a9bf01982168407700434d699816d6f427bf9ece8d54824bdbd01b06b7f36be9

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
our revised order qty for PO - 4500352886.js
Size 1.3MB
Sample260820-dcaklsdp7x
SHA256 a9bf01982168407700434d699816d6f427bf9ece8d54824bdbd01b06b7f36be9
MD5 91c497e9315245e1909a9bab08346b96
SHA1 d15dfe2fabbb39c4a72e14c4384627b5e17024c4
SHA512 6b46e92ee4ce2c0157d389172d4a21e5c94193d5c8677ee30c9597a7cf832fc36f41b550b745ede4f0d11b2ba801a29cfbe434205c700fcd1bb42dc7f076ef4e
SSDEEP 24576:6/C+F+paQJA+Y/TkDpJyXGc1bOpJW0wqygGBT7aGhnFZweKXZcU5:q8+LkC2c1bavMjhFWh
TLSH
T1026512F0DE418CA437398B2ED56AD6981FED46C8311DE4DFAE1828B05779BD7E81301A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4716	powershell.exe
984	powershell.exe
4768	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	prevhost.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6284	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3252	chrome.exe
6948	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4716	powershell.exe
4716	powershell.exe
4716	powershell.exe
4768	powershell.exe
4768	powershell.exe
4768	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
984	powershell.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
1156	chrome.exe
1156	chrome.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe
5340	prevhost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
984	powershell.exe
984	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeIncreaseQuotaPrivilege	984	powershell.exe
Token: SeSecurityPrivilege	984	powershell.exe
Token: SeTakeOwnershipPrivilege	984	powershell.exe
Token: SeLoadDriverPrivilege	984	powershell.exe
Token: SeSystemProfilePrivilege	984	powershell.exe
Token: SeSystemtimePrivilege	984	powershell.exe
Token: SeProfSingleProcessPrivilege	984	powershell.exe
Token: SeIncBasePriorityPrivilege	984	powershell.exe
Token: SeCreatePagefilePrivilege	984	powershell.exe
Token: SeBackupPrivilege	984	powershell.exe
Token: SeRestorePrivilege	984	powershell.exe
Token: SeShutdownPrivilege	984	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeSystemEnvironmentPrivilege	984	powershell.exe
Token: SeRemoteShutdownPrivilege	984	powershell.exe
Token: SeUndockPrivilege	984	powershell.exe
Token: SeManageVolumePrivilege	984	powershell.exe
Token: 33	984	powershell.exe
Token: 34	984	powershell.exe
Token: 35	984	powershell.exe
Token: 36	984	powershell.exe
Token: SeIncreaseQuotaPrivilege	984	powershell.exe
Token: SeSecurityPrivilege	984	powershell.exe
Token: SeTakeOwnershipPrivilege	984	powershell.exe
Token: SeLoadDriverPrivilege	984	powershell.exe
Token: SeSystemProfilePrivilege	984	powershell.exe
Token: SeSystemtimePrivilege	984	powershell.exe
Token: SeProfSingleProcessPrivilege	984	powershell.exe
Token: SeIncBasePriorityPrivilege	984	powershell.exe
Token: SeCreatePagefilePrivilege	984	powershell.exe
Token: SeBackupPrivilege	984	powershell.exe
Token: SeRestorePrivilege	984	powershell.exe
Token: SeShutdownPrivilege	984	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeSystemEnvironmentPrivilege	984	powershell.exe
Token: SeRemoteShutdownPrivilege	984	powershell.exe
Token: SeUndockPrivilege	984	powershell.exe
Token: SeManageVolumePrivilege	984	powershell.exe
Token: 33	984	powershell.exe
Token: 34	984	powershell.exe
Token: 35	984	powershell.exe
Token: 36	984	powershell.exe
Token: SeIncreaseQuotaPrivilege	984	powershell.exe
Token: SeSecurityPrivilege	984	powershell.exe
Token: SeTakeOwnershipPrivilege	984	powershell.exe
Token: SeLoadDriverPrivilege	984	powershell.exe
Token: SeSystemProfilePrivilege	984	powershell.exe
Token: SeSystemtimePrivilege	984	powershell.exe
Token: SeProfSingleProcessPrivilege	984	powershell.exe
Token: SeIncBasePriorityPrivilege	984	powershell.exe
Token: SeCreatePagefilePrivilege	984	powershell.exe
Token: SeBackupPrivilege	984	powershell.exe
Token: SeRestorePrivilege	984	powershell.exe
Token: SeShutdownPrivilege	984	powershell.exe
Token: SeDebugPrivilege	984	powershell.exe
Token: SeSystemEnvironmentPrivilege	984	powershell.exe
Token: SeRemoteShutdownPrivilege	984	powershell.exe
Token: SeUndockPrivilege	984	powershell.exe
Token: SeManageVolumePrivilege	984	powershell.exe
Token: 33	984	powershell.exe
Token: 34	984	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1156	chrome.exe
1156	chrome.exe
5072	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3280	msiexec.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4716	5048	wscript.exe	89
PID 5048 wrote to memory of 6284	5048	wscript.exe	91
PID 6284 wrote to memory of 4768	6284	cmd.exe	93
PID 6284 wrote to memory of 6480	6284	cmd.exe	94
PID 6284 wrote to memory of 6796	6284	cmd.exe	95
PID 6284 wrote to memory of 7028	6284	cmd.exe	96
PID 6284 wrote to memory of 3924	6284	cmd.exe	97
PID 6284 wrote to memory of 984	6284	cmd.exe	98
PID 984 wrote to memory of 4696	984	powershell.exe	101
PID 4696 wrote to memory of 2520	4696	csc.exe	102
PID 984 wrote to memory of 7044	984	powershell.exe	103
PID 7044 wrote to memory of 6984	7044	csc.exe	104
PID 984 wrote to memory of 3280	984	powershell.exe	105
PID 984 wrote to memory of 2004	984	powershell.exe	106
PID 3280 wrote to memory of 5340	3280	msiexec.exe	107
PID 3280 wrote to memory of 5340	3280	msiexec.exe	107
PID 3280 wrote to memory of 5340	3280	msiexec.exe	107
PID 5340 wrote to memory of 1156	5340	prevhost.exe	108
PID 1156 wrote to memory of 976	1156	chrome.exe	109
PID 1156 wrote to memory of 4532	1156	chrome.exe	110
PID 1156 wrote to memory of 3252	1156	chrome.exe	111
PID 1156 wrote to memory of 5724	1156	chrome.exe	112
PID 1156 wrote to memory of 1596	1156	chrome.exe	113
PID 1156 wrote to memory of 1064	1156	chrome.exe	114
PID 1156 wrote to memory of 2848	1156	chrome.exe	115
PID 1156 wrote to memory of 5716	1156	chrome.exe	116
PID 1156 wrote to memory of 4104	1156	chrome.exe	117
PID 1156 wrote to memory of 7136	1156	chrome.exe	118
PID 1156 wrote to memory of 6260	1156	chrome.exe	119
PID 5340 wrote to memory of 976	5340	prevhost.exe	109
PID 5340 wrote to memory of 976	5340	prevhost.exe	109
PID 5340 wrote to memory of 5072	5340	prevhost.exe	121
PID 5072 wrote to memory of 5032	5072	msedge.exe	122
PID 5072 wrote to memory of 6912	5072	msedge.exe	123
PID 5072 wrote to memory of 6948	5072	msedge.exe	124
PID 5072 wrote to memory of 7164	5072	msedge.exe	125
PID 5072 wrote to memory of 2680	5072	msedge.exe	126
PID 5072 wrote to memory of 2368	5072	msedge.exe	127
PID 5072 wrote to memory of 6984	5072	msedge.exe	128
PID 5072 wrote to memory of 6816	5072	msedge.exe	129
PID 5072 wrote to memory of 6496	5072	msedge.exe	130
PID 5072 wrote to memory of 4268	5072	msedge.exe	131
PID 5072 wrote to memory of 2064	5072	msedge.exe	132
PID 5072 wrote to memory of 3456	5072	msedge.exe	133
PID 5072 wrote to memory of 5700	5072	msedge.exe	134
PID 5072 wrote to memory of 1428	5072	msedge.exe	135
PID 5072 wrote to memory of 6852	5072	msedge.exe	136
PID 5072 wrote to memory of 5660	5072	msedge.exe	137
PID 5072 wrote to memory of 6668	5072	msedge.exe	138
PID 5340 wrote to memory of 6816	5340	prevhost.exe	129
PID 5340 wrote to memory of 6816	5340	prevhost.exe	129
PID 5072 wrote to memory of 5892	5072	msedge.exe	139

