purecrypter | 44d331ead0c797fb4d53497a36a4ef931742e513691f86760d80603b8108f692

Analysis

max time kernel
100s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
24/06/2025, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
transferência de pagamento.exe
Size 75KB
Sample250624-rfhmaatkw4
SHA256 201a6a8047b2621bf85356fa0ea76e3c6ce879cda9d2c5a319db5ce9e31ee8df
MD5 4100f3608069e521e6f49a10e820c3f7
SHA1 88b2e25d8046bcbf6948e7beb88fd8356e25aa17
SHA512 2fb4a4d689b7e6ea1403bdbb1be7e2d027d58528c1c286ec96d743f9dece3fd30638355542e9125972288f49f12f494d92f2a5de4de9f82fc5dfb1a058f92087
SSDEEP 384:P3L7V7R3nPLEmlhi4zUYfdwvIRY80+3U+Q25kFKO:Pn7PLdhiLmyvKY3kUfr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purecrypter collection discovery downloader loader

Malware Config

Extracted

Family

purecrypter

http://example.com/api/test

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Purecrypter family
purecrypter

Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	InstallUtil.exe
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3948 set thread context of 2676	3948	transferência de pagamento.exe	79

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	transferência de pagamento.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2676	InstallUtil.exe
5264	chrome.exe
5264	chrome.exe
2676	InstallUtil.exe
5316	chrome.exe
2676	InstallUtil.exe
2676	InstallUtil.exe
2676	InstallUtil.exe
2676	InstallUtil.exe
1544	msedge.exe
1544	msedge.exe
2676	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3948	transferência de pagamento.exe
Token: SeDebugPrivilege	3948	transferência de pagamento.exe
Token: SeDebugPrivilege	2676	InstallUtil.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeDebugPrivilege	5316	chrome.exe
Token: SeShutdownPrivilege	5264	chrome.exe
Token: SeCreatePagefilePrivilege	5264	chrome.exe
Token: SeDebugPrivilege	1544	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5264	chrome.exe
5264	chrome.exe
6128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 2676	3948	transferência de pagamento.exe	79
PID 3948 wrote to memory of 2676	3948	transferência de pagamento.exe	79
PID 3948 wrote to memory of 2676	3948	transferência de pagamento.exe	79
PID 3948 wrote to memory of 2676	3948	transferência de pagamento.exe	79
PID 3948 wrote to memory of 2676	3948	transferência de pagamento.exe	79
PID 3948 wrote to memory of 2676	3948	transferência de pagamento.exe	79
PID 3948 wrote to memory of 2676	3948	transferência de pagamento.exe	79
PID 3948 wrote to memory of 2676	3948	transferência de pagamento.exe	79
PID 2676 wrote to memory of 5264	2676	InstallUtil.exe	81
PID 2676 wrote to memory of 5264	2676	InstallUtil.exe	81
PID 5264 wrote to memory of 4800	5264	chrome.exe	82
PID 5264 wrote to memory of 4800	5264	chrome.exe	82
PID 5264 wrote to memory of 4384	5264	chrome.exe	83
PID 5264 wrote to memory of 4384	5264	chrome.exe	83
PID 5264 wrote to memory of 2812	5264	chrome.exe	84
PID 5264 wrote to memory of 2812	5264	chrome.exe	84
PID 5264 wrote to memory of 2064	5264	chrome.exe	85
PID 5264 wrote to memory of 2064	5264	chrome.exe	85
PID 5264 wrote to memory of 2704	5264	chrome.exe	86
PID 5264 wrote to memory of 2704	5264	chrome.exe	86
PID 5264 wrote to memory of 1872	5264	chrome.exe	87
PID 5264 wrote to memory of 1872	5264	chrome.exe	87
PID 5264 wrote to memory of 5900	5264	chrome.exe	88
PID 5264 wrote to memory of 5900	5264	chrome.exe	88
PID 5264 wrote to memory of 4000	5264	chrome.exe	89
PID 5264 wrote to memory of 4000	5264	chrome.exe	89
PID 5264 wrote to memory of 2340	5264	chrome.exe	90
PID 5264 wrote to memory of 2340	5264	chrome.exe	90
PID 5264 wrote to memory of 6112	5264	chrome.exe	91
PID 5264 wrote to memory of 6112	5264	chrome.exe	91
PID 5264 wrote to memory of 5316	5264	chrome.exe	92
PID 5264 wrote to memory of 5316	5264	chrome.exe	92
PID 2676 wrote to memory of 5316	2676	InstallUtil.exe	92
PID 2676 wrote to memory of 5316	2676	InstallUtil.exe	92
PID 5264 wrote to memory of 5252	5264	chrome.exe	93
PID 5264 wrote to memory of 5252	5264	chrome.exe	93
PID 5316 wrote to memory of 2676	5316	chrome.exe	79
PID 2676 wrote to memory of 6128	2676	InstallUtil.exe	95
PID 2676 wrote to memory of 6128	2676	InstallUtil.exe	95
PID 6128 wrote to memory of 1544	6128	msedge.exe	96
PID 6128 wrote to memory of 1544	6128	msedge.exe	96
PID 6128 wrote to memory of 6028	6128	msedge.exe	97
PID 6128 wrote to memory of 6028	6128	msedge.exe	97
PID 6128 wrote to memory of 3140	6128	msedge.exe	98
PID 6128 wrote to memory of 3140	6128	msedge.exe	98
PID 6128 wrote to memory of 5052	6128	msedge.exe	99
PID 6128 wrote to memory of 5052	6128	msedge.exe	99
PID 6128 wrote to memory of 1928	6128	msedge.exe	101
PID 6128 wrote to memory of 1928	6128	msedge.exe	101
PID 6128 wrote to memory of 5324	6128	msedge.exe	102
PID 6128 wrote to memory of 5324	6128	msedge.exe	102
PID 6128 wrote to memory of 3272	6128	msedge.exe	103
PID 6128 wrote to memory of 3272	6128	msedge.exe	103
PID 6128 wrote to memory of 1264	6128	msedge.exe	104
PID 6128 wrote to memory of 1264	6128	msedge.exe	104
PID 6128 wrote to memory of 728	6128	msedge.exe	105
PID 6128 wrote to memory of 728	6128	msedge.exe	105
PID 6128 wrote to memory of 2052	6128	msedge.exe	106
PID 6128 wrote to memory of 2052	6128	msedge.exe	106
PID 6128 wrote to memory of 2184	6128	msedge.exe	107
PID 6128 wrote to memory of 2184	6128	msedge.exe	107
PID 6128 wrote to memory of 2956	6128	msedge.exe	108
PID 6128 wrote to memory of 2956	6128	msedge.exe	108
PID 6128 wrote to memory of 5648	6128	msedge.exe	109

