bc16cf19075de6200a10d31a5f8775461c6d98c0d2f41d2b59c1ed28659b62c3

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order July -CEDF9837E748834938393003872143_docx.js
Size 1013KB
Sample260810-p2npbahn8t
SHA256 bc16cf19075de6200a10d31a5f8775461c6d98c0d2f41d2b59c1ed28659b62c3
MD5 e0ede72356471d6358a9e85241062210
SHA1 482cd8cd4d031510877d0b78230649cac0043e6d
SHA512 29d4e58957d4bd24001f6605fadb58efce565b4b14c52f7116b2e97a89794e0f3bf62629f4f9da0b3e4bd51644605f7eec8a30e0cd87b8ad013f8156df0db6f8
SSDEEP 12288:Jkg55il92UK812V0Rx8goUW1imeeuTj5FRGB9Sux+/t5TKp75iLk73INHDCRMSl2:U
TLSH
T112250EDB9F75D68906287D6EC83CBE9D299BCD9000D0AA5BFDB88147F70E64901C4B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	2016	powershell.exe
8	2016	powershell.exe
9	2016	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	2016	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	wscript.exe

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
3140	forfiles.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Environment\UserInitMprLogonScript = "\"C:\\Windows\\System32\\wscript.exe\" \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\v1864\\v2822.js\""	wscript.exe

Accesses Microsoft Outlook profiles 1 TTPs 39 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	powershell.exe
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4472	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3096	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
3724	chrome.exe
3724	chrome.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeDebugPrivilege	3724	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3724	chrome.exe
3724	chrome.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3140	1852	wscript.exe	86
PID 3140 wrote to memory of 4472	3140	forfiles.exe	88
PID 4472 wrote to memory of 3932	4472	cmd.exe	89
PID 4472 wrote to memory of 2016	4472	cmd.exe	90
PID 2016 wrote to memory of 3724	2016	powershell.exe	92
PID 3724 wrote to memory of 2316	3724	chrome.exe	93
PID 3724 wrote to memory of 4288	3724	chrome.exe	94
PID 3724 wrote to memory of 3096	3724	chrome.exe	95
PID 3724 wrote to memory of 2132	3724	chrome.exe	96
PID 3724 wrote to memory of 3684	3724	chrome.exe	97
PID 3724 wrote to memory of 4564	3724	chrome.exe	98
PID 3724 wrote to memory of 2504	3724	chrome.exe	99
PID 3724 wrote to memory of 916	3724	chrome.exe	100
PID 3724 wrote to memory of 1508	3724	chrome.exe	101
PID 3724 wrote to memory of 4100	3724	chrome.exe	102
PID 3724 wrote to memory of 4252	3724	chrome.exe	103
PID 2016 wrote to memory of 3724	2016	powershell.exe	92
PID 2016 wrote to memory of 3724	2016	powershell.exe	92

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Order July -CEDF9837E748834938393003872143_docx.js"
1⤵
- Checks computer location settings
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\System32\forfiles.exe
  "C:\Windows\System32\forfiles.exe" /p C:\Windows\System32 /m winver.exe /c "cmd /v:on /d /c echo !ACWSr3bBMEtSc!|powershell.exe -W h -NOP -nONi -"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\System32\cmd.exe
    /v:on /d /c echo !ACWSr3bBMEtSc!|powershell.exe -W h -NOP -nONi -
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo $CBo=[powershell]::Create();[void]$CBo.AddScript([System.Environment]::GetEnvironmentVariable('gSKE4AfAq0','Process'));$CBo.Invoke()"
      4⤵
      PID:3932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -W h -NOP -nONi -
      4⤵
      Badlisted process makes network request
      Downloads MZ/PE file
      Accesses Microsoft Outlook profiles
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:2016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe"
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3724
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1371c728,0x7ffb1371c734,0x7ffb1371c740
        6⤵
        
        PID:2316
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1660,i,4059455696875313088,9786950409159485503,262144 --field-trial-handle=1756,i,3439159930039332529,5174698241844437818,262144 --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:2
        6⤵
        
        PID:4288
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe" --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,443360314528671444,5402164543043821362,524288 --field-trial-handle=1756,i,3439159930039332529,5174698241844437818,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:3096
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe" --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,2084666614608713389,11126562880974533290,524288 --field-trial-handle=1756,i,3439159930039332529,5174698241844437818,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:8
        6⤵
        
        PID:2132
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2912,i,8308995204067338226,8054977799484605841,2097152 --field-trial-handle=1756,i,3439159930039332529,5174698241844437818,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
        6⤵
        