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6480	attrib.exe
6796	attrib.exe
7028	attrib.exe
3924	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\our revised order qty for PO - 4500352886.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command $AMSFV=$env:NQWXXB;$EWNNU=$env:KVRB;$GHQTLGZQ=$env:WJSK;[void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($GHQTLGZQ));$OTEK=foreach($MAAPSXW in [IO.File]::ReadAllLines($EWNNU)){if($MAAPSXW.IndexOf($AMSFV)-eq 0){$MAAPSXW.Substring($AMSFV.Length)}};[IO.File]::WriteAllLines($GHQTLGZQ,[string[]]@($OTEK),[Text.Encoding]::ASCII)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MusNotify.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:PJKNNZGQU))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gdi_fontmap\gdi_fontmap.dat"
    3⤵
    - Views/modifies file attributes
    PID:6480
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gdi_fontmap\gdi_fontmap_KENWNXLX.cmd"
    3⤵
    - Views/modifies file attributes
    PID:6796
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gdi_fontmap\gdi_fontmap.dat"
    3⤵
    - Views/modifies file attributes
    PID:7028
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\gdi_fontmap\gdi_fontmap_KENWNXLX.cmd"
    3⤵
    - Views/modifies file attributes
    PID:3924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:PJKNNZGQU))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\on42algo\on42algo.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDD66.tmp" "c:\Users\Admin\AppData\Local\Temp\on42algo\CSC15556EF6B3CA41D592E93A3FAE7F3C2.TMP"
        5⤵
        
        PID:2520
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mqyqbzkm\mqyqbzkm.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:7044
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE12.tmp" "c:\Users\Admin\AppData\Local\Temp\mqyqbzkm\CSCE38C558C808D4494BB8AECB6D08DE17B.TMP"
        5⤵
        
        PID:6984
  - - C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3280
    - - C:\Windows\system32\prevhost.exe
        
        "C:\Windows\system32\prevhost.exe"
        5⤵
        Accesses Microsoft Outlook profiles
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:5340
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc"
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff84ebfc728,0x7ff84ebfc734,0x7ff84ebfc740
        7⤵
        