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\transferência de pagamento.exe
"C:\Users\Admin\AppData\Local\Temp\transferência de pagamento.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffdb936dcf8,0x7ffdb936dd04,0x7ffdb936dd10
      4⤵
      PID:4800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1872,i,2653484690965964999,15704521083163768914,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:2
      4⤵
      PID:4384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd" --field-trial-handle=2008,i,2653484690965964999,15704521083163768914,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
      4⤵
      PID:2812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd" --field-trial-handle=2124,i,2653484690965964999,15704521083163768914,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:13
      4⤵
      PID:2064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2860,i,2653484690965964999,15704521083163768914,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:1
      4⤵
      PID:2704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2868,i,2653484690965964999,15704521083163768914,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
      4⤵
      PID:1872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3308,i,2653484690965964999,15704521083163768914,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:5900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3376,i,2653484690965964999,15704521083163768914,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:9
      4⤵
      PID:4000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3392,i,2653484690965964999,15704521083163768914,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:2340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3420,i,2653484690965964999,15704521083163768914,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:9
      4⤵
      PID:6112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3596,i,2653484690965964999,15704521083163768914,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd" --field-trial-handle=4244,i,2653484690965964999,15704521083163768914,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:14
      4⤵
      PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffd9374f208,0x7ffd9374f214,0x7ffd9374f220
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2116,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --always-read-main-dll --field-trial-handle=1796,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --always-read-main-dll --field-trial-handle=2256,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:13
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3060,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3080,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3592,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3600,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:9
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3652,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3696,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:9
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3732,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3772,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:9
      4⤵
      PID:2956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3824,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3844,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:9
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3884,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3872,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:9
      4⤵
      PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --always-read-main-dll --field-trial-handle=3892,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth" --always-read-main-dll --field-trial-handle=4784,i,442288211099782826,1414799935413226482,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
      4⤵
      PID:2064

