134953464b7691bee502f2fa35978ecda1e4654ea98e9f45f1d1ac95c46e77aff26e37b60fe9ba9c79c1aeeed0a0e4e7a78a6586d019b4ee89a75365d44cee
SSDEEP 768:3UfDPLSgcRUv+Sq4PUfDPLSgcRUv+Tq4JfDPLSgcRUv+gq4uUfDPLSgcRUv+eq4V:MqCqWqUq4Rzd/RAH
TLSH
T16E165DE25F247982E685EF70BBCDED1C3CB03295ECD258C2E52291794AE1FC41B8416E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 5128deea00af40a08887a59d16bdc6497f437e09883b9edce604bd00fc526ad7
MD5 a23b110160baf5e244a0230a4e1e2f0a
SHA1 0fb94013b6564c54e015c8801257d9ff002cbe6a
SHA512 5ab49e67929048d074631f39250482f1d8814ea8f062c1841a02a3a2548440f428a848f3ad8814f0c2d0cd27a3b49fc12b51e157aa3abd30ee1c6e039e274c66
SSDEEP 768:KvfedGq7O+WFFT9n8jcxyoqGjQaTazjGjz7jQw4mQsANlaOUN1A/pdExcfRw6O:BkTmYyoq3aTaHGPUbssUNWBdt5BO
TLSH
T13F03E00156FBA29459A81A820C8B84B8D54EE33C3AD174F13F51CBD9396AAD43B94CB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Cache\Cache_Data\f_000002
Size 71KB
SHA256 c5cfcfe10aa1686b7c43575ee31c8972ae2d0d05cb8d71f87892455e4a1eec9b
MD5 075110f361981db0c8637c9889ee8a18
SHA1 05e2bd96edb12c09b9bfae0a8ff1e19abd10bb27
SHA512 3af2fdc73bcf4078b3e0e945bd74c3ede09008a34033698ce297de51309351d34bbbe9740ef76eb6dfdf585496d6c51faa990d51a5fa9f2f60ef60a276eff8bf
SSDEEP 1536:4W7X6PCIvB5uKamkCf8G1WzU2eZcypBE4QfT5BRsxeGvjqtS:4W7qac+jGR5ZFfQjRFAjL
TLSH
T16363023B02F8D791488425E352ED13A657F783ABE4FF744DE26801D211683FC6672DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Cache\Cache_Data\index
Size 256KB
SHA256 bbab1e4c6df7015b2159dba92ab0fd76378b27d1437fb14ab2b99800601e134b
MD5 9fcb3d22c57308f8941cb36d21450c5e
SHA1 9cd7b4ef1926409d22efb723769fbc1dab77580c
SHA512 14369d8500bc6ae84f3ac6dbd390065800b978c5b72ba958aea3fce8756b79d123ddb29b4c25f0e9949b5f9356c54fccd6200dcce627e6652668f7368190d9e9
SSDEEP 3:LsLllFlklNllklkXl/+t7RwtlollLll/njNtlmNtl3Nl/lgl5llll/9lXl+ll//:LsRa3lP2t7g4dkNHUlllUlt
TLSH
T15444016EA38A6F16D2C406FEE4478B616378D909EA8FC743570636602CD67902E0F564
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 a52924ef99a99ad4cfdb9580cc0ec98e19cb0bc70e7992319b72250d8a26833d
MD5 fa1386c9b160b82e4ec247c961db1df5
SHA1 2cd49bc9f42491002ba86c717a946cf3d72d59ff
SHA512 4ef0b1358fd7bcae8b3013692487eb647601926072727838dad28d8bda74cff1411a4d5292aab7831e92ba797b28b39498a4fed6b1a80f6e228d1457dbcb5ae1
TLSH
T19AE02BC1824C0F1DD32DA6F7CDA703454B0B42C42ABE3A03B881C2C273128241248122
