78c5f5f69039203ca286b4fab31b9aa0ef27de474812201b14b007d48f5e4a6b

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Receipt Voucher.js
Size 1.6MB
Sample261110-mk5kdsef66
SHA256 78c5f5f69039203ca286b4fab31b9aa0ef27de474812201b14b007d48f5e4a6b
MD5 ad279593082e2abcacfc0d31aed2aa1c
SHA1 7c7c8afb3b5cef92d4df11bcce01348ec78c5e8d
SHA512 d468cc724affe09b51b6f5a72fffe060187781d9b352823725735dd66d9ad5a44a75903eed3cc8ba9936c036a555feb75b0f3576055c885f3c50601a09dce0ed
SSDEEP 24576:O0DR4MrdpZ5okVdcWwC/LjJzuPSD2OtdKIql5TD4u+O3LbU5UiP1a4hJ:dR4Spzz7NzuPjsKlTEO3U5P8cJ
TLSH
T1898502B648856F778E6C791581791F0DFFA2095BA0FBA554DF27EE8AFBA34004307062
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution spyware stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1516	SetupService.exe
5960	SetupService.exe

Loads dropped DLL 2 IoCs

pid	Process
1516	SetupService.exe
5960	SetupService.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 47 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key opened	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	SetupService.exe
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	SetupService.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4476	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5976	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SetupService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SetupService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SetupService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SetupService.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1020	PING.EXE
4692	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4584	chrome.exe
6072	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4692	PING.EXE
1020	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
4144	chrome.exe
4144	chrome.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
5316	chrome.exe
5316	chrome.exe
5316	chrome.exe
5316	chrome.exe
5316	chrome.exe
5316	chrome.exe
5316	chrome.exe
5316	chrome.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
1516	SetupService.exe
5316	chrome.exe
1516	SetupService.exe
5316	chrome.exe
5316	chrome.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	SetupService.exe
Token: SeDebugPrivilege	4476	tasklist.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeDebugPrivilege	5316	chrome.exe
Token: SeShutdownPrivilege	4144	chrome.exe
Token: SeCreatePagefilePrivilege	4144	chrome.exe
Token: SeDebugPrivilege	5960	SetupService.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeShutdownPrivilege	4904	chrome.exe
Token: SeCreatePagefilePrivilege	4904	chrome.exe
Token: SeDebugPrivilege	4904	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4144	chrome.exe
4144	chrome.exe
4904	chrome.exe
4904	chrome.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 4700	3924	wscript.exe	89
PID 4700 wrote to memory of 400	4700	net.exe	91
PID 3924 wrote to memory of 4692	3924	wscript.exe	92
PID 3924 wrote to memory of 1516	3924	wscript.exe	94
PID 3924 wrote to memory of 1020	3924	wscript.exe	95
PID 3924 wrote to memory of 5976	3924	wscript.exe	99
PID 5976 wrote to memory of 4476	5976	cmd.exe	101
PID 3924 wrote to memory of 5960	3924	wscript.exe	102
PID 1516 wrote to memory of 4144	1516	SetupService.exe	104
PID 4144 wrote to memory of 5316	4144	chrome.exe	105
PID 4144 wrote to memory of 5364	4144	chrome.exe	106
PID 4144 wrote to memory of 4584	4144	chrome.exe	107
PID 4144 wrote to memory of 1388	4144	chrome.exe	108
PID 4144 wrote to memory of 1628	4144	chrome.exe	109
PID 4144 wrote to memory of 3192	4144	chrome.exe	110
PID 4144 wrote to memory of 1304	4144	chrome.exe	111
PID 4144 wrote to memory of 3448	4144	chrome.exe	112
PID 4144 wrote to memory of 4556	4144	chrome.exe	113
PID 4144 wrote to memory of 1144	4144	chrome.exe	114
PID 4144 wrote to memory of 6072	4144	chrome.exe	115
PID 1516 wrote to memory of 5316	1516	SetupService.exe	105
PID 1516 wrote to memory of 5316	1516	SetupService.exe	105
PID 5960 wrote to memory of 4904	5960	SetupService.exe	118
PID 4904 wrote to memory of 2156	4904	chrome.exe	119
PID 4904 wrote to memory of 4756	4904	chrome.exe	120
PID 4904 wrote to memory of 6072	4904	chrome.exe	121
PID 4904 wrote to memory of 5772	4904	chrome.exe	122
PID 4904 wrote to memory of 4252	4904	chrome.exe	123
PID 4904 wrote to memory of 1860	4904	chrome.exe	124
PID 4904 wrote to memory of 5404	4904	chrome.exe	125
PID 4904 wrote to memory of 464	4904	chrome.exe	126
PID 4904 wrote to memory of 3304	4904	chrome.exe	127
PID 4904 wrote to memory of 5408	4904	chrome.exe	128
PID 4904 wrote to memory of 1300	4904	chrome.exe	129
PID 5960 wrote to memory of 4904	5960	SetupService.exe	118
PID 4904 wrote to memory of 4964	4904	chrome.exe	130
PID 4904 wrote to memory of 5796	4904	chrome.exe	131
PID 4904 wrote to memory of 3568	4904	chrome.exe	132
PID 5960 wrote to memory of 4904	5960	SetupService.exe	118