        PID:976
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1672,i,11467287017934632375,10616546638185677021,262144 --field-trial-handle=2060,i,10346879238986348018,6348760866008312092,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
        7⤵
        
        PID:4532
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1896,i,14452681884381101903,11172246028195317268,524288 --field-trial-handle=2060,i,10346879238986348018,6348760866008312092,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:3252
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc" --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,14040885172628586399,9669099074320150272,524288 --field-trial-handle=2060,i,10346879238986348018,6348760866008312092,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:13
        7⤵
        
        PID:5724
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3032,i,18173443298457906220,462209688604872781,2097152 --field-trial-handle=2060,i,10346879238986348018,6348760866008312092,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
        7⤵
        
        PID:1596
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3048,i,4815383349849233060,8785603664434870387,2097152 --field-trial-handle=2060,i,10346879238986348018,6348760866008312092,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
        7⤵
        
        PID:1064
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3204,i,16673316479780961147,6583460959952797924,2097152 --field-trial-handle=2060,i,10346879238986348018,6348760866008312092,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
        7⤵
        
        PID:2848
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3216,i,5370250416386852714,1723755239226984751,2097152 --field-trial-handle=2060,i,10346879238986348018,6348760866008312092,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:9
        7⤵
        
        PID:5716
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3816,i,14943573877691011744,17154022207001442143,2097152 --field-trial-handle=2060,i,10346879238986348018,6348760866008312092,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:9
        7⤵
        
        PID:4104
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4208,i,564904225721187579,18096554243024583784,2097152 --field-trial-handle=2060,i,10346879238986348018,6348760866008312092,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
        7⤵
        
        PID:7136
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc" --force-high-res-timeticks=disabled --metrics-shmem-handle=4424,i,15917977770580811063,6589943830738898886,524288 --field-trial-handle=2060,i,10346879238986348018,6348760866008312092,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
        7⤵
        
        PID:6260
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b"
        6⤵
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ff84e7dc188,0x7ff84e7dc194,0x7ff84e7dc1a0
        7⤵
        
        PID:5032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1744,i,714635849790810037,7623008442952075345,262144 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
        7⤵
        
        PID:6912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,13497763251710326837,12714120018322747447,524288 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:6948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,18237053449436087164,923555796565748579,524288 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:13
        7⤵
        
        PID:7164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3220,i,17853506307251784631,12047342001695525046,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
        7⤵
        
        PID:2680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3224,i,884794006629638742,2419333114728010890,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
        7⤵
        
        PID:2368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3680,i,15754515411314169281,10156575790528781174,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
        7⤵
        
        PID:6984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3724,i,2687302478353817876,598594082649104041,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:9
        7⤵
        
        PID:6816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3740,i,9053728969045635518,13804112893973410875,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
        7⤵
        
        PID:6496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3792,i,3950260398358610923,10373157551523246175,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:9
        7⤵
        
        PID:4268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3808,i,10466929062870238,7628428124015965697,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
        7⤵
        
        PID:2064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3856,i,4806823294849518861,15958113224566080428,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:9
        7⤵
        
        PID:3456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3892,i,3179611356569945489,12397612582299362592,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
        7⤵
        
        PID:5700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3920,i,17102925106106355135,11708631128187983531,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:9
        7⤵
        
        PID:1428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3800,i,5164717068903961232,5132655428886995563,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
        7⤵
        
        PID:6852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3956,i,4369553301923804605,8963594146265844479,2097152 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
        7⤵
        
        PID:5660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,2015956380095432401,14740180447942924884,524288 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
        7⤵
        
        PID:6668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,14528428249401669688,6695582014725490137,524288 --field-trial-handle=2360,i,5218422533333643299,9041740394029102404,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
        7⤵
        
