d22c47a0ec8719852fe2f1f295eb67ae2666d8d09edbbe7412e5208816be7765

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Signed POs for 500 kg and 100 kg Shipments.js
Size 788KB
Sample260908-jl2ckstybt
SHA256 d22c47a0ec8719852fe2f1f295eb67ae2666d8d09edbbe7412e5208816be7765
MD5 2b30c1d4c01cba4ba4bed0d36c73b726
SHA1 106bb6995cdb33e67e5605b11f9f323dad566457
SHA512 42c1b0272cd343d4aa698d5517db9306fc393b3fb41adfcad58d1afeb46d14a1f18502cfd727fee88a2b5111b12c9ca27b97291cb15715944c4f631ef097c21e
SSDEEP 96:eZ+A49OxmDxn8JfNlzYcivak3CrYkqGaNtAJ5sUHHwaIOYAkOJ4bTov/J7af5JNj:eZ+AYPtVAJEVwLWH
TLSH
T1D405167782FD2F3EC4275658CE7A3C0C98B054A20B4EF47AED3764C5D97CAEA66A0150
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4612	wscript.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	4612	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	wscript.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2341.lnk	2341.exe

Executes dropped EXE 1 IoCs

pid	Process
1792	2341.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 39 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	2341.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	2341.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	2341.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	2341.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1220	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
3896	chrome.exe
3896	chrome.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
784	chrome.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe
1792	2341.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	2341.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeDebugPrivilege	784	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3896	chrome.exe
3896	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 1792	4612	wscript.exe	85
PID 1792 wrote to memory of 3896	1792	2341.exe	90
PID 3896 wrote to memory of 4644	3896	chrome.exe	91
PID 3896 wrote to memory of 784	3896	chrome.exe	92
PID 3896 wrote to memory of 1220	3896	chrome.exe	93
PID 3896 wrote to memory of 4380	3896	chrome.exe	94
PID 3896 wrote to memory of 5040	3896	chrome.exe	95
PID 3896 wrote to memory of 4784	3896	chrome.exe	96
PID 3896 wrote to memory of 3960	3896	chrome.exe	97
PID 3896 wrote to memory of 4900	3896	chrome.exe	98
PID 3896 wrote to memory of 2516	3896	chrome.exe	100
PID 3896 wrote to memory of 3316	3896	chrome.exe	101
PID 3896 wrote to memory of 3504	3896	chrome.exe	102
PID 3896 wrote to memory of 384	3896	chrome.exe	103
PID 3896 wrote to memory of 3044	3896	chrome.exe	104
PID 1792 wrote to memory of 784	1792	2341.exe	92
PID 1792 wrote to memory of 784	1792	2341.exe	92

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	2341.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Signed POs for 500 kg and 100 kg Shipments.js"
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\2341.exe
  "C:\Users\Admin\AppData\Local\Temp\2341.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff80ae1c728,0x7ff80ae1c734,0x7ff80ae1c740
      4⤵
      PID:4644
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1652,i,242633293719010033,1282075783955804188,262144 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,6987997426904685157,3977803742684557617,524288 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
      4⤵
      System Time Discovery
      PID:1220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,9987367126131696398,11463139538573915636,524288 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:8
      4⤵
      PID:4380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2944,i,12542853874716809935,547178826499810471,2097152 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:1
      4⤵
      PID:5040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2948,i,17662043160220500035,17065837699224142958,2097152 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
      4⤵
      PID:4784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3360,i,4098340317776097225,7031601197977667174,2097152 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:3960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3400,i,13607358806081189400,18214995715061256501,2097152 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:2
      4⤵
      PID:4900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3996,i,11674724380773115427,4493074652395732147,2097152 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
      4⤵
      PID:2516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4064,i,11699723213963092086,16937198010307938446,2097152 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:2
      4⤵
      PID:3316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --force-high-res-timeticks=disabled --metrics-shmem-handle=4256,i,4698967566286265288,17460688361072196213,524288 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
      4⤵
      PID:3504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --force-high-res-timeticks=disabled --metrics-shmem-handle=3520,i,10486026924904771483,17822907423740954424,524288 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
      4⤵
      PID:384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo" --force-high-res-timeticks=disabled --metrics-shmem-handle=4336,i,12712818842940635361,4890684464947589801,524288 --field-trial-handle=1672,i,3957870039954665094,9546978015963142712,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
      4⤵
      PID:3044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2341.bin

