5ab746c4d9cdf67824e417c5178b0c7c76236422a4387bd5260004e749ca3b68

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WHT2607011 177CASASS107987 MEDUY6440091.js
Size 2.6MB
Sample260813-nptjcsxvbw
SHA256 5ab746c4d9cdf67824e417c5178b0c7c76236422a4387bd5260004e749ca3b68
MD5 d0fcf46104dc14d0cb6cbdf7e8547181
SHA1 e8d8e8c0a9993e7da8785e1a47dfe4ff92d056f4
SHA512 de5923a7685eceabf2cf3890dd8e4e9fb19a5c6ba47b31abd7d25bbd754dc843bac436782d948bd6bf7b6588c293916aa9b67e1f7363c22da627079903f9b47e
SSDEEP 49152:sVYfId+z0dVdnr2MVNSSda7NIBi9KbQX1Fv0zoU:C
TLSH
T1EED5F9B09DAD3D93B6D1CC7EF623A0727E627E60D56365A250A9231701EF4F0C893927
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5892 created 6036	5892	powershell.exe	80

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1224	powershell.exe
6100	powershell.exe
5892	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4672	cmd.exe
5392	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5680	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1224	powershell.exe
1224	powershell.exe
6100	powershell.exe
6100	powershell.exe
6100	powershell.exe
5892	powershell.exe
5892	powershell.exe
5892	powershell.exe
5892	powershell.exe
5892	powershell.exe
5892	powershell.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4176	chrome.exe
4176	chrome.exe
4176	chrome.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
4032	prevhost.exe
5680	chrome.exe
5680	chrome.exe
5680	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeDebugPrivilege	5892	powershell.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeDebugPrivilege	2724	whoami.exe
Token: SeIncreaseQuotaPrivilege	5892	powershell.exe
Token: SeSecurityPrivilege	5892	powershell.exe
Token: SeTakeOwnershipPrivilege	5892	powershell.exe
Token: SeLoadDriverPrivilege	5892	powershell.exe
Token: SeSystemProfilePrivilege	5892	powershell.exe
Token: SeSystemtimePrivilege	5892	powershell.exe
Token: SeProfSingleProcessPrivilege	5892	powershell.exe
Token: SeIncBasePriorityPrivilege	5892	powershell.exe
Token: SeCreatePagefilePrivilege	5892	powershell.exe
Token: SeBackupPrivilege	5892	powershell.exe
Token: SeRestorePrivilege	5892	powershell.exe
Token: SeShutdownPrivilege	5892	powershell.exe
Token: SeDebugPrivilege	5892	powershell.exe
Token: SeSystemEnvironmentPrivilege	5892	powershell.exe
Token: SeRemoteShutdownPrivilege	5892	powershell.exe
Token: SeUndockPrivilege	5892	powershell.exe
Token: SeManageVolumePrivilege	5892	powershell.exe
Token: 33	5892	powershell.exe
Token: 34	5892	powershell.exe
Token: 35	5892	powershell.exe
Token: 36	5892	powershell.exe
Token: SeIncreaseQuotaPrivilege	5892	powershell.exe
Token: SeSecurityPrivilege	5892	powershell.exe
Token: SeTakeOwnershipPrivilege	5892	powershell.exe
Token: SeLoadDriverPrivilege	5892	powershell.exe
Token: SeSystemProfilePrivilege	5892	powershell.exe
Token: SeSystemtimePrivilege	5892	powershell.exe
Token: SeProfSingleProcessPrivilege	5892	powershell.exe
Token: SeIncBasePriorityPrivilege	5892	powershell.exe
Token: SeCreatePagefilePrivilege	5892	powershell.exe
Token: SeBackupPrivilege	5892	powershell.exe
Token: SeRestorePrivilege	5892	powershell.exe
Token: SeShutdownPrivilege	5892	powershell.exe
Token: SeDebugPrivilege	5892	powershell.exe
Token: SeSystemEnvironmentPrivilege	5892	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4176	chrome.exe
4176	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4672	3516	wscript.exe	88
PID 4672 wrote to memory of 1224	4672	cmd.exe	90
PID 1224 wrote to memory of 5392	1224	powershell.exe	91
PID 5392 wrote to memory of 6100	5392	cmd.exe	93
PID 5392 wrote to memory of 2276	5392	cmd.exe	94
PID 5392 wrote to memory of 4864	5392	cmd.exe	95
PID 5392 wrote to memory of 5532	5392	cmd.exe	96
PID 5392 wrote to memory of 4284	5392	cmd.exe	97
PID 5392 wrote to memory of 5892	5392	cmd.exe	98
PID 5892 wrote to memory of 2724	5892	powershell.exe	99
PID 5892 wrote to memory of 4032	5892	powershell.exe	101
PID 5892 wrote to memory of 4032	5892	powershell.exe	101
PID 5892 wrote to memory of 4032	5892	powershell.exe	101
PID 4032 wrote to memory of 4176	4032	prevhost.exe	102
PID 4176 wrote to memory of 5916	4176	chrome.exe	103
PID 4176 wrote to memory of 5900	4176	chrome.exe	104
PID 4176 wrote to memory of 5680	4176	chrome.exe	105
PID 4176 wrote to memory of 1992	4176	chrome.exe	106
PID 4176 wrote to memory of 6068	4176	chrome.exe	107
PID 4176 wrote to memory of 2572	4176	chrome.exe	108
PID 4176 wrote to memory of 5656	4176	chrome.exe	109
PID 4176 wrote to memory of 856	4176	chrome.exe	110
PID 4176 wrote to memory of 2676	4176	chrome.exe	111
PID 4176 wrote to memory of 2748	4176	chrome.exe	112
PID 4176 wrote to memory of 4396	4176	chrome.exe	113
PID 4032 wrote to memory of 5680	4032	prevhost.exe	105
PID 4032 wrote to memory of 5680	4032	prevhost.exe	105