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5596

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth\Crashpad\settings.dat
Size 280B
SHA256 655eb8b95abccb8e581dcda508b66fc6bb83ff9945f08eb0c5566cf5f7be4268
MD5 7dd286e1f1fb6647830bf7222bdc374c
SHA1 9809d4d92db67f26c0c4f0de734cf428f09a7ad1
SHA512 112a812ab00900c58069411f6497e7640e47bc0c80e787dc91525242e8d695376d7059cedd3d0ee8ed48715d35c0c23d5a45c6da33e113255130fda129fbf69f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth\Local State
Size 5KB
SHA256 a251c0a4580a57be03969625bc52e14f0ee41a328c09074d514a59305845400c
MD5 7d3f77cd7f30838040413b37789551be
SHA1 14bcfa3f03a9f26c8876652371e0ccf5dd8b2df4
SHA512 58b4e9c45ebf9ee71fa397550acc8bc3f5f4629447f9ee368f22662bb71b4328cbda4d1924e3882aa641b0b013a9d48dd9ae7dfdd3034278de0189c8ced99f87
SSDEEP 96:VqGNkCyUfwH5wZuN58Frh/cInURoDotoBTJBkDv6DVgCaJEr+EmUPKBIa:sGNbyhH5UooDUklJgCWNUPY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth\Local State
Size 4KB
SHA256 ce1df99114afe8f1109d5d32eb73f7cc0e95ffeaa5c672a3749d584d942bfd8f
MD5 5f71a6a06aab8c1e6e47559fb1d7a0bf
SHA1 c130c388e62b0b106607088cf2a4aff67e7288f5
SHA512 22bbd882415f4182c25e7b5d832ee248c3b9cd8ad25a82d202e20e42a693220228e12fba059a78f9ee3e04964bdb903df5a2ad4ea7815c39296e89a87002c75d
SSDEEP 96:VqGNkCKUfwH5wZuNAQCBkDv6DVgCaJEr+EmUPKBIa:sGNbKhH5OlJgCWNUPY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe587fba.TMP

Path C:\Users\Admin\AppData\Local\Temp\jtob45ov.nth\Local State~RFe587fba.TMP
Size 1KB
SHA256 1c58ffc787ef5823ea82f948538aab90146f2109a615e4959ea59f2e089b09f1
MD5 1d8d78fe7d56a14ba38523544a100f2b
SHA1 8251ed01e2e19c45fd729852eedb1117e7bd3555
SHA512 b43667d3661f999f50e619429cad4b6a69903450330ba42d2519b1a347d3ed6dced831f8bbd7907d3d890c8bfe3ce5e034abb5c9dd83339c70af03c02523aa6a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Crashpad\settings.dat
Size 40B
SHA256 dcf1b6b2cb76e1f6df20c01e4c67c741f7d2ca6c1a94712bc193cb11553eb543
MD5 d6bd3377c9fe146738d99d0102c38e70
SHA1 d0cc9e5a77a074f391d08de98b05c08027b1b62e
SHA512 5989aabc941d9efc224c3904ea3f397ac4b3dcdb754f53930c662e9cdcb95845e2fa9fd95f750ca2d1ae84f9c4a0e08a7a4f4b60b4b02f8e0005bd758f1c97a8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 319afc840a8427734b09fb7413858ef5895cf7e255a12f873b91672078122910
MD5 7457914d311c1c6665adbf5458dc7ec4
SHA1 f42719632bccc3b23812f1d6c86baebb6a8ca35f
SHA512 0f2d7cf388cff5505bca3f2baa208227a85255483ecaaee3d169c6bfd971c8ea2271873fc0d231c910261d84fdfe21a31526ebf68120e9d386694ead0e5019ae
SSDEEP 6:/F4Z2CSkfkNOQmgSrcmy+U0myzJAy6vA:d4/SkMNygSrLU0JU
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e7aafd7b0e0229314f5d3ade1ec04a2a2f54e83d56058739c4328453b4dd1979
MD5 3e633aed79ed12664042ba3dfe7a1523
SHA1 1d63a91efcc92de2da6bd1cac0622dc78fba4159
SHA512 4ff798e2b955466d9e133059a55d68b5296410def4739006a5fea2ccd974512596324e81d4c72b40954e358e4e074d77dac2613f24f3500d37b6236b809560e4
SSDEEP 24:kWTAYqC5dvEmPmink6MCCwNOJUcMiCwN4iR:wYNvMCXgTMiXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 0975913236d5604925577e58d57c77943f5864d0ac90cf01fd5e9c68b5fce8cb
MD5 4552d5c45fb66e07e34f8873203edb4f
SHA1 623aa07256bcc95a027aa1b0d0c46df899498920
SHA512 bdb92af9429db8f82633d5f8123619c4e1998ac2e0ee87d4efa8dd597a09fa8728f2b1aebcb9eaec32283fe0fbe315bedfea0b5e36a0f5e3c69aeac0de7f4ef7
SSDEEP 768:zfDPLSgcRUv+Xk4zUfDPLSgcRUv+gk4iUfDPLSgcRUv+Xk4:dGq
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 18b4af40193ab078971e862e2bc74c02d98ae8f8a8a5bbad8fe085dbb262829f
MD5 f205c60a0b7d34b9bcf56e5893dbbb97
SHA1 da18be0cd6d5ced3161a16c7519b473f12997c11
SHA512 2afd1ad1a0150cb84c007e745d0c538a3fc77d9a253a8394152bff22f324738ece3ddbe81b15a4153d01d6b5f928d5dfc5663ea7a9089f16a60784643f53fb17
SSDEEP 768:khSTZvopuq8YVNz1sFtuykFuQX45zQ04Q/uGFYLhfDWu5a:1V2pUHZBQ0NCz0
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Cache\Cache_Data\index
Size 256KB
SHA256 9ba272afa22be3f9a834ab8cae00afcb1ae86bda262dca56ea455a43eeab6fa6
MD5 b466e0d2fdbf9cf2c00a663577d84900
SHA1 e03d6aad9a5c972e4e2f07b6afce5ae359bd3ba5
SHA512 b4f5c2fca90fc98428d42c29dc67888ad34024f802cb76539f3f246a60b0709147da672dee33c6bf63f5ff1b34f061e6500b381a61ad27a1bd42e403ed520181
SSDEEP 3:LsKfltlNllklkXl+cKlbXja1t/911alDlNlXlmNtlr/ME/:LsK13lPr+bXqdNbkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