        PID:5892
  - - C:\Windows\system32\choice.exe
      "C:\Windows\system32\choice.exe"
      4⤵
      PID:2004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MusNotify.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\MusNotify.cmd
Size 1.3MB
SHA256 c7141322544b430c9effe4f1381ea1dc2fb99e335463f1ac59526aedd9bb7839
MD5 0b0c866ed0a318f687d78b3b42695bf8
SHA1 c9cead43f19307638dcda01e52017a337396081d
SHA512 a7f314690b5113382fd2b2c8047376b5f4e8e1e0f4a6fd48dc6d4b746016080c4f8e876fe8bfaffd27280a15a7c06a6bad14f0ac682fa0d21067a2c9d8c1ea3b
SSDEEP 24576:GDCexOdywFUukXT4Dp5qzGUR3Kppe0ceGQ+NLnimhHdBkWeLUIcL:GQmj4OSUR3mbgXh92i
TLSH
T1C95523F05B511C043AB9C16EE5BBEA5C2B9AC8C42221F8EFB5193DE0256DB97DC13427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 e1deb6703a639c411bb0b49b7e90784cda49515371b5e2745a429c2d82f716e8
MD5 7cd26ef12032e4e2cadfa9dd4da6fa16
SHA1 6e0865fdc5b8383f9e4cda3d2072f459a149ce40
SHA512 1cbf74789e1349e169bd4ee88b5bf05d568837fd32fbfce1191e95d43aa4220eda3a6a17a53c1ee78a19ed577bfb37e4d499bb2fd334e2199db2d42609df631f
TLSH
T108116633F3CC8624DC5A403650DEAC1136B687CB449ECE6B7B84D154B46F699DEA0260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f2f2e7c84c183c5924ca665738ab6baf34b20138fc651eb13a3ad5f3446b523c
MD5 6f3906131e31c68e9b07cfce8da96918
SHA1 f392d1592b3655ca891d1e219f41dd333963f48b
SHA512 269260d5c7d8b8b03314ac4f2417812b3f7752852b3e745cce2e9fe5759721d61f776dcc8afbb318819fbe864758fa61a3542f821cb819d1acab7935bf1e222d
TLSH
T1A3218933B3CC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544A42F299DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b\Crashpad\settings.dat
Size 280B
SHA256 27175bb9b2297bd5fe100dc5bf258c26dab49465f9a2b4afa6734c68a5c354d7
MD5 e454d84b20df1b4f5b62dc7e2e8e1b96
SHA1 282db940dac44ffa7f7a1352c7aaeb3a2fd46904
SHA512 b38b1c84fbd55baa7b2db1bdc4849c0a0390e0160de226c2eee46c8000dcf4ebd4d7d7cc5c7e0431b10807b53fe0102df6c4bb88ed079af97e7269a0a4062c4a
TLSH
T126D02470F3C45C0CC01317351054134707144CC00CC3CCF1341100F35C1174114C4044
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b\Local State
Size 3KB
SHA256 e2208efb020042e61d96a6cfac301729382e825153152a1541be15f8f5b1b5ea
MD5 1b77f804ddb4c78b059aea4a3a5e174a
SHA1 27ca832dcaa45038cff48c34eec7f1893938d303
SHA512 958691c23b73d215a57261299a985d81fb528fd868c50d7d9eecf3739e4b42176705b2bec95c71e818ecba15d63ec503ff4212d071fa1ae0246470450b64a1ce
TLSH
T1B881B6716864EC3365E6AA44788677E39F7870B3DD85EF94E6D8531804DB3482F09827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b\Local State
Size 4KB
SHA256 ba67fa2a806a0c40c82624b79c6427f722948a3da7904444517b227e37095409
MD5 625a08edcc15a8eefbc2e0a92ff21d5e
SHA1 f143270001963cb624dd65a1d0111396dc8a21e0
SHA512 1132279119d5e806999518b21d6c3901db9ad2b9a3de79c5dc4796fb00906d2d5a30b302019a1f80d01b647076c932d7b976e468b8c638069cef15117023a7bc
SSDEEP 96:YqGNkHQsFfdLS/58Frh/cInURoDotovxRDtBeBv1rp8X0eUn/khkq4a:DGNn4LFooDUwbzM8Xq/K
TLSH
T165A1C8716874EC276DE2AA44B8C63793AFB43173D885BF98D6DC1B0C04DB3882B49817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a0b6b.TMP

