625a15f574e2977cc81a0743e34bd39944cb77f514a85aa7f1949bb5260093f4

Analysis

max time kernel
103s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2025, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
400000.be9d88675f7683f0db15742cf36bf8c2.exe
Size 628KB
Sample250702-e6lqeassfx
SHA256 625a15f574e2977cc81a0743e34bd39944cb77f514a85aa7f1949bb5260093f4
MD5 1dc075473c0489dd8766065dc12e24a5
SHA1 7c96503a6c43f467ae550b9fb189885299c706ae
SHA512 8b38524c98022e218b10b1cdd5333dd4bd3428d5343f091f1ff10b03baf20751aacd6a3ee9a32f9ca5744b90c6ba6ea7ae6959d91d6abae5b97ca45a1217c5c2
SSDEEP 12288:Cm3m9QkGObrL4LkFN5sWuVrEHcar2uNLeWNGM56DG/gqlBns2K:C/vbrfFNGXayu/NSDGIqHns
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key created	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	400000.be9d88675f7683f0db15742cf36bf8c2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe
5244	chrome.exe
5244	chrome.exe
4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe
4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe
3940	chrome.exe
3940	chrome.exe
4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe
4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe
4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe
4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe
2400	msedge.exe
2400	msedge.exe
4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe
Token: SeShutdownPrivilege	5244	chrome.exe
Token: SeCreatePagefilePrivilege	5244	chrome.exe
Token: SeShutdownPrivilege	5244	chrome.exe
Token: SeCreatePagefilePrivilege	5244	chrome.exe
Token: SeDebugPrivilege	3940	chrome.exe
Token: SeDebugPrivilege	2400	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5244	chrome.exe
5244	chrome.exe
1492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 5244	4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe	88
PID 4992 wrote to memory of 5244	4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe	88
PID 5244 wrote to memory of 3940	5244	chrome.exe	89
PID 5244 wrote to memory of 3940	5244	chrome.exe	89
PID 5244 wrote to memory of 3112	5244	chrome.exe	90
PID 5244 wrote to memory of 3112	5244	chrome.exe	90
PID 5244 wrote to memory of 2880	5244	chrome.exe	91
PID 5244 wrote to memory of 2880	5244	chrome.exe	91
PID 5244 wrote to memory of 5100	5244	chrome.exe	92
PID 5244 wrote to memory of 5100	5244	chrome.exe	92
PID 5244 wrote to memory of 4624	5244	chrome.exe	93
PID 5244 wrote to memory of 4624	5244	chrome.exe	93
PID 5244 wrote to memory of 4620	5244	chrome.exe	94
PID 5244 wrote to memory of 4620	5244	chrome.exe	94
PID 5244 wrote to memory of 4780	5244	chrome.exe	96
PID 5244 wrote to memory of 4780	5244	chrome.exe	96
PID 5244 wrote to memory of 1284	5244	chrome.exe	97
PID 5244 wrote to memory of 1284	5244	chrome.exe	97
PID 5244 wrote to memory of 5948	5244	chrome.exe	98
PID 5244 wrote to memory of 5948	5244	chrome.exe	98
PID 5244 wrote to memory of 5424	5244	chrome.exe	99
PID 5244 wrote to memory of 5424	5244	chrome.exe	99
PID 5244 wrote to memory of 684	5244	chrome.exe	100
PID 5244 wrote to memory of 684	5244	chrome.exe	100
PID 5244 wrote to memory of 1968	5244	chrome.exe	102
PID 5244 wrote to memory of 1968	5244	chrome.exe	102
PID 5244 wrote to memory of 4844	5244	chrome.exe	103
PID 5244 wrote to memory of 4844	5244	chrome.exe	103
PID 5244 wrote to memory of 1936	5244	chrome.exe	104
PID 5244 wrote to memory of 1936	5244	chrome.exe	104
PID 4992 wrote to memory of 3940	4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe	89
PID 4992 wrote to memory of 3940	4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe	89
PID 3940 wrote to memory of 4992	3940	chrome.exe	84
PID 4992 wrote to memory of 1492	4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe	106
PID 4992 wrote to memory of 1492	4992	400000.be9d88675f7683f0db15742cf36bf8c2.exe	106
PID 1492 wrote to memory of 5560	1492	msedge.exe	107
PID 1492 wrote to memory of 5560	1492	msedge.exe	107
PID 1492 wrote to memory of 5636	1492	msedge.exe	108
PID 1492 wrote to memory of 5636	1492	msedge.exe	108
PID 1492 wrote to memory of 5000	1492	msedge.exe	109
PID 1492 wrote to memory of 5000	1492	msedge.exe	109
PID 1492 wrote to memory of 5588	1492	msedge.exe	110
PID 1492 wrote to memory of 5588	1492	msedge.exe	110
PID 1492 wrote to memory of 1952	1492	msedge.exe	111
PID 1492 wrote to memory of 1952	1492	msedge.exe	111
PID 1492 wrote to memory of 2460	1492	msedge.exe	112
PID 1492 wrote to memory of 2460	1492	msedge.exe	112
PID 1492 wrote to memory of 3584	1492	msedge.exe	113
PID 1492 wrote to memory of 3584	1492	msedge.exe	113
PID 1492 wrote to memory of 2808	1492	msedge.exe	114
PID 1492 wrote to memory of 2808	1492	msedge.exe	114
PID 1492 wrote to memory of 1196	1492	msedge.exe	115
PID 1492 wrote to memory of 1196	1492	msedge.exe	115
PID 1492 wrote to memory of 2400	1492	msedge.exe	116
PID 1492 wrote to memory of 2400	1492	msedge.exe	116
PID 1492 wrote to memory of 928	1492	msedge.exe	117
PID 1492 wrote to memory of 928	1492	msedge.exe	117
PID 1492 wrote to memory of 3476	1492	msedge.exe	118
PID 1492 wrote to memory of 3476	1492	msedge.exe	118
PID 1492 wrote to memory of 5268	1492	msedge.exe	119
PID 1492 wrote to memory of 5268	1492	msedge.exe	119
PID 1492 wrote to memory of 4444	1492	msedge.exe	120
PID 1492 wrote to memory of 4444	1492	msedge.exe	120
PID 1492 wrote to memory of 3224	1492	msedge.exe	121