        PID:3684
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2924,i,13176681602882519617,1554894953141724169,2097152 --field-trial-handle=1756,i,3439159930039332529,5174698241844437818,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
        6⤵
        
        PID:4564
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3292,i,15645804022409986061,2806587401673356692,2097152 --field-trial-handle=1756,i,3439159930039332529,5174698241844437818,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
        6⤵
        
        PID:2504
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3316,i,15153649600996533281,13227759857903988708,2097152 --field-trial-handle=1756,i,3439159930039332529,5174698241844437818,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:2
        6⤵
        
        PID:916
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3780,i,1495323652267937404,17843962960870914652,2097152 --field-trial-handle=1756,i,3439159930039332529,5174698241844437818,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:2
        6⤵
        
        PID:1508
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4192,i,6360728253136013110,15568515677934139370,2097152 --field-trial-handle=1756,i,3439159930039332529,5174698241844437818,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
        6⤵
        
        PID:4100
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe" --force-high-res-timeticks=disabled --metrics-shmem-handle=4212,i,18084660460925285488,4488274694537378,524288 --field-trial-handle=1756,i,3439159930039332529,5174698241844437818,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
        6⤵
        
        PID:4252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Crashpad\settings.dat
Size 40B
SHA256 1adfeae770f38252e2e60bd2229a22d2d2af765171780e8352729767d364fd99
MD5 d8b43f43028f1dcb55bede0deab506b0
SHA1 161a7de222c6fda7019cc4d6eec80a195322e7ef
SHA512 25a1fac7012ffead766a0675177170a39c52ca8544126c36e31b9d89d9b7475617a66f84dcb321e5a503c7eee47bd98fe400b44430198e0beda4979ff18cd251
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 702e31a8ff712fd7c1ec0274d14fc65d965aed1678f61975e4f783c8e4ce4be0
MD5 581e1a2d7208cd61e806e80f2072103e
SHA1 5c0c5faa02d2c794114d3961580d2f155a44e940
SHA512 5674940b476c3eb73b09ac878540a0d0be8cb37e8b1e160f6a6bc1b31530f028c103ff0d5445294f90692bbb2b4461827c563fe0064b7f0f9920b2f6ce2c29d9
SSDEEP 6:/FoEXEVldll9ikNevj5L/9MwYslUGoSJASN98XyK4kEXiWqktkllxvCxx:d7XUHNEMwLlUGoUdeXyZkEiWxm/Z
TLSH
T1A713A72DA5D06F13C98E1CBC5C4B6B7483B24C84C946C207CE323822BD1431174CE135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 683380f9cd20c624b11eb4a94ecf17667d623f6661c179d8ae4d93014ed692d4
MD5 e0acf56555e28e79e24b217ae75dbb4e
SHA1 cbec0ee66fa4cda5f96320f8189415acb9ace38d
SHA512 1266c4bca9dc5d7cd760d04e0a5cb685a59ddd27904b34db3f4c4f334295410875f509286975048d5489e91cee25cab07dfb6f4f75c2165d3ea19702590ad47b
SSDEEP 6:/M/LlE3Uv3xk+ZzuSezuSeGLIiv8i/yyvxknzuSezuSeGLIivB/:U/Phk+Upqp9iki6mxkqpqp9i
TLSH
T19C445EF73C40920BC765E7F60111637CAC7B921D6CEE8EDFD52809730988FA768A48A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1d6e744f13a24b5cdfda236bceda21b3bbbf5c602dd31fb3b51b6fa79293fe6
MD5 779c7db2740e5a264b8c9cd9f9a61cf7
SHA1 ba06d543ce525ccfdb8b67d9313729db1c556bf9
SHA512 d1c3f95ffb4bdc8c34e07d448af9ea860722a33e3204227040fa0e16b7a783e98784e466b2785d6c3dbb0456ca4662c5ae08a576c05c512e388902e79e8a8302
SSDEEP 48:nXflyYYusWP3zlblQF4/vyM1Xg4X6UooMmXJ2dVEPLVBKWwtl:n9LYus8hblQF4nyug46RojeVOLHKWol
TLSH
T1FD44B6F71D09DAC6DA28CFB85C41923C8E3242172DAAFD7AF53844A10551AE332285A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 38f4ecccb5f8ef93838eb6ceb5db74b3ee803db4c3a0d6cfcf85acabdf4b6fb8
MD5 5642a87ce6757be600b8fbe52bb0e3f4
SHA1 97357fc52ca4d557516c3aec3c76bd4368939712
SHA512 c0f3ee65a2d6b5f898f18c4f1ee70f93061806615466ef2a9fc1982e32a4f35c5dacac11e04882fca82f212d4aee69a0ccd8813908d4950742e3a92c2b61625f
SSDEEP 768:AUfDPLSgcRUv+Gq4UUfDPLSgcRUv+3q4xUfDPLSgcRUv+eq4MfDPLSgcRUv+Eq4:5qfqhqRqa7zd/R1B
TLSH
T1C4165DA24F247982E685EFB0BBCDED1C3C706295EC935882E52291794BE1FC45B8416E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 c387df7e4ef61d0641df883038e6bcac78ea82faedbc5d0a703404e395f3e87e
MD5 0ad8187f749c55a382bb7c59669ed513
SHA1 91dab8367eb7ad1b442fd33a2cf468b0843e705b
SHA512 7b6cef91c67079920d00d7e40c330cf5a0f487b15b8c16a2f46c78baef98bd63d64d94c23c015d8e0c5f9005fb572871da8c4a41908c47775a77370f1ae832f9
SSDEEP 768:9T6EiZD01IKytKtMC98vfk0uC1zYGIPvrFXLJTBOEaN9oCul0Mtxv:4LZD5Kuk0fzYGAjNLmNq/9xv
TLSH
T10703013C1C57289517E6E7C906E6EF4EDE87F8C44A2D06D31588AEAD609C24118763BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Cache\Cache_Data\f_000002
Size 71KB
SHA256 c5cfcfe10aa1686b7c43575ee31c8972ae2d0d05cb8d71f87892455e4a1eec9b
MD5 075110f361981db0c8637c9889ee8a18
SHA1 05e2bd96edb12c09b9bfae0a8ff1e19abd10bb27
SHA512 3af2fdc73bcf4078b3e0e945bd74c3ede09008a34033698ce297de51309351d34bbbe9740ef76eb6dfdf585496d6c51faa990d51a5fa9f2f60ef60a276eff8bf
SSDEEP 1536:4W7X6PCIvB5uKamkCf8G1WzU2eZcypBE4QfT5BRsxeGvjqtS:4W7qac+jGR5ZFfQjRFAjL
TLSH
T16363023B02F8D791488425E352ED13A657F783ABE4FF744DE26801D211683FC6672DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Cache\Cache_Data\index