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2276	attrib.exe
4284	attrib.exe
5532	attrib.exe
4864	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:6036
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\WHT2607011 177CASASS107987 MEDUY6440091.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Music.UI.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:KGJFNCRGBM))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1224
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Music.UI.cmd" XOQZXQH"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5392
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:QYZQEREQFO))"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6100
      - C:\Windows\system32\attrib.exe
        
        attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\usb_enum\usb_enum.cfg"
        6⤵
        Views/modifies file attributes
        
        PID:2276
      - C:\Windows\system32\attrib.exe
        
        attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\usb_enum\usb_enum_VMJBFFVT.cmd"
        6⤵
        Views/modifies file attributes
        
        PID:4864
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\usb_enum\usb_enum.cfg"
        6⤵
        Views/modifies file attributes
        
        PID:5532
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\usb_enum\usb_enum_VMJBFFVT.cmd"
        6⤵
        Views/modifies file attributes
        
        PID:4284
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:KLIUNJ))"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5892
        
        C:\Windows\system32\whoami.exe
        
        "C:\Windows\system32\whoami.exe" /groups
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
- C:\Windows\system32\prevhost.exe
  "C:\Windows\system32\prevhost.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc1871c728,0x7ffc1871c734,0x7ffc1871c740
      4⤵
      PID:5916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,8203913085693255434,7795034330671272767,262144 --field-trial-handle=2012,i,4443618217962203681,7829000184694548309,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
      4⤵
      PID:5900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1816,i,17021248802672544618,2158692659479868576,524288 --field-trial-handle=2012,i,4443618217962203681,7829000184694548309,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
      4⤵
      System Time Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp" --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,6014458538027752229,7094936619364842269,524288 --field-trial-handle=2012,i,4443618217962203681,7829000184694548309,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:13
      4⤵
      PID:1992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2856,i,14830598817918166561,8273476944131656475,2097152 --field-trial-handle=2012,i,4443618217962203681,7829000184694548309,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2868,i,2976648868946652187,1851470778875676932,2097152 --field-trial-handle=2012,i,4443618217962203681,7829000184694548309,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:1
      4⤵
      PID:2572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3364,i,14305053985403802072,2121356434532763821,2097152 --field-trial-handle=2012,i,4443618217962203681,7829000184694548309,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3384,i,16922456785840514462,14528270003744922737,2097152 --field-trial-handle=2012,i,4443618217962203681,7829000184694548309,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:9