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	400000.be9d88675f7683f0db15742cf36bf8c2.exe

C:\Users\Admin\AppData\Local\Temp\400000.be9d88675f7683f0db15742cf36bf8c2.exe
"C:\Users\Admin\AppData\Local\Temp\400000.be9d88675f7683f0db15742cf36bf8c2.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff5925dcf8,0x7fff5925dd04,0x7fff5925dd10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1952,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
    3⤵
    PID:3112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --field-trial-handle=1984,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:3
    3⤵
    PID:2880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --field-trial-handle=2140,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:8
    3⤵
    PID:5100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2844,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2852,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3080,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3204,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:2
    3⤵
    PID:1284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3236,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:5948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3252,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:2
    3⤵
    PID:5424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4028,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:1
    3⤵
    PID:684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --field-trial-handle=4112,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8
    3⤵
    PID:1968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --field-trial-handle=4184,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
    3⤵
    PID:4844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir" --field-trial-handle=4216,i,12880500000395212042,7610947668017843343,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
    3⤵
    PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff555df208,0x7fff555df214,0x7fff555df220
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2248,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --always-read-main-dll --field-trial-handle=1808,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --always-read-main-dll --field-trial-handle=2216,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3120,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:1
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3128,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=1612 /prefetch:1
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3448,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3488,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:2
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3560,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3588,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3632,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3700,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:2
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3732,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3764,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:2
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3796,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3804,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:2
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --always-read-main-dll --field-trial-handle=4884,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --always-read-main-dll --field-trial-handle=4924,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --always-read-main-dll --field-trial-handle=5116,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae" --always-read-main-dll --field-trial-handle=5072,i,12310534624523327517,3892365545863009257,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:2416

