a9a3a42dac1c522ca696c84f1ef123ecbf80618da9f6e7975c0cf26a09d1c064

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice.pdf.js
Size 725B
Sample260808-mw8fesda97
SHA256 a9a3a42dac1c522ca696c84f1ef123ecbf80618da9f6e7975c0cf26a09d1c064
MD5 1bf14e8af9f1aa3e7777ab5d20bfc37a
SHA1 ae77bf7bff4b23f3992344a730aafdbf30bdf01e
SHA512 074ffa39341d3fff23d15a0289abe14decc618acbc4de94505ae49b4dc81b652f964a2f51751d17bcffde47319e30c0b2de0482f8f612b9dc3359633b55c5d87
TLSH
T1DF0124398204D8C4262A56C6D559CB298FA62D353F02F7677C5DCCE036DE0258D195DB
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 22 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4400	wscript.exe
45	4400	wscript.exe
47	4400	wscript.exe
50	4400	wscript.exe
58	4400	wscript.exe
60	4400	wscript.exe
71	4400	wscript.exe
82	4400	wscript.exe
96	4400	wscript.exe
120	4624	WScript.exe
122	4624	WScript.exe
123	3184	WScript.exe
128	4064	WScript.exe
129	4064	WScript.exe
130	448	CScript.exe
131	448	CScript.exe
137	4624	WScript.exe
138	4624	WScript.exe
139	3184	WScript.exe
140	4064	WScript.exe
141	4064	WScript.exe
142	3184	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	CScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	WScript.exe

Deletes itself 1 IoCs

pid	Process
4400	wscript.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
104	api.gofile.io
77	api.gofile.io
99	api.gofile.io
103	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3356	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306598822097370"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
3764	chrome.exe
3764	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe
Token: SeShutdownPrivilege	4984	chrome.exe
Token: SeCreatePagefilePrivilege	4984	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3756	4984	chrome.exe	90
PID 4984 wrote to memory of 2200	4984	chrome.exe	91
PID 4984 wrote to memory of 2200	4984	chrome.exe	91
PID 4984 wrote to memory of 3356	4984	chrome.exe	92
PID 4984 wrote to memory of 1108	4984	chrome.exe	93
PID 4984 wrote to memory of 1108	4984	chrome.exe	93
PID 4984 wrote to memory of 2344	4984	chrome.exe	94
PID 4984 wrote to memory of 2344	4984	chrome.exe	94
PID 4984 wrote to memory of 1808	4984	chrome.exe	95
PID 4984 wrote to memory of 1808	4984	chrome.exe	95
PID 4984 wrote to memory of 2936	4984	chrome.exe	97
PID 4984 wrote to memory of 2936	4984	chrome.exe	97
PID 4984 wrote to memory of 3420	4984	chrome.exe	98
PID 4984 wrote to memory of 3420	4984	chrome.exe	98
PID 4984 wrote to memory of 2976	4984	chrome.exe	99
PID 4984 wrote to memory of 2348	4984	chrome.exe	109
PID 4984 wrote to memory of 1708	4984	chrome.exe	110
PID 4984 wrote to memory of 3472	4984	chrome.exe	111
PID 4984 wrote to memory of 3816	4984	chrome.exe	112
PID 4984 wrote to memory of 3816	4984	chrome.exe	112
PID 4984 wrote to memory of 4484	4984	chrome.exe	113
PID 4984 wrote to memory of 4484	4984	chrome.exe	113
PID 4984 wrote to memory of 4640	4984	chrome.exe	115
PID 4984 wrote to memory of 4640	4984	chrome.exe	115
PID 4984 wrote to memory of 400	4984	chrome.exe	116
PID 4984 wrote to memory of 4624	4984	chrome.exe	117
PID 4984 wrote to memory of 3184	4984	chrome.exe	118
PID 4984 wrote to memory of 3764	4984	chrome.exe	122