      4⤵
      PID:856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3940,i,11893810572981293026,1757556796704863169,2097152 --field-trial-handle=2012,i,4443618217962203681,7829000184694548309,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:9
      4⤵
      PID:2676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4304,i,8937576316640565157,7968574579022246740,2097152 --field-trial-handle=2012,i,4443618217962203681,7829000184694548309,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
      4⤵
      PID:2748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp" --force-high-res-timeticks=disabled --metrics-shmem-handle=4288,i,10123212637003003639,3569051522354981687,524288 --field-trial-handle=2012,i,4443618217962203681,7829000184694548309,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
      4⤵
      PID:4396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Music.UI.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\Music.UI.cmd
Size 1.3MB
SHA256 ec43434631a3350f51d399a11c005fa7a12d2bae8ca58e65d289d072bc55f8fb
MD5 aeb4d8a9c74e027e32f1f678c8960ae9
SHA1 1427d2a85d1ee7629da783b0f8e3304e06883dc9
SHA512 70d68677daca07dd54ce5c94910ce199b9e847ca133dbb26c78780f2e7327baf4d9f94884f96569a06e5df2860f1e149b9285d9515cb97fa627f5a2dd7d2ab1e
SSDEEP 24576:t0XTMbXQW3P5MBAaGjUWU4e7QokzYimCbwbt9i8EnRd2CV4BbIrw/:soNkXkE9bK8fo45Ii
TLSH
T16A55227159162CB62AFF886B910BA9147B6DEFC7173BD5CD380832731C5B653CB2A422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fa606866043197f75de4426de51670f2291a94433384efe403e0026db4429a69
MD5 18a431e2bf1c7189baadfb9c408f62eb
SHA1 fc8e72f7c9ebcd482cc8d2c04b8bc8f606123c2d
SHA512 92552b76e6c27c94d721cd140e671db8bd23fbfc1085e099225c52eb8279a4ba90325ec9406f077c13a187e296745d880aec5c42e4b894b7dddf6d64aced536a
TLSH
T175218933B3DC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544B42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6a0f6c545beaac7d95f6d759165f12ab79330c5a4214be90d4c3bd70a7466e0e
MD5 71c335411158d29b1ecf4aff8f563b0c
SHA1 5415d69ca139a19eb3375e2dfad2e6474582e9c0
SHA512 a339fb321041dc8598843f625ec72700310b8945709719268c4c0dc3a81246ae5b2f0a0df6dfba157a797e955996b6cfc44afcc3f540c9aa526b36fcfbbd2822
TLSH
T144215733F3CC86A4DC9A413650CEAC1136B787DB409EDEABAB84D559B42F689CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zi5ttytj.zkl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zi5ttytj.zkl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Crashpad\settings.dat
Size 40B
SHA256 add34ebbf8ecf58de632c68d6b84eda68c4124cfc14a28750fc8e22fbc3f432a
MD5 4b94ed651acb5e13d0e8f84394faa701
SHA1 53a2f440f3e18cb2bc4e1d50552a30b43370c37a
SHA512 98283db5eac0bb4a91f706199a9040a74f66ced18d4b1601a38901dd70926ded2f6bde2d5fc224949498c2c8acced14f9bdb6d9afddb333abd37b388b9a066ad
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 cfe4075a8aedc2281d80bfc2935772b5e2b81e26f8ee128f2abc104de8e564c1
MD5 9bbcd7011a5afa46c2ac93fba7ce02c5
SHA1 927a98740592d8de53103204dceff0e82e15b50c
SHA512 cd01fccbff7ed713338f51d9f25dd294333847cbef6e4e92f572e8c4dc3146d6ab46653ea2d3dbe766e796c45ef8920aeab86099cef07e16755d2848e05378d1
SSDEEP 6:/FoEXEH+8kNo2pO7HwxnSgbK4Wf7mi+kW74kEXNSJkskllSJRaf/gRl:d7X2+1No2c7HwxkfizrkkENX/SJC/M
TLSH