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SetupService.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Payment Receipt Voucher.js"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3924
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:400
- C:\Windows\System32\PING.EXE
  "C:\Windows\System32\PING.EXE" -n 3 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4692
- C:\Users\Admin\AppData\Local\DataCore45\SetupService.exe
  "C:\Users\Admin\AppData\Local\DataCore45\SetupService.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffe856ec728,0x7ffe856ec734,0x7ffe856ec740
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1672,i,2052809613503432003,12473052999275490825,262144 --field-trial-handle=1912,i,2931585995845944141,7840946579138184021,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
      4⤵
      PID:5364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh" --force-high-res-timeticks=disabled --metrics-shmem-handle=1972,i,14419282815632251822,14940170751526406937,524288 --field-trial-handle=1912,i,2931585995845944141,7840946579138184021,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:11
      4⤵
      System Time Discovery
      PID:4584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh" --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,15646907654975922138,7809470303285679104,524288 --field-trial-handle=1912,i,2931585995845944141,7840946579138184021,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:13
      4⤵
      PID:1388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2984,i,3941091969808216610,8286452001452420693,2097152 --field-trial-handle=1912,i,2931585995845944141,7840946579138184021,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:1
      4⤵
      PID:1628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3000,i,11980172577032054395,4643367639245594079,2097152 --field-trial-handle=1912,i,2931585995845944141,7840946579138184021,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
      4⤵
      PID:3192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3188,i,14866692158916681277,15158023779809455858,2097152 --field-trial-handle=1912,i,2931585995845944141,7840946579138184021,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      PID:1304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3196,i,3799405326350042051,8173383227705918373,2097152 --field-trial-handle=1912,i,2931585995845944141,7840946579138184021,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:9
      4⤵
      PID:3448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3736,i,921193681921088358,410410966138323230,2097152 --field-trial-handle=1912,i,2931585995845944141,7840946579138184021,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:9
      4⤵
      PID:4556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4324,i,3281019431091261513,11490838874095342157,2097152 --field-trial-handle=1912,i,2931585995845944141,7840946579138184021,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:1144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh" --force-high-res-timeticks=disabled --metrics-shmem-handle=4380,i,15125278899844404599,6330589977299566976,524288 --field-trial-handle=1912,i,2931585995845944141,7840946579138184021,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
      4⤵
      PID:6072
- C:\Windows\System32\PING.EXE
  "C:\Windows\System32\PING.EXE" -n 4 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c TASKLIST /FI "IMAGENAME eq "SetupService.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\system32\tasklist.exe
    TASKLIST /FI "IMAGENAME eq "SetupService.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- C:\Users\Admin\AppData\Local\DataCore45\SetupService.exe
  "C:\Users\Admin\AppData\Local\DataCore45\SetupService.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffe856ec728,0x7ffe856ec734,0x7ffe856ec740
      4⤵
      PID:2156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1656,i,2254482504929620292,10361657835526315208,262144 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
      4⤵
      PID:4756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1800,i,12180182075295606154,11517465065707025053,524288 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
      4⤵
      System Time Discovery
      PID:6072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --force-high-res-timeticks=disabled --metrics-shmem-handle=2116,i,12199712991341670408,3977200230526858078,524288 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:13
      4⤵
      PID:5772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2944,i,1850515279424341193,5870470180405511213,2097152 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
      4⤵
      PID:4252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2960,i,7749748097187249514,3137580438717694716,2097152 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
      4⤵
      PID:1860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3232,i,4135311979513212969,4212032220128277742,2097152 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3244,i,1046881512804800488,1249847333951327628,2097152 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:9
      4⤵
      PID:464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3784,i,5792716460278443824,15520939691380688666,2097152 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:9
      4⤵
      PID:3304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4244,i,17428684499008417396,7843277292948815649,2097152 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:5408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --force-high-res-timeticks=disabled --metrics-shmem-handle=4348,i,12188094042837652234,9788250803362395546,524288 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
      4⤵
      PID:1300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,10482893744971523651,15929681417511077623,524288 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4924,i,4884195140572293522,17392255658011201727,2097152 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:5796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4944,i,8081293764502184932,2806147388846862585,2097152 --field-trial-handle=2068,i,15395495245009088692,4624486405631083446,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
      4⤵
      PID:3568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SetupService.exe