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\invoice.pdf.js
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Deletes itself
PID:4400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff80ce8c728,0x7ff80ce8c734,0x7ff80ce8c740
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,8251810970175396608,13479008464244401761,262144 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,17279989770553580050,7850149498266656577,524288 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1772 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,13433932970755443435,14812231814023180670,524288 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,5615147471723281078,13419836212242612357,2097152 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,16939841192129494887,6934959115996343666,2097152 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,6021141489203072228,13658264979578364156,2097152 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:2
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,10208573968469145651,12161688627762781239,2097152 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,17469746786727562557,12329612607883188031,524288 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,10338133858160618708,2552908788497898015,524288 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,10909301056148500431,4375447895730243221,524288 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,13493899889242997222,18093160347526675956,524288 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4512,i,10999971797055406577,15705977376609367542,2097152 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4864,i,7284984242314356136,16898440364246777343,2097152 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3496,i,1145148505461098197,8983189571486715176,2097152 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3328,i,12087884481479555872,4246610053407189012,524288 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:400
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\invoice.pdf.js"
  2⤵
  - Badlisted process makes network request
  PID:4624
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\invoice.pdf.js"
  2⤵
  - Badlisted process makes network request
  - Checks computer location settings
  PID:3184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1148,i,8648136294123530255,11625330250751009836,262144 --field-trial-handle=1988,i,15804548085158975695,9193742033394224368,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\invoice.pdf.js"
1⤵
- Badlisted process makes network request
PID:4064

C:\Windows\System32\CScript.exe
"C:\Windows\System32\CScript.exe" "C:\Users\Admin\Downloads\invoice.pdf.js"
1⤵
- Badlisted process makes network request
- Checks computer location settings
PID:448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61
Size 355B
SHA256 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
MD5 53ae64e9ee4ba962ee4b516077735710
SHA1 dae8a6fd15a9c447cdb2778f63880db25b0dd198
SHA512 ec31df0d1fbf225bc5a884ee8324aab6e2aa43031bede210b04677ed825966c8ebc0693b06d8f0e55de2cd5919b95a7b25691b6ae1fab893f58756e08836a168
TLSH
T1BFE0C08867AC24200AB19E539550C4936FBE31892970B05C8251CBED30C1A58C28B30F
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

9A825207339CC46F1024FF5AE250DA09

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9A825207339CC46F1024FF5AE250DA09
Size 42KB
SHA256 bd2702f20fb1172ba5b73b20703056c91458b097ca50d901249fe9aae7dcb1c8
MD5 33081daa5eb3c49468af138b013acc8c
SHA1 131d361a62fc481dddfd22276c9421d5e793e2aa
SHA512 4856eaad73046d030b06f8db56338b9983ae81df3e574750bef364412a817d0c7ca5107a9dc3e9ae9881803f46721e97e805feb4c1dad55af3daebe5b5f1f976
SSDEEP 768:o6+tI38JHbz3sl3snOqZft7xdvI/3gxl4/m4JjsBVJp2JmDkeVDx5TX+eS:nkHXpOO17xAwxV4JTJyZVt5r6
TLSH
T1251330A89C37F8616D4B9F614D9ECA9336F516D62D71832E0E307E50DC13A9B9B77080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 9d6cbcd59c7ea049d34ac3a76fed383c94413a67c014a2ade781f33b864f6199
MD5 c6704f5b7e4a3d401b8deaf04bd6f934
SHA1 9312866b065f248fffcdd1c762cf9db756778e33
SHA512 cf768841606c6cc4735f286a84306869b2abce8104285391b7bc74cc8c93877090e6681ddb48a05a7d2b387f7e8536373dc149c309c14e9a4d205d98cb2d99f5
TLSH
T11CC08C2C2AE24A06F2A8437C02C17903AB218541E2418F051AF23A08D99AB262838C6A
MD5 SHA1 SHA512 TLSH