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 be66b830530b53294e5ae101db203947bfc848c07096e739fad093882851b5a9
MD5 fa76d1b9afe40dbe51c3cdfe5e0c3232
SHA1 5650d1f3bf9df6f13d367ae63d1a209141316aa1
SHA512 5eb4a99a4d23588a32f50d109325de5ea9abadc56a347c179b8e27e1d7f5da7fd269da130753fc1aa550ab439c6b663dbcff5508245f9f2f9410222d9db14279
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 616b3b79046ad43af2aebe7604363b56f9daa6b6a3d31bc895ba252b995a60cc
MD5 97cf555525fdf8f6999daaf20ef2c842
SHA1 0e8d16ae325cc7a8455ca73ec20864ac4298133a
SHA512 d74d9b6e97a2cabd2fc4c9e920d4fd97bfe549d46a9c7e2a5eb9446ee7dc1f056664a5a76736684960982764f6fc4266e964c395d3d4008ce5f2c838583a9b07
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\DawnGraphiteCache\index
Size 256KB
SHA256 6bf7f91226db4efdd4d2b1a69f10a28d4eeadd7afea9ebca704c164284a0a7a1
MD5 faadf8332aeae225a8503491278af8ee
SHA1 3e34ab67c986a394495f66e8025a2558206d7e33
SHA512 db8071ec2f818eb69b5a869e62251a09b5d716b9c7ec69560e5cc1786922231c6b6747da792fb0cf397cb3da7b83b94b6aee995b0bd4768a8752c07c8eca66f3
SSDEEP 3:LstlNllklkXlCrct/:LsX3lPCr0/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\DawnWebGPUCache\index
Size 256KB
SHA256 e77524a620f4ff205e415153ce3757dca47dd00c0295a12745e31dc99103a29b
MD5 50f21a35836df768dd60617d8084c908
SHA1 56711c778da043767d6e31cd3e090d93896b249b
SHA512 2d94817912ae52261d20dff5a796f45533c288ac6e30d449470776a14033a068f575b325afe3dcce5fabb8eeca305cdc944e2df1f1163dda0ab81769f7ec7894
SSDEEP 3:LstlNllklkXlNVKt/:LsX3lPPKt/
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\GPUCache\index
Size 256KB
SHA256 1c86420ba52df640e8cf40d50ac537659f82158329e65e77c19e47e4957032f6
MD5 1307eb07b41a2c378b3c68e386cd818b
SHA1 7b20a3da399e709731ba8087203306a9bcbc2cb1
SHA512 394a5e740e07c22fc0864c12b34270f62d634c169fbd43ff1e5d3217f18490ab5c45c9208de96166386cff0e820816304279ae9f3e28c0abd17d4e4dee7ab45d
SSDEEP 3:LstlNllklkXlmgu/:LsX3lPmgu/
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 13f76d79a3f69dfe2db10d4bfb3c15ac97f4eb78310fc76bff3249b5d23f4546
MD5 846d938f22f9bfba8248515026973e7a
SHA1 9e82f46effb078a4fe08c862dcfde11535770cb6
SHA512 7d49d7d42a8ad6b5d18f48f57dddd07288e9302deb96cba7d030525ee2fa313df5dd41f937d0e76cb7202fa46230b64afa68d5cfb63491961e98bbbca7732a96
TLSH
T102A0021212418150C25013F0280583C82204FA25D5010293B6F003868C601504D52154