Path C:\Users\Admin\AppData\Local\Temp\2341.bin
Size 3.9MB
SHA256 da68ec390448b2f1cdfc843605f71750fecbdcbe7b24372f65dbac5a2fa8da2d
MD5 68e19beb041983431d2f4a50ff5746ae
SHA1 e21e97c96fcc7b96afca45bfe88297e8ee23d547
SHA512 5a6755c749bd83ef40f1a7fa598f3a388b41fcade2bdfa54144f5d4a4b8784852f7ce00788c468e6803cfe0387294dd21594e89a0dfd0a8fad2993e26d7f2cf0
SSDEEP 98304:SF7+d6zvR8MBh/jX5VNWnqyelM5VwxZesc44gBOWgNoDdfoF5v:O+d6L+uN7XNCqyPKtBOWgNoJfoF5v
TLSH
T1E016D03928D12195F3ACE6B05750E2365D38A3DBFE14FA9B613EFD159A31023AC26D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Crashpad\settings.dat
Size 40B
SHA256 e9c37b8d9a3aa58af8500a93c4550c6ddbe49c250ce96db5b469c0dc77784f47
MD5 ab9a6dc4fc155eb5f1d5e689f4f530a9
SHA1 fc1b775ec893b63177d263bf8336f2a6148bb83c
SHA512 d9d2359b8691cc7265df33010096909b1ec04eb82c99f68bcef59187e5b242c5204b87e8c610bfebe42d6828be87a68d2ca4ed161781b356abb6017fd4cd72b8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 493d2dc0cb66688faa89ad048e1e368e6b7f9d8e945724ec6caf4b03bd60893b
MD5 877d8533824729ea3fefd9c2e5610dd8
SHA1 bcaaac6759fd5da5a2f2f28cf707261131686619
SHA512 13814682caa014fdb5b534942a75f68627bfc5f60820a064b52018df3eb0278b11cd5d48e0f570ee3605d633414cba3e1fe88a2d316812c8aa29c69b0575c376
SSDEEP 6:/FoEXEMsweKw+oYiDwZSajgJHY+g4ErldtE06ol/IR5:d7XfsKw+ohEZSg65VEx/zLl/I
TLSH
T10E135B7D85410E55DAD5143C496727F25372A448FE798D636121F0162186732211B557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 4a4a33da8ed0902cc97e4850fd2de93febc009007ada09f8050813eb4769b04c
MD5 6d84cbc8e729a30df97661fbc93dfb19
SHA1 0ad0814f6ca1645a20bcca1840afd250f782a16c
SHA512 edd175b61425a4536db8a1353367e6a9a590f2e47bf2428fa43a81cc88429eb30fa323576b7032f7e9105b3674eea42c3ab0cf2432452e299af7a40b356963f6
SSDEEP 3:MsEllllk9/YtlGallg//llNmSjl//lnXR0D3uSR0D3uSR0rSLIivOiEH6gGl/l:/M/PXGuK1V5/BOzuSezuSeGLIivOnHC
TLSH
T127442BFB7D000076CE1082F10000733C853251189DEB9FDDA00408B3C480F1004104E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 8b9a36a4c928168413ea510d07d012097132b0626ff70048dde36d194418a6c7
MD5 e0ff7689d50b44af91f30e8fdbdf14a0
SHA1 f15a44a912ba9e3adaaa22e5abbc2206be604a82
SHA512 d02eaf7eb0edd22aacbc0217b6bf4c1334e37322f14fe382b0574268b939e3b12aa3ea29f6379baad2b18fd442cb6d91b6494d2e766f35907bbafc7c7b6843cf
SSDEEP 48:T4flMyYSP3zlblbX/ZlM1XghgmMmXP/dVEPLVBKWwtl:TieAhblL/ZlughgmjP1VOLHKWol
TLSH
T1C24498FB5C09DDC6DB19CAF41C41927C8D3256163CAAFDB9F17884A201506E731285B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 c09c4f3659878121b59ba0da7c1d86ac9f16ca9fd780e36f215c3d417363aa3b
MD5 e9991ee7b2408e4c2a5077989cc88878
SHA1 b02b9f01b8c82cf5a3def7208744484861284e7a
SHA512 1ab4e9658d42c70edc24c95853023a1a7d32e7c6670f98c5f7473ef0dafe557ec4e734f0dc8864b889b7474fbceab49411df1bb8bf7da240f480181ceef34216
SSDEEP 768:PUfDPLSgcRUv+r4UUfDPLSgcRUv+C4IkuGL5flddrx/j2odUfDPLSgcRUv+U4GfX:JO+JLtldp52n4B1zdx0bdq
TLSH
T1F5168DA25F28B942DA85EEF0ABCDED2C3C702395ECD35C92F512926949E1FC10BC515E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 938f14a8946a8b4978afd388b066108daa11690bc281758a359f7bc2b1eb990c
MD5 36e0dfd513e7da11f138746375ae322d
SHA1 a6d0166fa9e928d5099fda1dbba4c75221c2822b
SHA512 c484e95124f56704969cbf9a0f055c5150cb53ca25f01dd009784cd8f6e39c2e080a5c54625ace5d64a6851f63d2b62ff238cb6f56458d332323febeacf9648e