Submit Download

1B1495DD322A24490E2BF2FAABAE1C61

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61
Size 192B
SHA256 da87780147069e75b53841144e9e05c69b52c812eee1bffb5c29e1b2bd54a707
MD5 acb6cdfdd85952ce595cb7b1f05a1527
SHA1 ad27b80caa9153573f6d1d7ac124c38b8b0f008d
SHA512 c9fd4d2fc0684dc6e5f37d6594c383bd7f038faeac1e5f916ddf2889ffe4ba6050cd34839193f46470678c060e78c00ebc183ae5b203b6b28b4828a20f8a45b7
TLSH
T13EC08C1C4A720616F2EA437D02C12D03AB209420F6458F0116B52E08CC11F542C38C28
MD5 SHA1 SHA512 TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 e8a17ea47dccebc95a5f2db27986052b30836b472a1ed0e9ed74bef6d8dc2451
MD5 6d1cf6a9980da6f0bdd2c510f963f088
SHA1 b97e3fa49602558a41d3a9c6291cdbb3e6d80c9c
SHA512 57a7bf7fd65ea05d0d3d9daf8cf718ce3d1649d995514efda7e9edaa16b31404559cf3672c0132131c6849fd784d82865c63ac6f7a2ec579af4e9ade81c56e34
TLSH
T130C08C282BA61606E3E80BBE22D02A83AB15D401F6818F0A263A2A488C14B151C30C1C
MD5 SHA1 SHA512 TLSH

Submit Download

9A825207339CC46F1024FF5AE250DA09

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A825207339CC46F1024FF5AE250DA09
Size 246B
SHA256 9842eda58a14aed0384bdb676336f1e88f3a6b939aa95ea9fde23ded890741ce
MD5 2630b04d64e7bb7a9c9da6984c41d554
SHA1 d17e62e9975561ea41dbe93633152ebdbbeca1c3
SHA512 36e0fd60d9c54cb23e76026efeb4f89441ae4a1c6b5a5483b88ea9a5c92bde24573827fe678b4bd5deac292cd6416c5ccb46049444ba8a1d7f3df18853268aab
TLSH
T1D6D0A9309322123AF93A0A3A98E103822E14200AE5918F4E2FB20A29481AE834C22C0D
MD5 SHA1 SHA512 TLSH