Path C:\Users\Admin\AppData\Local\Temp\0jyw1a1d.42b\Local State~RFe5a0b6b.TMP
Size 1KB
SHA256 ced7d6599b2369f8b8d9d406f3416aef2f5ab6d29a63cad9968312dfb180bd80
MD5 34246aeb286a529a25184691fe861d96
SHA1 9d2b2a49cdffdad5f9973dd3fed71a7102838bd9
SHA512 d38669d00c97eb13c0b534f6d01196660db6730acbc313c20254ec99aacaa0ade6b34c2727f035df29aa768c8cca36422260fba28940760c652fc3b80908e3b1
TLSH
T1A031B7706CE46D37F8B197467646F7676F306575C1D19FD882EC021C01D728CA61983B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Crashpad\settings.dat
Size 40B
SHA256 02eaeabc7b0f9619957132457fb8099c43a31c9b2aec1b1bc53751c93440b3b2
MD5 b53b74b68683045a63ad4294a00ddc65
SHA1 faf750d646fbe4bd45718d0d8e988408d43305bb
SHA512 5a189eb3fb9ab38e29b0b436c04f9177b401e732d586569a92f33db1b6a500a721843e02fb6198648b80ae703276d0b60709565ca24f20defd509430965b7d44
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 9c12d4b2afc074f415ef82b80d00f5372923d904e645682d14bb90b782310e14
MD5 1bb8eefc29564048638150f10874cc67
SHA1 5ef4b62e75737e26a76b564c013156221599f552
SHA512 ad3ff1073b4b385cc5e10efa48ab96d48cf00d18bf007e6e25888c86aa69dc315c6a44cbeb73f2ab6ee2f97fc7e797b02aab78250f6714bbdc0b091823844107
SSDEEP 6:/FoEXEwC+kNGF1aYbml453idBt5mXkEXXJR1Pmklle8eHH63W/:d7X5ENGpbvkLSkEZzPr/e8i63C
TLSH
T1BB13523CA3989C0EC281183C3A878BB06371C764DA93CA1B31ECB5AC38B4203004AA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 acdf93919e1bfa248dedd6c5ed97a0f28bbf9cff6f8e655e8314fef6d58dc9c9
MD5 5ea785fe854cf89ded63069ddc82afe9
SHA1 2dbdcce1c1f1055a470741ac6bf1a4fb134efcc8
SHA512 1ddf53089992566c2e7bef494cfb6ac94b711e4306a89ce723cfc6f12a360d87945d019dd44b8a996d64bb4b32e7481b84445394aa7d0932b622621c392b24e5
SSDEEP 48:TlHYj3P3zlblQL5pAM1XgmQ/7XyYtDMmXsdVEPLVBKWwtl:p4j/hblQ0ugDryIDjKVOLHKWol
TLSH
T18D44A6F71D04DAC6EB19CBF46C42923C8E3356262DAAED79F17D44B601509E731286B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 98f3f6862a28b3ca69f965c5ba3678a10c36f589b6a95ac13f630969692bd171
MD5 7f226b517d30656cb655a0ace4680c69
SHA1 2aee45f1f1f3a30a094ae008733f9d2dea314bc6
SHA512 1e82e0fe002cb485ab658ecd166141c3a905aa7fa936d3babd4eca50a149a374c4f92b5af97d656fa390fb5658597021d88a3d35ab99b408f6d8b96109ea9d76
SSDEEP 768:cUfDPLSgcRUv+f43UfDPLSgcRUv+I4dfDPLSgcRUv+54OUfDPLSgcRUv+H4t7rgG:CT/5/fK7zdGfKLfK
TLSH
T15F164BB60F24B546EA85EFB0BBC9DD1C2CB43399AC929C92F122426D4AF1FC507C515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 a1286032722be68b27783564b9f9a158b3d5b138d1c5ed1776af297c544b780d
MD5 e0a302af38a542017bd41b6ba342ac76
SHA1 e1932f7f740cf7d67a51849908c4ba4ec417ff05
SHA512 43af0fa5623bd18981745f6110db208bef897bd160c7bc04d31eb5b502a29377c0d470e3488e038c7a8660afe1649a88ea3aa52771d24e3ff1b97bd6b0f953c1
SSDEEP 768:cANur0uj8ZaO9iPLDcHJjDuSLnv1cCoE1D6QdETwN0zWYjP:cAa8Z7huOv9o28Tc0ztP
TLSH
T1E40302C876C88C007C94538D8F243665B20B8E7E561FD8076B71D6ABD48EB5E9CE03C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Cache\Cache_Data\f_000002
Size 72KB
SHA256 0df3c4f39d3f7f318e5e9c31c07d7ff54b52d551ac30ab1c709743167f53a64b
MD5 718bfb329979c646da12fa79376bae76
SHA1 28dacce140caaad9a8492766e18ed92b0c93d2c2
SHA512 cb670c914b72c530362c7df9c2eb5b77bdbbe3c6d10f089be55a01e7534b21042203eff4edf3780b3369942a371aaeb317adb6dc34783dad39fc8f7a681433b5
SSDEEP 1536:GuNC1lRrqCNDEMmaSTJ2ed+oQK7vsmLMv29xy68oaVBOMS5In3N:LMlQCNYZTJkPAvsmz9N8oavOP4N
TLSH
T141730246A7ED93FDB5EC33E31742A406180908A8DC7A9BDFFD1F07AA1C1CA0195D895E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Cache\Cache_Data\index
Size 256KB
SHA256 8d90bf64b95206a2ccd9a60b4fb06bcce756f647351ec242b394602d2e83791e
MD5 8ec5a5bccd0c755cfab78a9ba87a2fd4
SHA1 533027c4ea869b4aad0d45c0e1c0fb37c087b9db
SHA512 f5fbb7456e8038d6416f90698613a090163d25493c33135b220dd211a0f8ba59c365648028df950ca1dc9e8b740446a9d4c12e67841fce2463add84c2706e1bb
SSDEEP 3:LsLllFlklNllklkXlkHvlllLll/ncll//ZNtlmNtl3Nl/l5llll/wlNlXl:LsRa3lPkHv/ilthkNHtlll
TLSH
T18744122E83643E01C2C001FC904747102334C405CA4F8383130421143CC03402D1F050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 b98c87fe85a666effbcc7236a7378cb3d127af5858e92d493ef135df0d69109e
MD5 7cbcb8c6b863d92dfaec3ca0510969af
SHA1 d75e9e28fd92df380a9813c4ab26eb6a2219cbda
SHA512 c66d90f329cb037233d7932ef730f38a3f3a12d38e067dc03475f3161ab3bbff42e709af6bd672cf80a954f4128fce6a692314da4d6667fe4aa6b0c5e6b0df25
TLSH
T15FE02B81C24D0F0DD32D96F7CDAA03058B0B82C429BE3603B980C2C133128341248223
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 0cf3ef2b742d4f333954766b5f3b7ebff9a6a6601778fe14dfeb1442694c33c6
MD5 0e9d4363a8d97918486447f1be36937c
SHA1 70024f1f8430156a68a73be46acba66809c41dfc
SHA512 729c4cfda6008d01fc85429d716ea7b790a1df9c9fe07c4b646903e56d87bd236ca09fb830991b2b749385ec12054a1579613ba8af4028875720cba5af5bf8bf
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 ad7fb773f2afecd7e36d9850380f60ba0a9355d788f2b348d8e795f82528e440
MD5 9c415350be42a8389e1179c8b725bb9c
SHA1 bbf64f75a4607f2031a916dc70ee072c9d288700
SHA512 17fba70ea4f3237dc48447f90fcf933630cccf016a734b51b235c2b0830e53f47433c642d1df83c690089e3b934ed19035ff8d1efbaa0e49ef56fccaf7346d67
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\DawnGraphiteCache\index
Size 256KB
SHA256 6a440500dce9ff2fa0e5eaf44a7b942c9238f7ed0cb1320b0ea55d157055fe1a
MD5 bec275b5f524d77ec13f9e22dc7cccd5
SHA1 6a4bae386887b0f1def38313398c2b0a997c2625
SHA512 7504c2df2bcab1e810d37a47374c11478aac234fd0bdbf900a8f4c309c28bcc38b7bd1bc563e4b120d29fc5c15ae09426974826364c3242f73f24d6bd5f44bac
SSDEEP 3:LstlNllklkXlKl:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\DawnWebGPUCache\index
Size 256KB
SHA256 382d5a4f06b512be4bf03f18be0ea90c104e611b46d4e6dd4c6eab780dd7a273
MD5 69c1f83810598774934a3f916f4b765d
SHA1 ac4568c3698e5ac687d159997c0ea1e67a0ad09f
SHA512 5d720a24b0d9a4dec12509c70356c9591cf31fc783366c39771921d5ea13e48620126571425d870d3bdf1943c38fb678236e565d982691a96da385c11ffe2ade
SSDEEP 3:LstlNllklkXlJCdKtl:LsX3lPsdK
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\GPUCache\index
Size 256KB
SHA256 e150339767236663d5663c4aa87704b22cbe19b98348791bae8f33d91a3194eb
MD5 2f9efc6a6ab315e2fcd9f1b9d9553cb2
SHA1 6c43c688c1a57856e95d4fc828e870acf1d41cce
SHA512 0c08feb8d3e23f71b3b4c7493af9f29fa80a1f25dbc810dbb5a1afa6702c8b19dc9ebcc9e92cbd05e91305d841b2615a72791e5d2d895d2a87604524a9cad426
SSDEEP 3:LstlNllklkXlvd+/l:LsX3lPF
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Local Storage\leveldb\LOG
Size 277B
SHA256 68a234596ed088f946c7e75bc105772479dd6946aae66999f19a02d829d5d224
MD5 b0751925534e10bc9417dffb10927a2f
SHA1 ca9e1672acaa5be1ab7794e91adcdca8343cc7b0
SHA512 552d8f120253a36334e9642a8c30b69fa33f687c3a5581bf87860fd1a744248cbda0e7af9ecdd084a50ec0544fc386d3a784efaa62cd568b7983b96a979aab8e
TLSH
T14DD0CD7188FB8D69071481AB59357B0CC778390CAEA967558D54D80C305584CE780282
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Network\Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Network\Reporting and NEL
Size 36KB
SHA256 473cee21f162f3a7a25635fadf8a9264238ac53cf89f7bb67ede9fbcdc676cfc
MD5 56e8276cedbc027359e31311dd2f91ed
SHA1 5aead8213b1fdeb895b9d51975126c5527ed8949
SHA512 c6ae5450f3ec31cb87fe6deb33b79c9c7919f637343e93cd0866d52c9fdaf674ab82eec261d77aeb0da4a5ed9f2960431657474cde55067a8b49c58c5a12888b
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:uIEumQv8m1ccnvS6
TLSH
T195F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Network\Trust Tokens
Size 36KB
SHA256 61747eae344a1ed6b1bea06522e094eba6879049db5f918e55423dbd8981a881
MD5 f2a84020dd3bf7c981b9b69dc6b8951e
SHA1 362b54cbf3c0ad6473ca595d4b72930ad9268890
SHA512 75ef07c38033b51286eb208d494d3856e7238bf0b1e928c8c35b5ececa05e8b591fc908ff83f89a1695ba74ed2bd155e49d35222a8cfdf8dbe936daeed7ae1f9
SSDEEP 24:TLn3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T731DtX5nDOvyKDhU1cSB
TLSH
T1A5F2469BA93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\35k5rf41.ckc\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