Size 256KB
SHA256 dc9c6c44dd8328c2d779209887a7163e60516b0fed5b1f8cda4c3f666fab5f68
MD5 7bc64d68658150e09c7155b39ab38795
SHA1 61194f26d852ed46aae50ba84344fb0782bae0f7
SHA512 0c4c922febdd5fdef3571f47ff6c86a5c4289384ae53cc68130c313a412d38cfe582708c42bcc7238d0fd8559d80ed6b5112b3fa9cafa43f72c84537c5bf092d
SSDEEP 3:LsLllFlklNllklkXl+SSS/ollLll/njNtlmNtl3Nl/lgl5llll/9lXl+ll//:LsRa3lPfS/dkNHUlllUlt
TLSH
T14F44025E93455E55C2C406FD84575754B375C809DA4F8743570526542CD17501D4F155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 391ef1903107ec4ed0b22e46ab803bbe5571eeb882d88e13902992880dc7df68
MD5 6be2b1e2925a64949c72911cc3a3366a
SHA1 b729f69e3d6a7bfcfd8bcb0a500e0e1936213163
SHA512 f82bcd0a5bbe0ee3e9152986c718525732b9340d029191ca157cd67e0efcacfd43e8449c58e386fe6963ccf83ed1568b34f6f519c7db8bd8ba1bd6e6a7883223
TLSH
T1DAE02B91828C0F0ED32DA6F7CDAA03084A0B42C42ABE3603A8C0C6C133125241248122
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 d3fc8035e5e1209324b69da5a4ac0e733585670f8fea5ada6759cb8acb1a09d3
MD5 4caeb6a36411e17cf8613019750b9ded
SHA1 660ad28ab48e273e31d1bc2d0e3c038d496cce4d
SHA512 f4cc0eb8f5603a4d379274fad97ae3f1a802022fe552f73b28ea86790cfdea6b754bd2f1fd7b4ab0cede8a52e04ed844bfcbb5755181eb96e65eafe4e3a801c2
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\DawnGraphiteCache\index
Size 256KB
SHA256 47e91f7e99a88b4e061a0e9936eb813cc1b00f5fa3187d737762ff76765f228b
MD5 4c7bf04d66265725abf838dda233f17b
SHA1 f1806b571c3c2bde7bab84e729284c430539c0ee
SHA512 0b68cf9f2d93d84c0bb15988ab768b2bb322e26d76d6bd640738f1b7e07018f33933264dd8d6cc65e9613c315f7758c63867cb624a7bdb98e488a0da4357bcf6
SSDEEP 3:LstlNllklkXlx:LsX3lPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\DawnWebGPUCache\index
Size 256KB
SHA256 2c8626d6fa2c8985204a8304aff7700d437d03e635392eaa54b2675a7cce88e5
MD5 51713bbcb3223025410416c58c602ab3
SHA1 ce3c0b7f906791c8ffa287df19364d4c919dff7b
SHA512 dfc16c995b55a85422dab5d56a053d8185a59ff73fd30f35fdce9f86c5d80811290549e65febec20e1e1d1ed86939c7abc7382cdb1f03f0e372f319895c05fa6
SSDEEP 3:LstlNllklkXll3M/t:LsX3lPl8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\GPUCache\index
Size 256KB
SHA256 01af5da36b888e24770be357891b81573635aeb47342def360b3d20535ff5200
MD5 e04f532aa728eed75aadb6b2ef02dda7
SHA1 2019fd1fbc0f86e65831e8bc08d6177c776d9072
SHA512 bf24088c67a8f53c25b5fbcd707aab3d5f14981fde75c29ab38d4544483a6dc4303fba1a5e6974ca1aeaa23c0fa8b046cad6a80feacc79d4a215e2c18dc5194a
SSDEEP 3:LstlNllklkXlc8t:LsX3lPc8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Service Worker\Database\LOG
Size 281B
SHA256 3863f972eaea34960d98cda15dfa5a0ab3e6a4f76cbbf57935b531ba23407054
MD5 9bd0449ff24df733e8bdc25f41006414
SHA1 c7ed6456d42caabcb2c8a1777603b8ae70fc6392
SHA512 adb73fd56fd063949c430028fa03d1596b3ce25e131b3eae5394b8a1f7ba2fc67fa1a31818ebea292a5f722dad13ddd815e40e5af8499a235a51f3c53070b8af
TLSH
T10DD02B0481C5C6B9954E426F0D2353089B5CF80DF6CC3E285FA7D50410C7A0CE5D2781
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f3ba1ccc13cd852a84a28418e673363c0742abf9d6a6984361a62d3c471bae2c
MD5 1bdc2a9a74ae08234bb7469e3ee749a5
SHA1 2a19083ecb5965253dbe9bd22c0106358b66894e
SHA512 10be1fb07cfc1d9e0110f26ef6af3da0ba630243622152e198248d6d76d247b3f86181b4320e135435fe66ed3e6420e4988a9aef232deb80e311da1cb04423de
TLSH
T104A002110380C134C14046B1280183991271BD2691010613BBE0074B8CA40644952184
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Session Storage\000003.log
Size 61B
SHA256 5c3a5b578ab9fe853ead7040bc161929ea4f6902073ba2b8bb84487622b98923
MD5 9f7eadc15e13d0608b4e4d590499ae2e
SHA1 afb27f5c20b117031328e12dd3111a7681ff8db5
SHA512 88455784c705f565c70fa0a549c54e2492976e14643e9dd0a8e58c560d003914313df483f096bd33ec718aeec7667b8de063a73627aa3436ba6e7e562e565b3f
TLSH
T1C4A0041C1341D037FC1DC730054533303731DCDD1F111543444D15D00717F751401441
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Session Storage\LOG
Size 265B
SHA256 f7f812abce5ebab212d0911cc0701ea0b856c8bbc6589c92e3543ebbab97dc80
MD5 46a27fba5124bf8a819ae471647395d3
SHA1 bb3da6f4410172978143b059b6197f1f404a68ca
SHA512 b024243b9945230a9dbacd7b344188cf6f2ac98bb751b62c4d33fc62a938715fae2eb3cc445d06d32452194af0e11250269df8a705115024e6c2860eaa8fcc53
TLSH
T10DD02B1841D6C7754644C57F2133631CDBA4F509F7DC3F284F13D00431066095682391
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 beac456cedfba908a3e7d9a5b5dad5cf8647ee77b8abe0aba674758d7764bd63
MD5 5d0bd2d4613f08f339cbca2589e9186f
SHA1 fde903131c7f6239097563f4042fba04c624c5f8
SHA512 5de801af44c31ab3439913994c2b98ca37248beb6487738f06fbcd34cc2beb5466608c719712fd1df8df95fb70df79534fb1811303b32597fa4ac2c3549aa332
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\Shared Dictionary\db
Size 44KB
SHA256 b08af7745c49533422c5afb2e683b61ab1b025a2ef13f892321a2cd1383fba79
MD5 ad4b0d21f32cbccefd98c28e33a59a6e
SHA1 1850a90ed7ec61efca181fcc35927a2888549e6e
SHA512 0bc8a37f441ce5cbb0fe4ea3f766f741cc6424ac4274ffa42fcf507c8fc7154115375bc669449da02d8b57a19227483814357367cc8611cbecdf247d7b65706b
SSDEEP 24:TL6BgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg8TPq81fBG:T1OIy4m1b3fbUdeqSB
TLSH
T16B13BB0F1E187551D1BD0236E9E64E6B2E7E204C9B8369D125F01AF24DE211C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedStorage

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\SharedStorage
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\shared_proto_db\LOG
Size 265B
SHA256 08c098490576d2f0257c5152b285139d7ec94c08cd43f188eb9b43a70b6fabf8
MD5 0ca271b44f6bbdbdda59a959aba29e3b
SHA1 10d42cbfb64dd983908c771f40da7eaf40adcf7f
SHA512 cb3bc91a4d43e2f91112fc753f4761b5be75b49367551f1127b283340ab16d9acc0e89f043c5816de8895af5681288005b7c376582eb8b9d992fddacdf916422
TLSH
T149D02B10D5D5C79E955941AF14239749C70CA80DFED83A5C4F13D008600320DDA46342
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\Default\shared_proto_db\metadata\LOG
Size 283B
SHA256 e92d102fc7f49297c98104a6496478b79bb719b92257e4be728495d2df76a30f
MD5 0b23128c137f6f9618c11676a06c9c0c
SHA1 06047da4e4be5f01edc2d542c81aff4af309d0ed
SHA512 4599ea9378f9c374106c7bc593d4e1b4a2d539dc64c9060b16be30da364f4e6858a7cd1bc64b0178ed1c7849bc460a1181c22d4f6bde78508126e3fad1ac976f
TLSH
T146D02B00F8D9C7EF894541BF1423A789971DFC0DFE887F1C5F4AC808500220EA947342
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\0za53qic.ewe\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_0zn52xog.2bj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0zn52xog.2bj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2016-17-0x000001FA2AD20000-0x000001FA2AE12000-memory.dmp