Submit Download

9A825207339CC46F1024FF5AE250DA09

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A825207339CC46F1024FF5AE250DA09
Size 246B
SHA256 f562d31c3a5eaf80164fb51233891203bb9079c2cb343a2fe7ec02330a154a23
MD5 b0d9ae82d97061c5266809a55b921787
SHA1 51d98e0acda93dd225f8cb7e9619f80f0ee14a76
SHA512 6978230a9ce60f4d3a1cede6e7d4415ed1fc2971d24e51cecd3046b51082ad769742b98b2af136269c05554ef5a993114c153e8da04a6c68d108aef3790af879
TLSH
T118D0C72456561136F575463998E143461D54640AE1918F4D1FB61529441AE435C22C1D
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 172ffde9ba9b750dd7bb5ea16c04dc57235c48088fc3511c9b6b52088424d4e2
MD5 e2df148ddc9f564499f785d06754b345
SHA1 d83ca59a6cd015569b6717d028afeccf247a7e57
SHA512 080f5acea5fad750e0e994e5f43422dd38b409a94722ee61722f3a3e4022deaae451906e598a3a1940e19d9f1a19b32faaf7796a4221fb16c8ec7feb2dc72129
TLSH
T128E02B65C971EC2B18FD0B1CA0141741E754135B2A40C9CB7A3D850C8FB5A374595D2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 720B
SHA256 835a6dc224e742dd1c968ec8cd5258a486c03399ad1cdc2459871f933c528c50
MD5 474b23b84915e0642ab9d24e3eda3919
SHA1 ef69739e1f0cc894f34adf2a6d3f3665c06fa5e5
SHA512 5922a200d383f091fa917c425ae2e3f1ee5949a4e321c20427cdd20e621bdb5bdc0af069dd71e6b6e64c462e0bf33d9f4c840752de02a643e56d8dd9e47cffdb
TLSH
T15A01AB32C595EEAED3556B385FC5A5AC3237537C450B0C192306CEB06B29354541432C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 ae314773ebc75d9b9a71869cd0f66fb59d6b263ff64b451c08e4bb4bbcba81c7
MD5 1fce053d227dea7fd8fbc946695f48ef
SHA1 f4a8681ee3459313b43322dc09750fa73858284f
SHA512 a6a340348ce7405bb6527a938550929287f19de280bdcc03eb193e2eb5777809d6332dada9edc88b82bc6004bacad5c4eb7b538c5074793e782f21e36ac5b354
TLSH
T1DC01D534C096DDAEC3042B385FC5A6AC323A173C450B0C192305CEB0272A7086A0171C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ad13527f7cb3628ffbb2146e638cd55898213c959222693e6a08962244333c97
MD5 e003e75c728dade1c1f69f5bdc1b01c6
SHA1 867f3f62fa8ba801ff1673147c56ee5343b478e1
SHA512 98ac1bee8a6ac0d9e5e87a1e0684d08ecb053797cbdbf9b4fabdb9a5cb289298f51e456fd0e7f9f1d047e0c44086cb54f2b7e3e552decc775e4f6ce6fa6177f8
TLSH
T19371ADF3C3E8857DC92156F4AB156E1FCD690928532C3D66C9D4AE1B93E3872E24078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 795682dd079331acf6e8f4919fea461f1befc7c2b8c19e7f499d5fc76eaec1f3
MD5 299ab12a5b1c6610e791bf41e5db44a4
SHA1 8db7ceee4352eab156d1ccf87e017764053d7824
SHA512 3b63651312fd3b939182e67355d8919711382f50407a24b02f9ed4309ecfb388faf930442c399f33955b2413cef778e931a0f708d231095a221fc247a9361854
TLSH
T197618CF3C3E8857D892156F4AB156F1FCD6D0928532C3C66C9D4AE1B53E2872E24078E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9b98b725304e72342f4fcd3aeec71014d3302cdee539a14f41714857ed356d31
MD5 e4e0252c8708ed6fb720e515babe6e2a
SHA1 1727f4b2f0223469949b238df6c7230d6758cc74
SHA512 00f38696d61e69951afc2617887678dc950f5dd0aa7f3eff4a0251b8d04aad59b7ecbe463b3b768ee6968ed02dff30e1bc78e0b95e82e68b22cd09a5f7860455
SSDEEP 192:TRgf9v3HMoUmav70hWPRpMdZlf9+Hsb+WNn+N3bI2RbwkwUad8VyIsnAUgraJ:TRgf9PHl2gCXI8wwM2G0aCe
TLSH
T1F052C62EAA10693B9CDFD229F9517763E7F5213125902E84EBFCCA2C19E75CC2127427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d0746b67298aec2a24c975575dd03272accfb8a2b97751502827978bb5898cb7
MD5 980e0b6788e8b35b410083f53ce8b523
SHA1 8c73ae6c4b552a484693808df553e4592744848c
SHA512 4b9b9b89eb367bc17cf1620f6047f1ca76ba7b2b6d9af6523e486e7205f0a49031c2ae38e9009341b26e77e271fb2bcb18b20ac2a704403eb49e275fc3349ba2
SSDEEP 192:TRgf9r3HMoUMMv70hAPRp2dj9+Hsb+WNn+N0WbwkwUaddVyIsnAUgtaJ:TRgf9bHrYg8X68ww0H0aR8
TLSH
T1FE42D52EAE10693B9CDFD229FD617713D7F5112125942E84EBFC8A2C19D75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 80bce64b913504a051ce93b3ef0eea6ba9d03e0561d9e75bdb82f5288804aa11
MD5 6fb7642921843ef4c55cedb2bee8652f
SHA1 e730f0287a9740a085a38e09c8fdd528184c2f10
SHA512 cf57647917083db36cfeafe270a599ac9d1911742ae1990c6a37812cbe14ba4db6579914ceb085f5aaccbca149bd2ec5b210debdcde0802177c5648ad5f2021c
SSDEEP 192:TRgf9r3HMoUmlv70hAPRp2dZlf9+Hsb+WNn+N3bI21bwkwUad6VyIsnAUgraJ:TRgf9bHlVg8XG8wwM2i0aEe
TLSH
T12352D62EAA10693B9CDFD229F9517723E7F5113125902E84EBFCCA2C19E75CC212742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0a213341b7338d1981e45eceadb21e5d976e80e53c52ce15895d640cdc5abfab
MD5 b411de07e0407903247bcce5ed54bd67
SHA1 92466d20bf00837ca4cafc1d34b2fd69c878f3b1