RESDD66.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDD66.tmp
Size 1KB
SHA256 b6eb4ed4ee709fa03b21c207aaa4018f25655373273168ed947d3ab8b27f942e
MD5 b0081df6dc190ce0550516ca9db390a4
SHA1 55797193c264d6f8d5779ded75c5fd57be26df56
SHA512 2846f3db8bb2bd84b04ff5c0e8a87d1e20977606c72a20c8ebd188bbe11c14e008f11f465de311012b9efd4f4c3a73548414d75d2c34e9518ca6f9a78d2f2eb9
TLSH
T1D121AA0993E9431FF0775731B8FA131FA274FD61EFB193AA954042282C42204EEA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESDE12.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDE12.tmp
Size 1KB
SHA256 a08e1df2fe56e862ea76bf47f40b1bcbd02baeae815f89cbaeb16ab8514a5a3a
MD5 ff38be7b4a814c81161f3dc14b994401
SHA1 0579890118be1b2c95e6baa7f6836cc5f5037850
SHA512 7c59bbb761fcef6eac2291cfb24f0aca8e172dbabfc244054168e8985450a4d9ea72cecd50208d4d15af2caf4d1bc99bfbed29db63c685332791c93e086b2a3f
TLSH
T14621C00153ED871FF0B35B326DF6631B9274FD94EFB2536A954042281C01604EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yeavy4ev.vqc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yeavy4ev.vqc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_984_e59df4a.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_984_e59df4a.txt
Size 70B
SHA256 6faa8abd4f1b3477f97dd14734335e43427fdd6751f59794c2f649b1455fe724
MD5 40d155f9ac692980333e3826522137c3
SHA1 4b538c880dbb66c9f3033a4b7e354c4dbf3b00d9
SHA512 701d45549fd965078e61486c4c7c672b27dc36b07aa1ab769908cea29fd707fddd13ae12893788f5ea0e900ef5416f604d6bd76261b98951a57e37fc776337d6
TLSH
T157A0026F0CB74C6AC61B1F15665D71D106A1B18267D6A84496D043F0B06AF75C304758
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_984_e59df4a.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_984_e59df4a.txt
Size 86B
SHA256 b17c490234f041d5e0b2f49788a6e25e776ecc0e64f57416a3678b8166a864a2
MD5 1bf998366ff7a2171e3db29dc51a0dc4
SHA1 d29c25a62eed658182cb919d295aed5d8dd48885
SHA512 e9b1df924b2fb7682748a4215d5368c81382518ba07f78c6b7787b1353b1c687a8ee58f89117e0bef46c01e57b0fef61fc838a8fc07a9dfe3e07b5305c6cce33
TLSH
T144A0112A08B30C2AC22A0F80220E30C202A0B88223C2A8808AA003F0B02AF22CB00308
MD5 SHA1 SHA512 TLSH