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae\Crashpad\settings.dat
Size 280B
SHA256 df62dd9675f63eaff02f2006ede4063fb2d4daa5230b45e4f979f5a9a759cb40
MD5 ea5eb2f6baa354deecb2e97c22dd6efd
SHA1 242963ffc7c875331bc2313c2ed50b6366479960
SHA512 7a21b368b78434c44bca2ee4b7922540030d3f00490ea12e7a596e75b0f5a232286d4f84ee08e77218a061e11dd39cb8ffe13c5e2b8480c273bfb357c0119980
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae\Local State
Size 3KB
SHA256 373dcab30b38d57f30154a6999007271d50d0f3238e6820d45f9184972f4ec2d
MD5 fda0aec3182f06808e69b03e13ca5a64
SHA1 38783f0de39e7cb426771ad43c4318cb470dfa40
SHA512 396bd6422966f3b7808c5ced76a3f1cc9a4c0472b697c5cc8c08b6f11d3b6ac840310715e2e689cf3acbc5720663bc0b598abe1be0fe4f2a5a846ed5efcd76e7
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae\Local State
Size 4KB
SHA256 e0334dd398afbb0f262cfbc4fe292a8ef5e28a8b9c400df7de1a1694fba1d131
MD5 89dae68a5c4eab52744df23a61b88f6f
SHA1 5f353a297e394eac9fde6abc656f3d7234125925
SHA512 584cd902d59858b41d48951f8483d8325dac934886bf008b4b70c0cdf0d8406867cb93f8f47dd70810dee0d7f62d624f4d906d16d68c7f2f1bc6890d72cac1fb
SSDEEP 96:3qGNkCuflPAmcj58Frh/cInURoDotoxLtgBmP9va0gRZR3JmIeHSDS4SYSuSDSDg:aGNbOYKooDUtAjgjRZfo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57ce9a.TMP