Path C:\Users\Admin\AppData\Local\DataCore45\SetupService.exe
Size 843KB
SHA256 fa809ad9f8608217b34e5c7f751d37f033627ebd358561de6f084aadd236ac3d
MD5 303f4ed7532fb53e8b94db453c139ed5
SHA1 c792f341f3af147c1862f9b240c43acabc295df9
SHA512 e498b08543c7b05a143819d3c9f0ca9cac67d479534e037dae15ab4a09ccffb435dc7a12eb08965de34af8e99b0f84b51e966f3d7a3680368041f15110f1f9df
SSDEEP 12288:LEgt6cTRNKRi8eMd65PE9UU0jwHORKWjT4iqQ6uagedvpbaq80vw1tWi3Xb7Obav:4gv7KzCkUU0a6Pjh6FgepNIDWi3POev
TLSH
T1C9052300AA956F16CEBF473461F75A9A8A7AEF4310C9BFCB47939F931E527728C09401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

amsi.dll

Path C:\Users\Admin\AppData\Local\Temp\8697de9f\amsi.dll
Size 1KB
SHA256 23a359ddb243a4a08b511159621bcf044aaf93809e4fe5627f509ecd0630536c
MD5 6e329d609d0adcc091a8fc754587694d
SHA1 e25fefd915aebe217c99d91ea65e5ff31efca010
SHA512 23c94facc67781f6dca48e402689c056bfb3cd3df99817a97d0236815cf1659354a41b3c232bd715bff2aeca413aedef6bfb7e012ae7f036fb6115f851810fe8
TLSH
T194317D106AB4D7B2C01C52384893060566E05080D7DED2017F6460772C075D13C31F99
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Crashpad\settings.dat
Size 40B
SHA256 7ae22b94634d6f6b76596ab79019a6c1685d66918703054d9937fef42cec7fba
MD5 e086841ffa50676ebab0d76813c801f7
SHA1 2419f0dd91b8e9d6d4e51ac139e20835c752e1e8
SHA512 20f7616678e83b159fffd0326a285867d107ece32395b3e841ab66ed29253536ce96aea8330b0a624bd36194b6f63355a6137fd151e036ef0be08687f64c0e7f
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 69ebf728ec0e578e2c2038445b9d24174f5ea75cfe22f909c96fe0d91ba596a3
MD5 c2cf35d441756414e2b967fa6a53dbf0
SHA1 7f848a1d370ffc3e6becc81e8cd978cd2776ea12
SHA512 6a634225d5b12d53cd813c0c55aa3a09a7235609ea9deb71d83393ee6ff42fd942b9433902ec4f89c590a38a6985d43b0f238b9b27827241999d514130deb0fd
SSDEEP 6:/FoEXEg4EQxCa9ikNUxHwCa9z5czC94uXB6zuHkllaBY:d7XXJQEwNUx5UuzCauXB6zuE/aBY
TLSH
T10F13123DD5D759E2C3E0107C690F27325B308448F51B57134C69B01A39D9210264E447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 148aa3a26e3f777cd293450f1aef136e119e3ab5134f37d00795098f289a9858
MD5 9dd2a899e0d56175f8a0a6775006796b
SHA1 68b6bf9b98e912b68fc3b3c104418e7a6e34f8b4
SHA512 a0f46b9a71e23703bdb668cfa1a10fc911b3f089065091f51b36e74e32130c3dac794df21a3667139e6a128b6ecf03e4322f981fd1bc19741ef8b05da19c6bf0
SSDEEP 48:GLSYVzGEpSDeM1XghboD3y6MmXL8XIdVEPLVBKWwtl:srVz7pqeughq31jL8mVOLHKWol
TLSH
T19744B7F71805EAC6E725CBF46C81A33CCD3356123C99BFB6E12444A215919E731288B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 cf0e86b6d3624cb2114561fad553cf7a33c523ba8801a162dc7cc2393fa24cd8
MD5 a019bc181a474a6a70fec1c72bb83589
SHA1 06d53ea1d7ce7f4234a23157a0b79f54243c7ef8
SHA512 3cd7932b0ae3546c7615d162fdad843b866a8d569131f927d855e1783b6fd785a6ad1ca3e7d84ff96f822b5fe519fe4dfcdad12cb52f3ab4053188cf74924d2c