Submit Download

mqyqbzkm.dll

Path C:\Users\Admin\AppData\Local\Temp\mqyqbzkm\mqyqbzkm.dll
Size 62KB
SHA256 345be1383b5ac9bfb0e16f705f910919ab5b2bc7c844f77474d2d3dc739fcb71
MD5 e64c1bf776eb1528cb76d9535f664e16
SHA1 44d0baeac387e48b36ad1cf86efcc4aab58466d7
SHA512 ebbad244a2b0dc7e96aa67687680871a63a575725bea64653a251c1c4d82724e7f57c516f2b8b7686d5cc0fd3898855be86afe2b35e66304b2ba7d0f1b9ca36e
SSDEEP 1536:mpAzFf5lVbOfQXRnxtopxaLaDhoq8aSUvv6KzhCJqHHo5g97EaU/oTKxUTtwdf0K:mpAzFf5jbOfQXRnDopxaLaDhoq8aSUvg
TLSH
T17A530A85A7F88565F2BF6B76D97102809734B0833A73E74E07E141EA6F727C08906BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

on42algo.dll

Path C:\Users\Admin\AppData\Local\Temp\on42algo\on42algo.dll
Size 3KB
SHA256 dfb577a4050450e25e71d9bb97f2c977e891ae0551035f2fd95d82b5287ed984
MD5 c0b6bf5897e1b3b6dcfd3477fff1aa92
SHA1 3b4c5448fd743c58dc35e5c1c7f0a99a66d09a5a
SHA512 e54ce3eacb1351e1818c46a89daa95d6c05a6e08bbaf36b10f29a2455d1f0f27b69c90446b2105cd655b356dc85a9f2997d1fb140a69022c37d4e7004c3501f7
TLSH
T1F6514B2697F8426BF07747306EE7071636B4FC108B62975E1981431C6C50AA46E21BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE38C558C808D4494BB8AECB6D08DE17B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mqyqbzkm\CSCE38C558C808D4494BB8AECB6D08DE17B.TMP
Size 652B
SHA256 72ab4864602f3309da0b8b814fe36dda8bf5d12ae9c92c25dd83ec282867898b
MD5 07163bdfede015dfe338e579d9eea0dc
SHA1 c6a64f20704e6389547bc20a091867c3ea88a23d
SHA512 f3d6b29d1592c33bf0ee6b78a81132c92ca67817b8d9ddb19f388a6df6c611f8ddd4236d697bb650a8633389090003b6c317952df7f886cf70a1fccdb21045ab
TLSH
T1D3F05E4963FC420EF0F35F31BEF693A391A8BD64DE7293ED6440131928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

mqyqbzkm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mqyqbzkm\mqyqbzkm.0.cs
Size 86KB
SHA256 790b20d1aca7ae1797f8dc880fedc4197f7c810d386b410f5c63cba0c9ad82d3
MD5 c9f3c29e27e0f0c9c8785708523befff
SHA1 d11883e822909b5525a333cf139eb0a078197385
SHA512 964ec8e34ad2daba57f4d3f595926f9d0e9a1d7f60e0a4c40785df9a819f32c0917ed60e72c3bc7108f924a8d080b4864fb611874197e2b6f9e6decd7cfc6865
SSDEEP 1536:ezylD7vZAJLdOmXJ5UfyGVpqu9Tb9kdewndoDYkm/MqB21Ss:/74dOg5UaGVpqu9T5kdewdoDYkm/NmSs
TLSH
T15993C5919709912E6DD02529ACCC204EFB93C53123F924B4D9ADD1A03E4E57DD2BFFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mqyqbzkm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mqyqbzkm\mqyqbzkm.cmdline
Size 247B
SHA256 5086b0a4b3e58c370108345d0d626de70675fc566ff2a7b5242d3fb4b0b048eb
MD5 315067d0d557a147c86aec7a757d034f
SHA1 0d7828035f67484cb26fea0bf0cb724e7522f772
SHA512 ee5f6b836de7652d0fed3098e0240acbf279d382170a46f91be3793032d9f56fa88e200ac3e1a65a856e01068dcb7770493aec01471b552688fef75413abac58
TLSH
T1E3D05E6A4287CA2966E8A4E728A2D4BC43B619199D473F9095E0C1CFD12704877D1782
MD5 SHA1 SHA512 TLSH