SSDEEP 768:HShGO1M10R7gIPMdRdnZJMk3OGCsbe0QbGkwA6484gj3HXxp4J4Ufos21JM:yhGMcIEdRdnfMk3OG1eRbC481j33xp41
TLSH
T1D003F14663FF3B2746D598D305012A63B1443C896543E4D779EEE72845ACE0BE03CAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Cache\Cache_Data\f_000002
Size 73KB
SHA256 fb9acea2fa7074cb3fdebf730adefc33c50367f8797af574901352caa814d779
MD5 15dcfa016684da43289216097cb32bc9
SHA1 4ec5fd9945ad55bea83d3b1e35238beb22c7e2b1
SHA512 24e4b2dc585a5a5c6bede5e1b735fb29c728b671afd88522030538be26c371519d7cd88cc57478eb8dbbda11fb761723dbf8669d7d7c9246395d6c52cef44948
SSDEEP 1536:fFe/4pJ09FbrtybC85RChT7HvY2njBfDTYubbnsge+oj:HcDfzjBfJbq+W
TLSH
T12B73127866985FE441A83CB93A54E5E2845323680348F1EEEF13C549D2439CC7EEDEE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Cache\Cache_Data\index
Size 256KB
SHA256 b61915a3d3fae2035637bf802a6c4a1c995b66a998a129a13d6b44f55fe959a1
MD5 1a4cfb7e4c7524f7941a20302a85fc7d
SHA1 c69f6691fe1490a0040acdfdfb72c9b6df0ff2de
SHA512 0503e8f8afb5448383ebcbfedb35bc4091b3f3a0c5736cfa57c3c0e0255387dd8c33e88e5cbd2261e858872623381db656b284966ae1041a59ce5c8e7f17e1e3
SSDEEP 3:LsLllFlklNllklkXlqztlollLll/mltmE/b/GNtlNlXljlZNtlQl:LsRa3lPqzI4MEjON9
TLSH
T1FF44025E57824E49C6C006FC84474B64733CC544EF5F83530345B5152CC17A31E1F555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 73fe179eeaf9ba2fd505d4c090e8ec6d24ac2b9edbfd7d64a532d7f11459f512
MD5 1c6b344fcb461bf24d8ca7ebe7df1b4b
SHA1 8dc2956d13bd15b2fc51130a2b66b2778714f8f1
SHA512 34764f0f3c2179450f9dd588cbce296486ce7b728302dc06aada1700f599fd4c5d5d0b7b8c5adc43fd0c7463217ea2bb4896984abca51e4b60333283e392815c
TLSH
T1D9E02B91824C1F0DD32D96F7CDEA03058F0A42C42ABE3A03A980C2C133524241248122
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 66567e51ae297a591937fc95ee9c45f563e90f9612f7679d14eea8e76a9d2b66
MD5 c86b7b113f0f2d25ec910b4ea7dbd41d
SHA1 ae0898639e4637cde812e5997d66d8db752532ef
SHA512 0dd81614b456afae38133c0436744408aa070e839f106c796a48ee39008c89be816447c3dd3923127d94a89340be90903281c244868cdbadc783269fb4639a12
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 3dc879c3ff249b4eac54f1b9898a9d7f593cbd9b10a39f8b276ce8f5a4f3ba43
MD5 53c9a27f83c2e3d22d128f2045685ad7
SHA1 d9278159b25e4bea68fda33f19798c87e75f9a28
SHA512 809c2cd199afefbde903dfafa1c6d18eda4f6d54a064a6fc3cfad82e4a7e8fad6236e3de413ddd6cb49da1dc594187c4c7351f8e32ac14edb05f430a320ffabc
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\DawnGraphiteCache\index
Size 256KB
SHA256 da8a2e5dac2cb41a6a77d3a5f96a1738adf96fddb6b3c95e29edbcd23a665aea
MD5 6276755ba7b327a8047a883eb6a10ad5
SHA1 a80cba5739f340d97cad952cc721165415131f6f
SHA512 a20c8e0ae4905ad1332fdec30284f2ea5d62c8f802009dbf7c49c768bf883eb61d4599e3c02ffb5a33cc531b9f4e1aea00668bdc24476366849d22c6b96759a2
SSDEEP 3:LstlNllklkXlO+/l:LsX3lPOul
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\GPUCache\index
Size 256KB
SHA256 01b2558daa3a0fa91f1a0e8e6c5a92db4c3324f617444fc84ce3c4b7548b2076
MD5 3b2a00b8f5204d3207c715bc9d0c0b80
SHA1 360aa594c6304a6f7445f4caf0893f646274c464
SHA512 b8861e88906ed9768ab0c3d3b658acf5e7c4c4faf9673187faa1bf9c0f3c97868e8ede8940996ab6329af97eddf8ceee5a8b1f4389410c2f5fa28f71c5755955
SSDEEP 3:LstlNllklkXlmt7l/l:LsX3lPmt7tl
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