SSDEEP 768:JUfDPLSgcRUv+8UfDPLSgcRUv+1UfDPLSgcRUv+PfDPLSgcRUv+RxqLq6q:bs5
TLSH
T13225E89A0F186EC7D792DA70EEC5CD683DBC2299AD979C83A04186B654C7FC10F8174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 4ab8f102a66fd7394e45c727e4e1a151ff1651815692cb9c0d66f80cbefa5c9d
MD5 8f8bb61e720ecca0d752733838191113
SHA1 0e277d629c8a420dbb8dd95ea432361309324c90
SHA512 97874030f97aa78c174c168f711b597b8da096874e02467c27af3ae015b5676748905a5eb8952dbe23f47d661b5e53124d5eaf0d2a3e785f3eba46e31741bb39
SSDEEP 192:NywhkVudDoeTSK2jCEzmsjVK9jlPCa5ljoJBmR:NdkVuN9OKpEzXjqlLljgB
TLSH
T137168E11B19EA460F40A7837640D3EA6839E4821ED67AE05B1247D324DFB461EEB47EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 745c816c4e5eb443cb530d66852b501a568e8bcbb76a0906f538263a9a069fb6
MD5 66272adfe1635345eb4d24a67ea06288
SHA1 9a8dc7c602945560cc3be62e3842de684f37e6f8
SHA512 de6e87b635d318f0239113f6b885234738e8fbd276c429977e026e7a88b7c54f6f37f101e5e62a33b6a5c2409d61a4117bfac17c6ff3df0ba5db9dd37f50ed2e
SSDEEP 768:pUOE17pqeAP8cH9h1C+cvxm9Ec0fpePYgTJifQ0663f2hcVT22yflIY:JEPqe5qCxxOEcxghv2hck2cIY
TLSH
T18103F11B0419E652CBB8F432A97B47E7A64F472F9E60EDA4DCF5DCA378E8184944380C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Cache\Cache_Data\f_000002
Size 78KB
SHA256 e35e5dcd69d2cef0eb8d0c70954e33c271d7455704fd05c2a2e1d12fa42584c3
MD5 3eb646c53642ded8315b91770e2f1d7a
SHA1 3dd89b63de3c47f5841b02f0fbb8ea9f50169583
SHA512 962cc14a1f6fd7481e506985b17b0f6373ca0c94d0fedec0e461b17b84dd9cd900db8688351deae61e1fe033f8a6d74999d70ac432c303ec1399e86e8ee3f4fb
SSDEEP 1536:+Q3yhf6qdIjJvoibt1mk2W7sPyDuhjwMZ0wwNHpqhEaVf8:+Q3BqdYV1mkYPyDWjb0w0HAhEh
TLSH
T10F7312F451E0F9BD51FAEE67CF95C38606DE865EE1CE2908EE1190730F0ADD850A115A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Cache\Cache_Data\index
Size 256KB
SHA256 85dacd5431eaa8f561c56e289454441d2cf0ffc8bb0423b9caf078fa4d5b0824
MD5 c066e35a97b0aff832ac965b7f782dd7
SHA1 8bdd4c191ac7806309cbddf5488d78d048738ceb
SHA512 83ed38b7d6077717e8fff4786ce8b0b7e0bce985c439ac226655f893545cdd5e26433973b5afb836fb8bed62df6223eb09eee55703face67b837397faa5c6821
SSDEEP 3:LsLllFlklNllklkXlzoflkrlllollLll/nt/pNtl5llll/2Ntl6NtlglNlXl:LsRa3lPigufxtlll+NKN
TLSH
T1F144126E53410F01C3C001BCC54787103334C014CA6F8303070061102CC13A03D1F090
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 ff95af45d1555fee1d40f189f2cf4039ded185a94962dee4fbc4ebe9ccbd330b
MD5 c0a018cdc408992aa023028d57c91ab7
SHA1 67405846f67d0c1882becb03a78c7b23b96ebe4f
SHA512 e31b836018e2227239eb48519d5857f4784ead313035436bf759f576f81570bf4127a29af99bc6758ee3a63b007eed12c053af221d74c64da5f9f69235fccc2b
TLSH
T15BE02B81874C0F0DD32D96F7CEA603044A0A43C429FE7603A880C2C273525241248123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 afaf976d85b3ea768d1706f2d7bf2dd7cfdc0c09fef0a55de0d5655a9e6a6777