SHA512 bd3b3163cfd05d2d9c255ba152cd86ca16e3c10f753d702b8090ac00a6c28d1417b5cb44aa250e783c293a69275268f7d40f616bff317c96a15840712fbf220a
SSDEEP 192:TRgfFv3HMoUmav70hWPRpMdZlf9+Hsb+WNn+N3KOekbwkwUad8VyIsnAUgraJ:TRgfFPHl2gCXI8wwneV0aCe
TLSH
T1FB52C62EAA10693B9CDFD229F9517763E7F5213125902E84EBFCCA2C19E75CC2127427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 530db107f40d81f8a38bb4b79cf4467df474fd5555d75a7bf20b2c4c49d58365
MD5 12f3c398e78a54adaa5ec280e6b0b5b5
SHA1 3d6194fde4e2e02b892f054e11bac11edb860c78
SHA512 314b3035aa6fac8f25db0eb146ad44cbcfea6fa632a046a610c603400b3d6b03a07b533774c7e216f873e53f48f857c697fbf48b0bd60b8c5009909cf8b7a15d
SSDEEP 192:TRgyFv3HMoUmav70hWPRpMdZlf9+Hsb+WNn+N3KOekbwkwUad8VyIsnAUgraJ:TRgyFPHl2gCXI8wwneV0aCe
TLSH
T1BD52C62EAA10693B9CDFD229F9517763E7F5213125902E84EBFCCA2C19E75CC2127427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 628d1c8b8f2c67c3373867480c9eca23fef49ec8738426df1e2322ef48996889
MD5 2e2466f04951af8d8c7ef02232a8ad01
SHA1 1e1332305c89b74032c17dd27bf5507c55dd8b0a
SHA512 cc68a278cbec36dd3dfe66cdd9b0673c6ebfd1da719649205cbaf42564b51634152d712437ca393bca1beb486ee460d45033ed8e5fb7e1b3956ad884a4e7ad6d
SSDEEP 192:TRgf9r3HMoUvzv70pAPRp2dj9+Hsb+WNn+N0WbwkwUaddVyIsnAUgtaJ:TRgf9bHKLgUX68ww0H0aR8
TLSH
T15242C52EBE10793B9CDFD229F9617723E7F5112125942E84EAFC8A2C19D75CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b7f79c709da73921b1f56502ae7d9fd076e9f159e1d72020a4d20406d4e0a452
MD5 7db3ff6e19803337ed8330f40d00bae9
SHA1 c0744396ec3de551943cf6de28853eba7214aa75
SHA512 ef095d238abe611787263828b461491c427fcb253f7e0c752b6d0bf56a02a47e385f6645c268aadc25725bdd51737c93754a40171638e1d1e6573b0f50f60795
TLSH
T178B01250C0059581C00206F812429488B62CDF14D60A170253E0ED6288266D18918050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59287d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59287d.TMP
Size 96B
SHA256 6262a09824398b98ce7dc90e1a07a45d8c8c5fe2a3b069dcb8591d72b29754cb
MD5 adfb1c3a8209b4cef2a909cd3ffbac2f
SHA1 8cafef8ddeac0fd462241cb3beb390e95217c031
SHA512 4ba08ac609316d30abfc1659044553e9f9ee0a4c28daa3426588b9df8205f078dcd98aeb0369b8ed1624ac6b66c9955e6a143d045c7b22bc6d8106584f059ab9
TLSH
T135B00275C5026612C08203B12996D6E87171DF29CA43137BA2E25EFAED756E05636560
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f8ef9e3c852c09e2fd0c00046c91351ed2cca08f43e5f6492f1e0276d13958c8
MD5 77143bbb97e0e32599af399ddc0ad01e
SHA1 56581d01e46e9d2f5b0021757145e94ca784be54
SHA512 36f8f964dbd690fffb1271780d06ae5ae85d7089391312741dd3f6f37025481b2d017418ba48335c7d0ce5627ebee8d88d73a3f571599b167016f2ef91f18568
SSDEEP 1536:blLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:nqfd7NtZL8cHQRZEQ6Sps3
TLSH
T194C30237ABC21F339D92CF64B9130FD667B644A99030D301AAAD37FB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 327KB
SHA256 aeec1f3188817596b0a0dfe14592d2b7f2eccfc517284154ea0998abdca99ab8
MD5 70600d9de4ec77366e8de5a72fb70175
SHA1 b399fab523d9c65751d1804e7349fe4fc786abb1
SHA512 81b1f4ab14667061328cf609abce8f6fc8646ce75e32af0d01465c932e9c5ac0e732f7bb699e8faadb42a217bf85766bccf74a3f34fbabe574ccc113c80b09b3
SSDEEP 6144:Z7bIamqMNk/5PJUy6PYab9S6VzuQb4kBwv39N2ENWRECyFyOAqZ/ZLW3ExW:Z7MQSkBxzgQ6d1b437NWiFyBqZ/piQW
TLSH
T1ED642333FF4A5E324C809B3C34274E622AF119D9D07DDAC86ED317EB66866C19C63919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 36f349836334d65bce9af65078fd286a68e68b6b1e197e2c8f53970476022f1d
MD5 a9392741af43041018cc0f053b62199c
SHA1 7c71c3caa2b28e08dc0251bcf6003a6f6d2c6eb6
SHA512 758f05cb14558c87f9a9b330a0cac15c5beee41c8c888fe3d17f00648d19d7b5bc6102ecbbe898140b57e618d2babc303a9c2dae46176c6639f90dfaf9207d29
SSDEEP 6144:sl6VzuQb4kBwv39N2ENWRECyFyOAqZ/ZLW3ExW:sl6d1b437NWiFyBqZ/piQW
TLSH
T1783412B3FF8B5F370C918B38752B0E162BF265ACC0789645BD9633DB64816949C538A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 6c4bba80dfae500b01a8a4ce9b782b6de2f206f3e488d444fd41e7f9ed19759e
MD5 2e2b8a4b9cb37edae08c323c076384bf
SHA1 2e1ed887a1c5d5e029a392dbc70ed4186ce07fb7
SHA512 2e6bfb58e9c69be4fd58cec9b44458c6f959825b5f544a8e8d6f11d09a95a51b75f0f9ee201fc4159da0039777c5bdab89cd887acbbc09a9e04b360f07f14109
SSDEEP 6144:Zl6VzuQb4kBwv39N2ENWRECyFyOAqZ/ZLW3ExW:Zl6d1b437NWiFyBqZ/piQW
TLSH
T1E83412B3FF8B5F370C918B38752B0E163BF265ACC0789645BD9633DB64816989C534A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