Submit Download

CSC15556EF6B3CA41D592E93A3FAE7F3C2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\on42algo\CSC15556EF6B3CA41D592E93A3FAE7F3C2.TMP
Size 652B
SHA256 786a1d123d020ed6febec78dd672ffc1738fd9ea91cbbadb24535332239d1559
MD5 2753ee7686618b6bc0fccfbcd39fc4d0
SHA1 e817577ccf7be798acea4368c5f4242d8511e766
SHA512 df389843399abd0afd1b4cf81aaa3adc06959cc93ea55c3c1e66e5b7e877134213a0b001a2a22cccaa5b53cfd486c9a04c3984205569625f91fa5f1183e5138d
TLSH
T1A6F05E0AA3F8420EF0F34B30BDF6436391B8BC65DE7293ED1580135928645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

on42algo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\on42algo\on42algo.0.cs
Size 60B
SHA256 987fefb55f5ec95ae927ada3bfbfb64e8f022193cfb3296ec65b561053578c72
MD5 5008e65bbf396b7984284b437a87f2f2
SHA1 05c32416a4a9ffc8f61bbc7c754803b56dbc06d6
SHA512 004d9177e0fab5c1e109d5243259b07c4de2c67ae4f9137b611f866395bf987f534c1f58011dbfd3c5b54de2819469fd21fd83e79678d68b28578f01f28b73f8
TLSH
T1E0A002413651E5350987D803C511CC33EB0694F05BBC7E12C1550F113E0040BB23816B
MD5 SHA1 SHA512 TLSH

Submit Download

on42algo.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\on42algo\on42algo.cmdline
Size 369B
SHA256 b3c7e211bb8ff67bb16e10172cda5d2d9f533572a0bb8d80db86d00ade9de3e5
MD5 1f02c587533a3d793364d65de9876149
SHA1 b5a464692bf16acc251eb13696a277ce5bc19940
SHA512 f0f1e6ed18a56d09e9cbc7cdbe3951d45da36bb0b3b5ad031d258086cfc367ad942bfb292ae0957f9dff1b074636356d34d58b8eb3415c0e82305b1f036668e5
TLSH
T1E1E0C62A8746C2FD41FD104B32ABE4ADEA7287832982BF84B460840DE06F0002BD3B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/976-230-0x000001706D7B0000-0x000001706D8A4000-memory.dmp

Download

memory/976-233-0x000001706D9C0000-0x000001706D9F2000-memory.dmp

Download

memory/976-231-0x000001706D7B0000-0x000001706D8A4000-memory.dmp

Download

memory/984-25-0x000001B59BB30000-0x000001B59BB3A000-memory.dmp

Download

memory/984-53-0x000001B583460000-0x000001B583476000-memory.dmp

Download

memory/984-23-0x000001B59BAF0000-0x000001B59BB0E000-memory.dmp

Download

memory/984-24-0x000001B59BD80000-0x000001B59BE32000-memory.dmp

Download

memory/984-26-0x000001B59C250000-0x000001B59C27A000-memory.dmp

Download

memory/984-27-0x000001B59C400000-0x000001B59C424000-memory.dmp

Download

memory/984-40-0x000001B5833B0000-0x000001B5833B8000-memory.dmp

Download

memory/3280-54-0x0000025B94FE0000-0x0000025B95030000-memory.dmp

Download

memory/3280-71-0x0000025B95030000-0x0000025B950FE000-memory.dmp

Download

memory/3280-68-0x0000025B94FE0000-0x0000025B95030000-memory.dmp

Download

memory/3280-72-0x0000025B95030000-0x0000025B950FE000-memory.dmp

Download

memory/3280-58-0x0000000180000000-0x0000000180040000-memory.dmp

Download

memory/4716-10-0x00007FF852960000-0x00007FF853304000-memory.dmp

Download

memory/4716-9-0x00007FF852960000-0x00007FF853304000-memory.dmp

Download

memory/4716-3-0x000001FE0AD30000-0x000001FE0AD52000-memory.dmp

Download

memory/4716-4-0x00007FF852960000-0x00007FF853304000-memory.dmp

Download

memory/4716-5-0x00007FF852960000-0x00007FF853304000-memory.dmp

Download

memory/4716-0-0x00007FF852AEF000-0x00007FF852AF0000-memory.dmp

Download

memory/4716-7-0x00007FF852960000-0x00007FF853304000-memory.dmp

Download

memory/5340-88-0x0000019918230000-0x0000019918308000-memory.dmp

Download

memory/5340-87-0x00000199181A0000-0x000001991821A000-memory.dmp

Download

memory/5340-95-0x000001997F600000-0x000001997F650000-memory.dmp

Download

memory/5340-75-0x000001997E8D0000-0x000001997E8D1000-memory.dmp

Download

memory/5340-83-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/5340-82-0x000001997F530000-0x000001997F602000-memory.dmp

Download

memory/5340-74-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/5340-89-0x0000019918350000-0x000001991839C000-memory.dmp

Download

memory/5340-90-0x00000199186D0000-0x00000199187C4000-memory.dmp

Download

memory/5340-91-0x0000019918590000-0x00000199185C2000-memory.dmp

Download

memory/5340-476-0x000001997EC80000-0x000001997EC92000-memory.dmp

Download

memory/6816-475-0x000001FFBB700000-0x000001FFBB7F4000-memory.dmp

Download