Download

memory/2016-14-0x000001FA2AB70000-0x000001FA2ABEA000-memory.dmp

Download

memory/2016-218-0x000001FA2A2F0000-0x000001FA2A3F2000-memory.dmp

Download

memory/2016-2-0x000001FA0F840000-0x000001FA0F850000-memory.dmp

Download

memory/2016-19-0x000001FA0F840000-0x000001FA0F850000-memory.dmp

Download

memory/2016-18-0x000001FA2AE10000-0x000001FA2AE42000-memory.dmp

Download

memory/2016-21-0x000001FA2AED0000-0x000001FA2AF20000-memory.dmp

Download

memory/2016-16-0x000001FA2ACD0000-0x000001FA2AD1C000-memory.dmp

Download

memory/2016-15-0x000001FA2ABF0000-0x000001FA2ACC8000-memory.dmp

Download

memory/2016-138-0x000001FA2A2F0000-0x000001FA2A3F2000-memory.dmp

Download

memory/2016-13-0x000001FA2A960000-0x000001FA2AA30000-memory.dmp

Download

memory/2016-12-0x000001FA2A250000-0x000001FA2A262000-memory.dmp

Download

memory/2016-11-0x000001FA2A2A0000-0x000001FA2A2EE000-memory.dmp

Download

memory/2016-20-0x000001FA0F840000-0x000001FA0F850000-memory.dmp

Download

memory/2016-3-0x000001FA29FE0000-0x000001FA2A002000-memory.dmp

Download

memory/2016-1-0x000001FA0F840000-0x000001FA0F850000-memory.dmp

Download

memory/2016-215-0x000001FA2AEA0000-0x000001FA2AEB2000-memory.dmp

Download

memory/3724-159-0x000002385A8C0000-0x000002385A9B2000-memory.dmp

Download