out.exe

Path C:\Users\Admin\AppData\Local\Temp\out.exe
Size 2KB
SHA256 ef05c7362020823ef6f02a9447a13360b447cce73b35bd5e14c5f0eb6242e767
MD5 593b557fbf0cc8276bd19585236cf1c2
SHA1 cbe582daa9ce842f84bb0bda42a7fb302d77637d
SHA512 6588f55f64feec4d372d5cd5891ff849abd1c0747ffd0e028e7f8a3cb8430d7257b8c6084d21dbc5c341e19f9fafeef6fa5f376aa732d60384ea122b9f0f625f
TLSH
T1F851F1623858D91C68E19573B8C17C605F92A2372F4DD8C094ABC13A2FD1BEA49027BE
MD5 SHA1 SHA512 TLSH

Submit Download

invoice.pdf.js

Path C:\Users\Admin\Downloads\invoice.pdf.js
Size 725B
SHA256 a9a3a42dac1c522ca696c84f1ef123ecbf80618da9f6e7975c0cf26a09d1c064
MD5 1bf14e8af9f1aa3e7777ab5d20bfc37a
SHA1 ae77bf7bff4b23f3992344a730aafdbf30bdf01e
SHA512 074ffa39341d3fff23d15a0289abe14decc618acbc4de94505ae49b4dc81b652f964a2f51751d17bcffde47319e30c0b2de0482f8f612b9dc3359633b55c5d87
TLSH
T1DF0124398204D8C4262A56C6D559CB298FA62D353F02F7677C5DCCE036DE0258D195DB
MD5 SHA1 SHA512 TLSH

Submit Download