MD5 0f83e4f3985d83b6198652960a803a49
SHA1 f57c9cb3ecb9721066b1c1026756fc34abd9500d
SHA512 ebba3c7a8659a5275e3ecdf6b9826a40dbbd430404f5237a9052cf5a6798a795eb7cd28a5c253f06187f5daf22f5f08f298ddba5efd528be48f3249395eb5f0d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 316698974d75dd9018176137f7aef0ef3f11026af3821fad9aae8e03b313f1fd
MD5 b614094b7bdb5e739c46747fa0fedc3f
SHA1 bc2619c40b23324b60835eb519d82722dfe0796e
SHA512 aa34a549df084e28f623f19f7ac221f4c3819e92db6bf5c1827cbce6da9f34152bf2792b66920a8cc6f7c652c4f846892dcf58bbb0b571c2b8c5bd5152f56cdb
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\DawnGraphiteCache\index
Size 256KB
SHA256 bde9df4388ca8e02914e42e6acf98fc7cebf065773482cffa9bd5029372608ac
MD5 89b6677b340186ed1514d0c81d831fc7
SHA1 daa8e3cf52f0f1dbe8bcf47dbe53da2aea2f8244
SHA512 b579ac472aace7fac294b35a3b3109821340e56536bb18117aebe032dd5a2a7a22962474f0639110455886cc7b42b3cd38bc62e0fb8f167dcfca9b68d96b5afe
SSDEEP 3:LstlNllklkXlyEfltl:LsX3lPXflX
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\DawnWebGPUCache\index
Size 256KB
SHA256 d030ed4ba4375860dee07cc741f38a4e3f1b2d72637a05d11c3a6709f83a82c8
MD5 d03a38f6028b51acfecfdd7a229850dd
SHA1 1f46082a84f20ef007771406eae33abefd659bdb
SHA512 470e4b7e91e8df6544f435e5164687e3ced47b5d372636c8c0a14a553f9dfedd136078efb6861fec0904e601f686d4aec75fff9cb34a44e4878db42c9931b002
SSDEEP 3:LstlNllklkXlXql:LsX3lPXe
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\GPUCache\index
Size 256KB
SHA256 03e2c8ce04f347fb4966484db240e680043fee015bfb01c2fd82780e7d6c6346
MD5 4c84f13f60a1dc7b007842fc2af67299
SHA1 08301ceeb3e5c0d5a5908dfb3de69575a59302c2
SHA512 72bfccfdf0ec2dc20229865735c79a35f65f20deb51cdc72f138333e9798ec719e269b3c8bba34bd607454e360714a2c0afe3df635c0dc46e76eff8cdb5a0bf3
SSDEEP 3:LstlNllklkXlFQKXl:LsX3lPFQK1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ffd6aebec5e8d5f461d085207508bf682319bebc2b6271a78de816f1816ef94b
MD5 b59b9af7bed9a8224745105527e531d3
SHA1 7a54d3d90ba6f5dc73d33bb32e4529945a364cce
SHA512 11111c5bc365a9f8782b1beaa1150ac1efe77add5eef22ea57f83fd3f1cb0dd901a5c70b1f5a0f9a8f68db991434e986f30fde8b31546b229857fc874de33d4a
TLSH
T180A0025543899522C10223F028818398B220B965924247137EE003B7CCA06555911246
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 e5852b14b49def4abdff9a45974839582d16557281a7369d1aba07cb553cea3f
MD5 cb8aa81a60bd82c50b2d9158f0bc5fc6
SHA1 0791119e849d9f2aec3ae1ab85222fabdfa72182
SHA512 7e515ffdb36ef01579457c2c43b4da03cc0d9996cbd5c41b9b56c83f9f92a44f9f2542f69768b2db4c2ef8be7330ce17a7422ee0b8e5341c285d033577399ae5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\ShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\g10xbrej.dgh\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