T1FE13A97C97845E13C2E818BDA81F6FF1A3F0DB18CAB2C3032F62F026345833224A9549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e1c5d7867276666267705746b9b3ba8ad79c76514542f5e8cc7b422baab625d2
MD5 f2e199ceda2d1f8ce35b84eff49615e8
SHA1 171b0eaa5ddc7fc6cdf26f7c59c26142f5ace3df
SHA512 3a72f5ae5079c53353b025ad88dd04c9698481bd34926c3115ee10979dd76e25d5dc9b76e29282f3bd1835b3c52534659ee163c406ff28ce3afbbfb3f1ed643e
SSDEEP 48:GJXYplsP3zlblQ9niM1XgOUXKUwuMmXJ2dVEPLVBKWwtl:wILKhblQ5iugOUKtujeVOLHKWol
TLSH
T17C44A8F71D05CEC6DA19CBB81C41622C8E3252162CAFFDB9F52984E21591AF7322C5A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 b4c2edf24b5a341835e4f3073cb3806d179e091d28e69acd1a0f0120001863a7
MD5 808d546bf7f5db049d39125efaf67faf
SHA1 6191c06219f12bbe34ff07f5746fa67ac63145bb
SHA512 60b12b8b9aedf3b4f3e0fec13da7ef74ec71115bdb63a38d60f03251d73cc185383fa3b3f3bfc75b57896fd67d258beba70873898eee501e6714643379f82421
SSDEEP 768:FfDPLSgcRUv+pBq4UUfDPLSgcRUv+pnq42UfDPLSgcRUv+pGq47zUfDPLSgcRUvO:yqtq+q2qT7zd/RHv
TLSH
T122165EE64F247982D685EFB0BBCDED1C3C703395EC929892F52291794AE0FC4578416E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 6c5631b35818716f1ff0405f778aaf52d8fba0091c0fa25496464228af7c0fb1
MD5 052bd7f02901cf84b2bf0fc67dababbd
SHA1 93ba014082b83cb81eb54eeda30664b180c5f1f3
SHA512 a21830431223dd27e967fcb6e18da36575a1b7d91696a1fdb8a8cb50cc479e7bfe9354561ffc41b9c2973b543eb64e561bc03ab20453edbc420744fdb831ce6e
SSDEEP 768:tRSNPzPYHe+0zDGK6Tyc8qz2SvakSI1LIBKSImbAvbavz:0rIpTDkI+0SPcvmz
TLSH
T159030284D22D4782A9C577E642E273C3892FEF39BE5B571034A741FFB249366605B470
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Cache\Cache_Data\f_000002
Size 71KB
SHA256 3e3feae8ee4c6b2a9e3d614847664f7ba9fd1517b446fedce19caee08f409f3f
MD5 482bd2f4782f1ce7c01780a76cf53e23
SHA1 e8416e4acc981bc1ccd4905ea9401686f83608c6
SHA512 538997f10e965bd3a76f663120b5480f2f9a7b5314ff035b53d58845442a9f832137ee49067bcf05a0e43a8c454c0ac303b863055f850f72d6f0a16a4b4bc9d3
SSDEEP 1536:/VuOR3aNs67H5NUCJY/wHZn8m6+yfyMl7Zl6iFF3cld6EQjFShwG2rN:/F5abNUK1oKI7Zl6ibs6EQRShCrN
TLSH
T1A563125FA7AFC5CF5E983CB1597CF92B20C5014BF2B0B33CC04A70584A69797A8C6256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Cache\Cache_Data\index
Size 256KB
SHA256 1abdc97e4c20ca84cbea693c906cb6fec29331f4effd1510eaa833e41df389ff
MD5 85fecac767760f42d419ba08620a424b
SHA1 f0fe9615e71432e9e773f79ca68318b3ea5c3dd1
SHA512 9b7bc91474e7a679b559fce5727e99744b903c5e0fda3cb5c12bc81b863abe97bed7ba455fb84b8cba35338b8d22fd2a5dffad771cbf69e6437dd5e26d7c0098
SSDEEP 3:LsLllFlklNllklkXlKGtlollLll/E8ll//5NtlmNtl3Nl/lgl5llll/9lXl:LsRa3lPL4PltBkNHUlll
TLSH
T14344121E83846E15D2C801FC840B47102374C404CA8FC703030072203CC07401D0F010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 33add9bbc1fb46517317eea53321ced7bc4db4a4be8dc78b3348690ad981d504
MD5 bb6819ea142df39fc4bfb8479123b7a7
SHA1 2137ec5a64342e93f99ac4d411c0e76a6032340f
SHA512 372eccd91158a09bb42983768e84884799c72c4b783e2d83355b46982de793ef2db5c4e6cb8b3d9cad982c717def125844df2dcdea8801190a94887bd13138d1
TLSH
T1D9E02B82828D0F0DD32DA6F7CDAA03058A0E82C42ABE7643A980C2C533124241248232
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d42e97e5be3ae70f5fb45e50a86c68f98faa8c5cf42ae5fc97b64c340febafc3
MD5 b2231290d2fb08038e0599a3703b3f2f
SHA1 da51b3b6f1f8bb7c1b5aab78ffe366a042469e5c
SHA512 1319199246a72ca6c360a816b67493dd9aa09452762457a0c5d3a6dd98cf50bb64aea847d1f056883b50bf5f0e0100da3cac0950ff3d3bdb1b969101219106d1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 46a22f59fc7dcd3cb5230dcb2d1d8f5da05f822d8651ac0286370eacb140f4ab