Path C:\Users\Admin\AppData\Local\Temp\mcz0k3ws.rae\Local State~RFe57ce9a.TMP
Size 1KB
SHA256 35593ac2ea349284f25cba6b8662d3f6ec50e91438b50138ea4fb57023e46b79
MD5 ba259da540f3e4230bd48ab5d83e8687
SHA1 79610a519adba2c987f8408b5405cd4ae310f6c7
SHA512 7689591d891d300bd09a543bc1796555b2991436d5daf094afac6d0b99e03ad12d8dfe515842d1d77ed8f8bcbe02250edd018ff18cb6fdff1e803aae13f7f8cd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Crashpad\settings.dat
Size 40B
SHA256 359db8c25540e5e9228348b493efeae71e1e38501fa390c0df916c5e66d14648
MD5 edebfcbaf78f1eba1071ee1281e3eaa8
SHA1 fb080c221f9e9bfaa3cbd25110c7f78ae3ecd59e
SHA512 e86c0f758438faa3f648d72a75b2038d50e26b8d11c4c4be96862f4a9654a8e6beed095d3b8843fc2f6a76ca17ec56dc99f8f29eb5de868ed9a66164fd0965a7
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 403180e3fe2418c1c8be20ba835e8f9566c50b7d134b1916364693994bd2cbf5
MD5 1e4d0928ab1fe4c1c0bf3bb996877850
SHA1 73aaaf4592d33ac63bb5af19446a71fcd7c07d16
SHA512 d5c7c93551ec25fd7e8bb2d3352cfbb2041005eca2060cc7724ac3ba752d2ba3a4ecbd5f09862740bda335acd7f1a17e1f8aebcca2229324041a8343ac4ce154
SSDEEP 6:/FoEXEXOU+SpFl60G5mAk/E0/eHtar9SYDcWRot:d7Xc4SpFG5mxnYIXot
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 80a6f068af4d8111a838000c8ef71b40444ee905ad44815088c581a9d7c30a9e
MD5 2327a80c6b55f42a7010bcb1962e6a24
SHA1 8776246e5ad768d3b0bbd58a0ed4f6cfda076877
SHA512 38b7b46fad706081c9d42be5006cba846cbede001e3833b3d53bd463b6013822a23e1396898af83babfd17b43cdad0ec3ef1b6754420ffedfd030f1301c09465
SSDEEP 48:MUYLfSMCXgbFU/wMiXgTTRGxoyCqS8aBCyUa3YW0:MBDS/gZUoDgTNPDqSCyUaR0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 63e4d55ea2d2262ea40f36503005ce06a2e64de738f5e167bcf5027989f8a15e
MD5 836a7c28baada8a1618fe398c1712e65
SHA1 24efb4d7a36b066c059cba4c0dd98e50d36d9e91
SHA512 2addafc08ca53cefeafb906229a43ecadcade6d0f0ffbaf3ec20125f76298a9124d0b19bf0185bdb524b399fe1e8e23c51d3b22f16a7a7f8d28c29fcffef683f
SSDEEP 48:NkdpToyrbGUixjIp9ZIRVZEHjt8JUx+nUT+:OdxoyojEKTEHmuQUT+
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f1481883905b14151c9f4b7a6aaa84caadc8d1ea268f5872ba944080f644677d
MD5 13f3d6b6e7d6e49c396d47e913ec3c54
SHA1 55ca8c075c7e3f66ec60ace774b44bfa96a33fc8
SHA512 8f24e4fb87f4335c8e595895e45a7124724d82fecad2c2c7e2014d1968d11a5bad3301490d37587a8c3b5d590ea1cf319d38707b36a6682386f60736fef5947d
SSDEEP 768:cfDPLSgcRUv+zk4GUfDPLSgcRUv+Pk4+UfDPLSgcRUv+Pk4AV4V4w414:G6mBMVs
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 ad0c0a63dca0ccefc50a0d1a8507b24e5d8fee2130c922df463cfabeae3e5090
MD5 fa85df80bb56ea1a2521318e863caccd
SHA1 2dff8ec783ea3b5b0aa42d44e09b41635fa66d24
SHA512 56dfe4380df7499e0d19de6773536d0acd2c2c03e8915c04b2211de0f243c19640d6f1225536b7abbbc0b58f4654fcc1fa6bd3c4105c4c381da436e71cee12a2
SSDEEP 768:/fVi1S457K0M1yRD+7Sa0ZneOGIJZyqFgRDlWHlrd5K/fxAaSbWnxw5:/fViIsQ1hBWnY43qHdSk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Cache\Cache_Data\f_000002
Size 64KB
SHA256 7c80241256e645f4404fe0cdb19f4ed720cd934c4367e944fac070cdbda5213c
MD5 5a43214ac7538628e46bd4794a2315f6
SHA1 9e92f018435ec0bb1813cc02c04ca18f385288d8
SHA512 325891175c52f0c79f41e1201d274202a4f4f76bcddc5d328daa43e98c4206faa77360b8bf470aefa20f5ebc59ca0fb4107b9295fe597b7badc58e1c42a2b86a
SSDEEP 1536:Wrf46rfndpWzAPmJmIB6Us9Y7KkNANsY/KuxbTWnBjNFSgEOvA2:WrvfdpWEPmsEtNwsYCux4pF/EG
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Cache\Cache_Data\f_000003
Size 68KB
SHA256 fb7bf104bb1b7fc139749d8b270cdba41d4646f8a3eeb25adf6c56b8d99d5eba
MD5 7a599995b8e3d8fbd5ed7a5b0696ec56
SHA1 6aa9041badfa0cdeaf7ce072a6867925e76c2184
SHA512 610da8d7d9f63c0c9a0feb08dca0474a04e1457792a5b45970b26aed067f4c2860c70977106b51de73f9f85e5ea05d8378e2e85a2fb4b51666df696045f66f89
SSDEEP 1536:BA8+uWi3ufGEV6XSDamayI0X7nA4RC/NwP7PDcQ0kcz:BAVuD3BEAOa+rRC1gwnkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Cache\Cache_Data\f_000004
Size 38KB
SHA256 d22632c84b8b935a2451ed89ef446356ab024bb761c52cf8ace17068a655be0a
MD5 ed81ae6e321fbfbc6cb3dff94779e4be
SHA1 1f0c0cae6cf9366424323db0b0739facd69afdfb
SHA512 60dde1068dca1305c488fb5bc43bcd77d8da22ca0b7d61515c777510cae0045d054094b5c52e27b7d9f2b536342f18e9358b806e9bd67f15ca4da0702b3b985f
SSDEEP 768:QSnFFCcBJxIomJYmESvU45oODrHBWrHKcY5YImrkpEB8kG0uIrMQ89k:QSFFCcjxIomJYUc4N2KD5YnoE5vrMQsk
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Cache\Cache_Data\index
Size 256KB
SHA256 a568f03a40acdac499d2b085d6d727efc33479e8fe31af8fb6d8e2ee61328358
MD5 6e823d3730ff8df7385512ee92aa730d
SHA1 688387a5eb7527696bf2da26c8d454b30600a52e
SHA512 f956f9402c00a77eb3247b6b23838b32b7ec93902484d3e28119800e2a9304a345314f41fa954beb6a4c477a7df7ef217e3f654d4800846a6258f5f171e38f14
SSDEEP 3:LsLllqltlNllklkXlpb+dWAllx/911r/Xll//gl+/lcE/tlXlmNtl:LsR4lX3lPJkB9l/qEkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