kxd.txt

Path C:\Users\Admin\AppData\Local\Temp\kxd.txt
Size 141B
SHA256 84a2349fd4e28bbce1eeeea03d10fd63ac82eaf323c148729a3867aec7b98957
MD5 bdd08038fd8b6cd9e3b42f3b0d97eac8
SHA1 fec56249fa9fc373266a12298e1cdf577eb60954
SHA512 d576fb66cd75722f81cfeba03bb772ebf7a49ea5a56cbdbd945741bad90e520b644df817aae0bda89bb6f760c8b10c21952afca8060eddba04ba24dd8b4dec10
TLSH
T135C08C36C09F902A180A81C309FD894C8071080A3B8566028300C0082084C6CE2C3022
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\skl1zrbr.rpc\Crashpad\settings.dat
Size 40B
SHA256 2dc755a2a52222718721d8f6a5aac4de68e225c178005a6bed045cdb3b02636c
MD5 6d1f6deb41ec6fa1312a54ba2aabc1fc
SHA1 6e0378a1804873c17de322b3c062d0af1b471745
SHA512 373497bea12ce34f7b205ea3a44e98d8fc975817a43e27477579fc59c8ec363d1431fe9ba16b49eb94f1d21f64350380b68948d04c01b0d81b92fe9be91c4774
MD5 SHA1 SHA512

Submit Download

memory/1516-31-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-26-0x000000001B590000-0x000000001B668000-memory.dmp

Download

memory/1516-194-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-38-0x000000001CF00000-0x000000001CF50000-memory.dmp

Download

memory/1516-34-0x000000001C9E0000-0x000000001CA16000-memory.dmp

Download

memory/1516-192-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-33-0x000000001C500000-0x000000001C5E4000-memory.dmp

Download

memory/1516-32-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-184-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-30-0x000000001B770000-0x000000001B7BC000-memory.dmp

Download

memory/1516-29-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-28-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-246-0x000000001CD40000-0x000000001CD52000-memory.dmp

Download

memory/1516-27-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-25-0x000000001B510000-0x000000001B58C000-memory.dmp

Download

memory/1516-193-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-24-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-23-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-22-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-21-0x000000001B340000-0x000000001B40E000-memory.dmp

Download

memory/1516-16-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-15-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-14-0x00000000000E0000-0x00000000001BA000-memory.dmp

Download

memory/1516-13-0x00007FFE8A74F000-0x00007FFE8A750000-memory.dmp

Download

memory/1516-263-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/1516-264-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp

Download

memory/4904-430-0x000001B8E4860000-0x000001B8E4944000-memory.dmp

Download

memory/5316-195-0x00000296336E0000-0x00000296337C4000-memory.dmp

Download

memory/5960-265-0x000000001C7D0000-0x000000001C8B4000-memory.dmp

Download