7018b8cf1c3b00c7_0

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Code Cache\js\7018b8cf1c3b00c7_0
Size 306B
SHA256 abd77a665e897524476265da5ebb12d88c5e030bcb7bef06d526ecf9f85a1d43
MD5 570bcd6678ad332e613740320f859e82
SHA1 944085b8a67e76fb482622fdbbec6c2358301b0b
SHA512 52b6641561521800760e4745649bd6311fb491a8926c1d86b0840ad7a42134c794eaeead87c915b1d804d75a96a8bd919df39d096fcc79812f0e8caf30d8555b
MD5 SHA1 SHA512

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 7304c246994cac0ebf3125331e574e24e7c07749feb5fc980badc265855253a3
MD5 c990bb659de13c1c070a580d53df7110
SHA1 5e7fe9fa763436e4b4a4320092ee2e55447f107a
SHA512 ea91e35595d16eb5fe2f9a8b53107eeaacee51c8bf193a184665f88b3f69feeee0cd758bad6be804bbfe7bc29661b29b7114fc1734fbdf29802c3f590e51bb40
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 38ac9667827f8e583eed758a4855da9873b610028298e870118cef40f4717c25
MD5 86cf1ffd6e2e14f0286e19dbb34559a5
SHA1 f6d2f6238c5c89ec3072acbd5a9c129c4ca983aa
SHA512 13fb3f8fed8ab1a0809719d9b97338161f4d23a50a9f4ec1318622af4b54e339a1ad92df02d7702c5fe929872147d44577322d20c3bb52283d4abe9bdc2ca720
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 d8cc0a4b0201faf805de886d2aae4ce3efac48fb308b777eb2bbe9cfd3035e62
MD5 784a5247ac2410331955512ed43a0513
SHA1 f82af6d0b53e417b88601511cf56e36cedb3199b
SHA512 9f73afe911b4b3a7b3ad4c07c4c7694946ea09ade0bf9588af2f08fbbf69fe5a8f0ebd0a2498c2cbe982c1e4e38a06ed45279ee7bf9533d0a83d29ea378a55bf
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\GPUCache\index
Size 256KB
SHA256 11f44aa5d7e254f6296449e84d8f4eb825da4565d2ee6b1a109ae943b3fcb05e
MD5 7ded507aea79b4e047134e8eb8ea70d9
SHA1 88abc5588ad6f94a275496eeecabf9b893ef4e8e
SHA512 ff8870b22b52adfcca05b1cd1f709f18a0ed7d2efe8eb38e48588fbfc70a4be16cd23c51fdfa202d2b0361de5365f4041aa5cccc70f5ddf2d9d001cd32769a6f
SSDEEP 3:LstlNllklkXl/a/:LsX3lP/a
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 6e6d7d54fd0886c26d942a48cb14d2001205a397a17dc76d297b9e0bd2bed32e
MD5 662cbf93d99c6d70b368d329cdb0d8bc
SHA1 bf9e485a5e99ce02588cbfb1bf62e429a299932b
SHA512 5b9394ca8ccdc9490ae1141ab0a657890250382b3ec9e4df14621d107129b97d2dafefa3cdf4c044c3a56108f3701e347a72dca33a2f16708d584e82fa5c56b4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\GrShaderCache\index
Size 256KB
SHA256 13ef3897490f5dc1efc7aeba4799a9e5569662ffc55d0a7ee9824021ce09cb1e
MD5 aad65a51c87ab36f12a20434398680cb
SHA1 9c1346d7942298111f8833d3d8ee493427aa8b78
SHA512 fe7e049d0d840f9c2367a119856b96bdafe046bf026a8c2e7a57eb046887abda35814e607ff051e39d3f52e86cc244c99ec3ec0e359338c896351264ef69e54a
SSDEEP 3:LstlNllklkXlKOG:LsX3lPK
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\GraphiteDawnCache\index
Size 256KB
SHA256 aeb9cac7f66beaf6d6a89e656334159017df71aa0284f6660f77f1d013267a03
MD5 9c9c1657645fd9893303d34dd90c99be
SHA1 bf3634af1babb89250644ac6b2944d2f657149d6
SHA512 8340481061d6bee2642585f184beee92f70aa07e07c5fa2eb58562adbe36d6b63dc7101c723f97f55bbbdb2a6ba2aadf9d24dbbc6c5f752234d78f577afe2586
SSDEEP 3:LstlNllklkXlpNzq:LsX3lPp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\x5dgildg.mjd\Local State
Size 1KB
SHA256 c024074e274116b6e99d29db4c61c6e64da88367a77f4d0b1307a6dfb5f6b99f
MD5 220cd0e8e75e23d409a2f2e04a94aeb9
SHA1 77e40de818a74073a5c6cf609b30f310d233d147
SHA512 37f81aa7702ae455bb7cf4b25fb7afa4ed5f378d4eb6be9ac261cef456c77aeb6c991a5b87fee52985e0ee6e1e02e1414dc4ea077cff52cd91f47b0aed7974ad
MD5 SHA1 SHA512