7018b8cf1c3b00c7_0

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Code Cache\js\7018b8cf1c3b00c7_0
Size 306B
SHA256 ba797e9e56a47d472484bd58704a42e9e2dcbb353e27b7df3227559447837bbb
MD5 c5f7d32e520837de0a4d7c0c3bdaedfc
SHA1 90a149d1e8dadef10a38de17cf00f13a6c441d9e
SHA512 2dfdb487a86a8e6175f805915ea3d81b3c6fe00e6638a776747b0febda7e65ddbef72c8e7ebca708124a80522282efd6a7474f1d0d2fb2faadf7fc6ecf9a8053
MD5 SHA1 SHA512

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 232ef66bbf013f8ecaaa3a40cc95e1db1f9a02d1e8406b383148c9769adb7558
MD5 315cf7ff0784684a4b7b89a2ac6b2083
SHA1 adafa2d3f034c0fa9e410d364ca2d2442a44f8e6
SHA512 5a9b2df949d621521c66c38e450eba3819de2dccbf06dcc2deb90b46511e282f59828cd880a251e7a8b15154786074717b833323cd01c661922712941588d585
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 08c54adf89575e28c5c1f35a69aaea8a11b182514155523429e5394b1c25a0be
MD5 5b75af163af14258ae048bcdf4cfb881
SHA1 2e52566d901dd2454f7ece0a4eee4407916f4f9c
SHA512 3c8015f3867f3a303a35d038ebfb7ac30e4a5ec5ae2ce3298d7ac3f5ad73c4351fec841a9db06b768af6ef7b509799a92d8d8d36d431882e1581389b7ece52b4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 017b38ae01b7b3efe56247ebffa3fd5cb651580a2662dd4e4e5e2a5179cc8f41
MD5 704a44c78a5f7349aa289d99691a25cb
SHA1 c9edf5a9bf8b3708ce876fdf82e3510f1aaba7fb
SHA512 17130ff798b009e2a79c334bc6afcd12cf5067b97b4214c8bc55cee181d9b86e514dedd4cf03bc76d7782d52747c7d6fb4826590a3ce61edaa029c535b9f9f6e
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\DawnGraphiteCache\index
Size 256KB
SHA256 d27fca4477f3c79b744885dc2fff259b2f5cc6201718cae742b5423c3412f2c2
MD5 3cc7e47303e006cf146347dbfc47c928
SHA1 779a41e22abb32f2bbf0c4ddbd9b54a59d714a07
SHA512 49acf086c5bb58be5079aaa9ad13f753c5cb0a224b39384a659f6c8ba33a1ef7bc5bede011023c37b46b8c0fe030ce8fd49665c7b8d9cf0be33b7c3d228fe9e0
SSDEEP 3:LstlNllklkXltpkbl/:LsX3lPtp+/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\DawnWebGPUCache\index
Size 256KB
SHA256 0507503e49a82e00103c21a41922ecbc4da4bf9ab0085b9537f367ba176b862b
MD5 c72d442b901ab8f971f40239096b1991
SHA1 46801297e815fb521c458176b362372858cfd23c
SHA512 e3d7f46ebce2dc47221d0924c78501d3ae09aa81486770fd1e6513278535f2cde5923ece0e17b79f92e54526902523243ee15d7e123c008ab4cf32b38adcbb71
SSDEEP 3:LstlNllklkXl1p7+t:LsX3lP1st
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\GPUCache\index
Size 256KB
SHA256 e6c39df9fd841955ed5dc5ba245713d0ef5d15f4f57214ea374adfc4f3b2569d
MD5 c159655e3911c780012c8a0beb634549
SHA1 cb430b9fea4a9a9f9e31c3a5827abfe4bf0a52c7
SHA512 9cd7cdb12801b07243ba76f5ecd33e44a7cfa7ba5c38307359c55a5b4697a640c7e5be2f5a4428bde5ebc4146ef2cc3a29800a104f88f1043c734de0188dc48e
SSDEEP 3:LstlNllklkXlA+t:LsX3lPAq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
MD5 SHA1 SHA512