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 a7deaec6f230cf3a0f337931267cc86a98ce2f8a1326588a43d40909804d794e
MD5 906efbdf8e850e12b30bd0fcf102c5a9
SHA1 667d737370a90afb9e9300fc0a035e2c7e789f48
SHA512 08e1da3e9c988967bfca6917f80fa40e79aadca95cea607a9d9ab0b7869430b9c7d75819d73d6faa42e8a1573fafff4be9d70a52edfac9f34784869cd060bad1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\dcr4hq1f.b40\GraphiteDawnCache\index
Size 256KB
SHA256 31138b0fc86857b8679c9303cf8e4b7d644e1cc6f9632a0427aee8c314a68827
MD5 01d0a32135bc732b6cd7ed6e606a4d2e
SHA1 7818aff51093e43bf41d82aa8dce2df9d16c0760
SHA512 115f7c3bcd77c1cee59459e5619a297bf79e5944424f3e7587e4271b07d1b45a901f4fa09bae47268a0e3b2757d422c51f1a437452742d0e892e38d854c73639
SSDEEP 3:LstlNllklkXlP+thl/:LsX3lPc/
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y\Crashpad\settings.dat
Size 280B
SHA256 5aba3ce155f46066cdf43efd8ce08e3173498dbf208a7b7c97b954cfad21b692
MD5 6f0f5bee5320786030424ccb9eb09671
SHA1 b8b6cb338f36c067759363d7e29f9fc953bb63cb
SHA512 4465a01f7b5bdf52f52200342d829b34d00b66f1cb6e94da336090689b3164883de6e0bae843a49b4bfbb40dd24061bf59485779d166abafc0fe36577929cc08
TLSH
T193D022B3B3220C0BCA00F83808A82F20230388000322328232A2008B0F00032800B032
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y\Local State
Size 4KB
SHA256 89513df7bd31ccb840e734ef5d703b1c2d22d1f6f7539329a904fa948c5d9cc6
MD5 5f038d44c45b759ab66c5e87a1afa1b4
SHA1 4bceb68442195f69e0cb3442777ef1a26b293d72
SHA512 5e503d434b14ad6a2e60bbba6be4792b1d1b950c28d96878233e08162d1a64739aad8801e2f6e638bb78276156bbc41bf23d2b078abadeeca22df7097c1c8ec2
SSDEEP 96:5qGNkFsFf16+LS1LJmDT1BLPlvJHAZv5JCo0eUnmIwGLq4a:AGNqY6+4uTLb7ov5lqmI6
TLSH
T15481C6B16420FD2749D5AA9C748936939F7834B3D815BF94E6D8631C00E76982B0FC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y\Local State
Size 5KB
SHA256 e98d591f5c6064dcefc63fb97cd104a53422a9a29fc62b765755ee4ee9ef2672
MD5 605dab4384ad9885488eebbd5114c90f
SHA1 8543e91a07a1a7c344edc21bf6096a65c07b1011
SHA512 adb72e2b83ceabcb0188920464f3724195ec3e7538dc7d406a51f23db495867cacf6b88d1ae854c659b987bf1fac66b75cb18c735eb2350cc4f6b440ac25dbc0
SSDEEP 96:5qGNkqQsFf16+LS58Frh/cInURoDotovLsPDTmBLPlvJHAZv5JCo0eUnmIwGLq4a:AGNKY6+dooDUwcT2b7ov5lqmI6
TLSH
T15DB1A6B16434EC274DE6E958B4C93752AFA82573E845BF98E6DC1A1C00E7398274BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58f930.TMP