Submit Download

memory/1544-6446-0x000001C57A4C0000-0x000001C57A6A2000-memory.dmp

Download

memory/2676-6030-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/2676-6026-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/2676-6453-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/2676-6451-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/2676-6450-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/2676-6447-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/2676-6227-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/2676-6167-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/2676-6166-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/2676-6035-0x0000000006900000-0x0000000006912000-memory.dmp

Download

memory/2676-6034-0x0000000006930000-0x0000000006980000-memory.dmp

Download

memory/2676-6033-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/2676-6032-0x0000000005F10000-0x0000000005F76000-memory.dmp

Download

memory/2676-6031-0x0000000005CC0000-0x0000000005EA2000-memory.dmp

Download

memory/2676-6025-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/2676-6029-0x0000000005550000-0x0000000005B68000-memory.dmp

Download

memory/2676-6027-0x0000000004DA0000-0x0000000004EE4000-memory.dmp

Download

memory/3948-63-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-67-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-6028-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/3948-6023-0x0000000006FE0000-0x0000000007034000-memory.dmp

Download

memory/3948-6022-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/3948-6021-0x0000000006F90000-0x0000000006FDC000-memory.dmp

Download

memory/3948-6020-0x00000000067E0000-0x00000000068BC000-memory.dmp

Download

memory/3948-6019-0x0000000006130000-0x0000000006210000-memory.dmp

Download

memory/3948-6018-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/3948-1435-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/3948-47-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-51-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-53-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-55-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-57-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-61-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-45-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-65-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-1190-0x000000007475E000-0x000000007475F000-memory.dmp

Download

memory/3948-33-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-43-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-69-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-35-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-49-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-59-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-0-0x000000007475E000-0x000000007475F000-memory.dmp

Download

memory/3948-17-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-19-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-21-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-23-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-28-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-29-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-31-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-6-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-7-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-9-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-15-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-25-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-11-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-13-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-5-0x0000000006D80000-0x0000000006E12000-memory.dmp

Download

memory/3948-4-0x0000000007230000-0x00000000077D6000-memory.dmp

Download

memory/3948-3-0x0000000006900000-0x0000000006C5A000-memory.dmp

Download

memory/3948-2-0x0000000074750000-0x0000000074F01000-memory.dmp

Download

memory/3948-1-0x0000000000D10000-0x0000000000D28000-memory.dmp

Download

memory/3948-37-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-39-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/3948-41-0x0000000006900000-0x0000000006C54000-memory.dmp

Download

memory/5316-6170-0x00000230B5A40000-0x00000230B5C22000-memory.dmp

Download