logo

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Search Logos\logo
Size 8KB
SHA256 8533a4a5dcd1b946bb61feb2ddac755e324dbef11c8a597705c3457c30384a84
MD5 2a3d664ad9bde4a1db6b593ae1a9ffc3
SHA1 a81b83e4792d8229075bdefe56c3aab1796d305a
SHA512 7a91e61d0372bfdf744e6de3b828e503d81686415664eb42f307bf2d3579cf63cf8505a39c2ee6b487ffc1f93999c01175a2117a56669343307c225a90f42fe3
SSDEEP 192:PQCgRZqnKiDrRnUt2ZBCwFUbj2uVV/Vz6VMLhLWT0vr2S:ICgnkNUtukZjx6kWTQrV
TLSH
T169129F140927F230DD2E53B9C02B9913A574AE088E86B397CA2DFD37DC7B1B7491C649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Search Logos\metadata
Size 1KB
SHA256 f992c8279621c5ee9e572c2467d8305cfb81e9338595402a524f8d6e7cc13c9f
MD5 9b25ea761bab49ba3806a70f027b1399
SHA1 a74cffaa7bbef847d7a458de78cf7d15b347f936
SHA512 4dd52633ab24929aca17d6ea99988170a7521afcabb6139a4c5dcac9ada8bbb934ef77dada1641d2a31e7614405272f44841eb8a270acd20b246d95b66ffe775
TLSH
T12D21CE932F0CC64B5BD062D2304F4F0DADFDA419B6587887D1A8BC6D1AC89122B0E6DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f5167f6ee30929c3eff3281eee613eb63a5d544bd5cb8d2125bd4ae9c3efc02c
MD5 262356c2befd5c73fa2f7a71c9f6cb94
SHA1 838465a1b4fa86c0c6a325b546a196951d55742e
SHA512 fe6e7fa9c2716baaba69e7b8d42f4e57026dc6d8e472722d816b8674de5bfa891e6fe7c64da026024e9b9eaad7d38d616125a6ba4c998417643fccb9f0ff8330
TLSH
T117A002214740D151C12802B07905E3885205FD268411076376E5838B8D610509911155
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 d57a7ee4a4f687299d30eafa7223e9aa5891bc3baf50e38a7b6cc7bc84461020
MD5 cc0566bd3c31d5b3a3cfdc173088956c
SHA1 203eff9477acd35530eafb3b8c849b3ae4427c4f
SHA512 e27a58cecb4d6a974b1cb7d1dbc31cf13b2e242466bfb498e37f453ae0b79a232c0bedb24ff7da9236c3e9938823498d06b5b13db6696765bb20f22047e3caf2
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\gwjzuddt.tlo\GraphiteDawnCache\index
Size 256KB
SHA256 e0e2818ffa1f8cc28c1dbd8f5443269b9ab225db8426a82d573f72b9424197b5
MD5 ae27f0a955528f17f15abd466f7a87a7
SHA1 81afb07cf66dd7080e92c0080a83bfefda9d48dd
SHA512 801f8819018419fb9b706d0e8943b423af031fe2ce0597fb02ff98f7ba11ae46e7c65b42a1a8c2caa46f55984fb0dbc5a8a287326547ba2ff2108fd830d1e3cc
SSDEEP 3:LstlNllklkXlaJl:LsX3lPel
MD5 SHA1 SHA512 SSDEEP