Path C:\Users\Admin\AppData\Local\Temp\szx35jlw.n3y\Local State~RFe58f930.TMP
Size 1KB
SHA256 606a8f98d82228e38750c992546beb5333f10b26747d0c8e0c414c4b7b651246
MD5 3f33946740cf721079931c2bd5e78f09
SHA1 ae2a25bf2756c779c8b53a0b015704b004568b57
SHA512 0647f834c75da32e2623c7c909f89738b5e693cf43bb933c7121dcd6913ca04e8f80973210b3561024b8a35bb3d32b2f176dc085a57a49f47bffe55de4ef1c99
TLSH
T1CF3196B0A8206D67DCD1D29D614D37532F382935C0167F9466EC262C02F35DC211BC3E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/952-216-0x00000253C45A0000-0x00000253C4692000-memory.dmp

Download

memory/1780-16-0x0000000005950000-0x0000000005F78000-memory.dmp

Download

memory/1780-27-0x00000000060A0000-0x00000000063F4000-memory.dmp

Download

memory/1780-15-0x00000000030C0000-0x00000000030F6000-memory.dmp

Download

memory/1780-17-0x00000000057F0000-0x0000000005812000-memory.dmp

Download

memory/1780-18-0x0000000005890000-0x00000000058F6000-memory.dmp

Download

memory/1780-19-0x0000000005FF0000-0x0000000006056000-memory.dmp

Download

memory/1780-32-0x0000000006B40000-0x0000000006B5A000-memory.dmp

Download

memory/1780-31-0x0000000007F50000-0x00000000085CA000-memory.dmp

Download

memory/1780-30-0x00000000065F0000-0x000000000663C000-memory.dmp

Download

memory/1780-29-0x00000000065A0000-0x00000000065BE000-memory.dmp

Download

memory/2352-45-0x0000000006FC0000-0x0000000007056000-memory.dmp

Download

memory/2352-61-0x0000000007470000-0x000000000749A000-memory.dmp

Download

memory/2352-43-0x0000000005760000-0x0000000005AB4000-memory.dmp

Download

memory/2352-46-0x0000000005B40000-0x0000000005B62000-memory.dmp

Download

memory/2352-47-0x00000000081D0000-0x0000000008774000-memory.dmp

Download

memory/2352-48-0x0000000007280000-0x00000000072B2000-memory.dmp

Download

memory/2352-49-0x00000000711B0000-0x00000000711FC000-memory.dmp

Download

memory/2352-59-0x00000000072F0000-0x0000000007393000-memory.dmp

Download

memory/2352-58-0x00000000072C0000-0x00000000072DE000-memory.dmp

Download

memory/2352-50-0x0000000071330000-0x0000000071684000-memory.dmp

Download

memory/2352-60-0x00000000073F0000-0x00000000073FA000-memory.dmp

Download

memory/2352-69-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2352-70-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2352-71-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2352-72-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2352-64-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/2352-63-0x0000000007270000-0x0000000007278000-memory.dmp

Download

memory/2352-62-0x00000000074A0000-0x00000000074C4000-memory.dmp

Download

memory/2712-73-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/2712-83-0x0000000006AF0000-0x0000000006B82000-memory.dmp

Download

memory/2712-75-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/2712-74-0x0000000005480000-0x0000000005550000-memory.dmp

Download

memory/2712-76-0x0000000005650000-0x00000000056CC000-memory.dmp

Download

memory/2712-77-0x00000000057D0000-0x00000000058A8000-memory.dmp

Download

memory/2712-78-0x0000000005A20000-0x0000000005A6C000-memory.dmp

Download

memory/2712-80-0x00000000063C0000-0x00000000064B2000-memory.dmp

Download

memory/2712-81-0x00000000064F0000-0x0000000006522000-memory.dmp

Download

memory/2712-84-0x0000000006D80000-0x0000000006DD0000-memory.dmp

Download

memory/2712-489-0x0000000006EB0000-0x0000000006ECE000-memory.dmp

Download

memory/2712-488-0x0000000006F20000-0x0000000006F96000-memory.dmp

Download

memory/2712-487-0x0000000006D10000-0x0000000006D22000-memory.dmp

Download

memory/4912-472-0x00000245A0670000-0x00000245A0762000-memory.dmp

Download

memory/4912-477-0x00000245A0620000-0x00000245A0652000-memory.dmp

Download

memory/5968-2-0x000002E1BD420000-0x000002E1BD430000-memory.dmp

Download

memory/5968-3-0x000002E1BD420000-0x000002E1BD430000-memory.dmp

Download

memory/5968-4-0x000002E1BD360000-0x000002E1BD382000-memory.dmp

Download

memory/5968-14-0x000002E1BF5A0000-0x000002E1BF7BC000-memory.dmp

Download