MD5 b61788dea888a973df800f5827a10145
SHA1 3386aa83f280af386f241c022b60e7998788b86a
SHA512 65bb57e0540145804d80545226d15c9087cee0640a74f3fae1cdb72f8e8bb8ed7bd20283e704dd8302e43fd17f5b3e8a2f9d5092e126edc425a2fce0bfb41bea
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\DawnGraphiteCache\index
Size 256KB
SHA256 a52f841994806619055c2299fdef2b9c74c9b90c4dd46705339a4e83d2077ebf
MD5 22f07c12c72c43d6e4171877ea4363a4
SHA1 db3e13c075dd1ac9597a1222df33daaa8ac80ae1
SHA512 f4d0ddedf4387ee11c8faad2247f9a30e3999dbea9fd06dc7cd6f3ff17db61d6a53ff87bfb5122c23f5d93e0d70d1f8e6fc180fd2559588b72ea1d1f58cfdc8d
SSDEEP 3:LstlNllklkXl5lX:LsX3lP7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\DawnWebGPUCache\index
Size 256KB
SHA256 9ea476527cd649a8ec6784b730336b5271a9de2a9567374757c065df33366fb5
MD5 3e66d8e5e45ec8e14ed5eb45138d63b8
SHA1 31e2f7fb9ce41a8227310fd3c9c076db28ee2812
SHA512 86b86951a52d10dd6724269d8cc58bc389b2003e0a745b8ccf31bd72e00b667cbb69272afa640e8e565901cdc3724c43abaed43fbd4d4ea5b3310ee34c8358f8
SSDEEP 3:LstlNllklkXlfb4:LsX3lPz4
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\GPUCache\index
Size 256KB
SHA256 505260a59e180d54e6bb759028ae3d351656c55a5de939ce03a925b0fbffc7f9
MD5 c7813cab5c6af10c6cb79121c955d4e3
SHA1 7c609d44aed042a99c75e17f4b1a2775bd4ba940
SHA512 c6fff880f9f64d43ec1e53a5d2f5683de258a3af6a4fb47a7182af0458f24b0ce99af0b4755d0db05f85f26926ecc3fbca4e468db83b2608846f95bfe50f834b
SSDEEP 3:LstlNllklkXlmxe:LsX3lPmk
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 272be650af03937126331ff13a2707879e00df9532c8cffb88f0f22a2a68e6fe
MD5 bdd8aa3f002dc9e82453984d1aff5195
SHA1 37e335b5c1379a43ebb795e6ee6edc4b857d41ca
SHA512 1a2a61dcf0105f3beb0c61765e789bce49d3f94270d446eb26304a22d7853fe8f178e463383ead5cbd7513fa0d69cccbef6c7d5920b72f7fa357c032e1530f79
TLSH
T141A0022517418510C64012B42945C39C1701F925C004861376E143569C600505961254
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 f0aa515b8c93f700dadbd8db28178f3cc6b277f8728f5a240b7446aea27c65f6
MD5 dcf55b30b032277ccf80683bc548e8a7
SHA1 109f8911f131049732b1c59a7b74b8c1ac534a35
SHA512 2a9c2383d52838212b12576738b28596109f0aec8ab32a03d90c83af0c0b8256e0cadd48024e43ca1997aca1d968eaa554d3d0cea86503a38f3156f8b32ec30e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bmmjc0pu.4lp\GraphiteDawnCache\index
Size 256KB
SHA256 157a55ab8b9a08096d92aa8f414c5192b4544336ebaa0f8dce5ef284ce744f8b
MD5 42d1124ffaf0d0a9996ede72c0600669
SHA1 82bf9a9fcf02e045b10bc583979448f1f99ae7ec
SHA512 ffd6434155cc145a16a9db32b77d0e5e74c3ee1d4f12f8ec5398399fa945d18a26e2cceef226d542888b559981b22d1e45541c34d6677cd56e361820745342f2
SSDEEP 3:LstlNllklkXl4Enht:LsX3lP4Er
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1224-7-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/1224-15-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/1224-13-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/1224-12-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/1224-11-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/1224-10-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/1224-9-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/1224-16-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/1224-8-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/1224-6-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp

Download

memory/1224-5-0x0000022075CC0000-0x0000022075CE2000-memory.dmp

Download

memory/1224-2-0x00007FFC1405F000-0x00007FFC14060000-memory.dmp

Download

memory/4032-51-0x000001D967700000-0x000001D967732000-memory.dmp

Download

memory/4032-45-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/4032-239-0x000001D9679A0000-0x000001D9679B2000-memory.dmp

Download

memory/4032-37-0x000001D94E000000-0x000001D94E001000-memory.dmp

Download

memory/4032-43-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/4032-44-0x000001D966EA0000-0x000001D966F72000-memory.dmp

Download

memory/4032-46-0x000001D967070000-0x000001D9670EA000-memory.dmp

Download

memory/4032-53-0x000001D9679F0000-0x000001D967A40000-memory.dmp

Download

memory/4032-47-0x000001D9670F0000-0x000001D9671C8000-memory.dmp

Download

memory/4032-50-0x000001D967770000-0x000001D967864000-memory.dmp

Download

memory/4032-48-0x000001D967210000-0x000001D96725C000-memory.dmp

Download

memory/5680-183-0x0000024BB3ED0000-0x0000024BB3FC4000-memory.dmp

Download

memory/5892-31-0x0000020BE4E40000-0x0000020BE4E48000-memory.dmp

Download

memory/5892-30-0x0000020BE4A00000-0x0000020BE4A24000-memory.dmp

Download

memory/5892-26-0x0000020BE4EE0000-0x0000020BE4EFE000-memory.dmp

Download

memory/5892-29-0x0000020BE4A00000-0x0000020BE4A2A000-memory.dmp

Download

memory/5892-28-0x0000020BE4E40000-0x0000020BE4E4A000-memory.dmp

Download

memory/5892-32-0x0000000180000000-0x0000000180040000-memory.dmp

Download

memory/5892-27-0x0000020BE4F00000-0x0000020BE4FB2000-memory.dmp

Download