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 40B
SHA256 9ef91682eae794115b2ff873ea2478824597564d0fde9231c943664c9e0cd1cc
MD5 12a658db678d9cd3b1a4810bc32b7223
SHA1 f6485ab6b961b58114e3111bce19b9871c276d22
SHA512 2ea6c31628918d7990f024948f973e7684933ccee3577e59467dfed4020d9fc57f55a8d2ac2228c3471ddfc96bbe85ab6cbfa05af7b2d4cfdbcfc67bffebfa30
MD5 SHA1 SHA512

Submit Download

memory/784-373-0x000001D56AC50000-0x000001D56AD3E000-memory.dmp

Download

memory/1792-244-0x000002BD61580000-0x000002BD615B6000-memory.dmp

Download

memory/1792-229-0x000002BD60FE0000-0x000002BD610B2000-memory.dmp

Download

memory/1792-246-0x000002BD47700000-0x000002BD47710000-memory.dmp

Download

memory/1792-358-0x000002BD47700000-0x000002BD47710000-memory.dmp

Download

memory/1792-245-0x000002BD47700000-0x000002BD47710000-memory.dmp

Download

memory/1792-243-0x000002BD61490000-0x000002BD6157E000-memory.dmp

Download

memory/1792-242-0x000002BD613C0000-0x000002BD6140C000-memory.dmp

Download

memory/1792-241-0x000002BD47700000-0x000002BD47710000-memory.dmp

Download

memory/1792-240-0x000002BD47700000-0x000002BD47710000-memory.dmp

Download

memory/1792-239-0x000002BD612A0000-0x000002BD61378000-memory.dmp

Download

memory/1792-238-0x000002BD61220000-0x000002BD6129C000-memory.dmp

Download

memory/1792-427-0x000002BD47700000-0x000002BD47710000-memory.dmp

Download

memory/1792-230-0x000002BD47700000-0x000002BD47710000-memory.dmp

Download

memory/1792-247-0x000002BD61680000-0x000002BD616D0000-memory.dmp

Download

memory/1792-236-0x000002BD47700000-0x000002BD47710000-memory.dmp

Download

memory/1792-237-0x000002BD47700000-0x000002BD47710000-memory.dmp

Download

memory/1792-14-0x000002BD45270000-0x000002BD45271000-memory.dmp

Download

memory/1792-428-0x000002BD61660000-0x000002BD61672000-memory.dmp

Download

memory/1792-429-0x000002BD47700000-0x000002BD47710000-memory.dmp

Download

memory/1792-430-0x000002BD61750000-0x000002BD617C6000-memory.dmp

Download

memory/1792-431-0x000002BD616F0000-0x000002BD6170E000-memory.dmp

Download