Submit Download

dark_logo

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Search Logos\dark_logo
Size 42KB
SHA256 cb5ab99cf80d8ed72248e307444aa90b3ff44e959c231160d8076ce46b29b792
MD5 443e07f4aa340f739b12484f7c4c0ffd
SHA1 e8571532707959454f36a9783247a2615b7b2c73
SHA512 7247986ca3847cce60fe7f2cd902a933ccaa4c5a42ff34064ff536ec1506731aabafca8e95387612c61f69e817f8753dad4c49032fe2ddd09070d7b8f012ee88
SSDEEP 768:6aLmfZSvavpTVI+BvyfZCIsjAGdr7sAPeJrySPC4U9CYx+XUwh7Fq3BXJtk38zL9:NLm6SI+BviZCE4UdrbUCY+UGStk38Xvl
MD5 SHA1 SHA512 SSDEEP

Submit Download

logo

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Search Logos\logo
Size 19KB
SHA256 bb9fb7f5321bb15848362375a501b7bcbe44edb5b4236389d7d7068aea5005b3
MD5 3cb903e1fe1c1466f92d871a331ab9c3
SHA1 664562b4a10b20e1bd74ad620817556f42e49381
SHA512 77e0fed09e89e9c9693a64e62709fa2a27bb2f8bd1aca307cf343ca5263d7af65db9dc561b0dfd2f67daf6fb73b563a2b2be3ef473b029914ce88c337197ff59
SSDEEP 384:54USg4oQ3mQsW60APuA0qCqCm0T/8Sro8jqh1FaszcrLiu+0NuC9nC9rcBX9:6Rg4T1sP5JCm0TRrogqncHtnC9rcBt
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Search Logos\metadata
Size 1KB
SHA256 af75517fdc06f472d362a7d58002388d26b13733cea743bc1c684f58cc942fa4
MD5 2df507391d066dd98dba0ac804ef8fee
SHA1 f96a303b4aed69b66c01d82392eff3a3e7085830
SHA512 9f1f9234897adb7a6bfdaf44aa06ab6e83f6904d37e8e1e715e5541e04331bc830b8fedb342890112a3b2a5dbcbc5a6a1acc6691266f83891210e5385e05d9e8
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 1c9635008f6d4e063aeed47f32e1109092c661878ecd8f4d4c317312ea2de6f6
MD5 af3a776a22ceb4a9a291120c2b9415db
SHA1 c9b82abd054b0b6bb10aa4bb1e52cbe3250b051e
SHA512 b519e4211843d1f15804a64611d6b9c689ae7402e4ca08f271d1bc106b4934b3d882c9865af8bd6cbba0ca38cb92b16afc44f3b2bf9973948940e6b47692c894
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\oryyb5ok.fir\GraphiteDawnCache\index
Size 256KB
SHA256 20fc3639c6454d9c41ed842de8dedd31d685267c277cd30dc686690860b3d2f3
MD5 7dd8581b63b1fb08c71e77bba8f050af
SHA1 83a85a7142b12c93d94723153353969092fdcf10
SHA512 86d0edeb2ba5d572b1cabd8d69dceb926679723a4ed649900a5ac03e5262003ad271ea3656c5d79315c4b7aaf6c8adbd9aeeec4b342bfe21e90ad211662c0a39
SSDEEP 3:LstlNllklkXl/D/:LsX3lP7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2400-443-0x00000257B0E00000-0x00000257B0FE2000-memory.dmp

Download

memory/3940-154-0x000001F29CF00000-0x000001F29D0E2000-memory.dmp

Download

memory/4992-8-0x000000001D520000-0x000000001D532000-memory.dmp

Download

memory/4992-4-0x000000001B600000-0x000000001B610000-memory.dmp

Download

memory/4992-9-0x000000001D3D0000-0x000000001D420000-memory.dmp

Download

memory/4992-7-0x000000001B600000-0x000000001B610000-memory.dmp

Download

memory/4992-6-0x000000001BA10000-0x000000001BBF2000-memory.dmp

Download

memory/4992-5-0x000000001B600000-0x000000001B610000-memory.dmp

Download

memory/4992-211-0x000000001B600000-0x000000001B610000-memory.dmp

Download

memory/4992-0-0x0000000000860000-0x0000000000904000-memory.dmp

Download

memory/4992-3-0x000000001B600000-0x000000001B610000-memory.dmp

Download

memory/4992-2-0x000000001B450000-0x000000001B594000-memory.dmp

Download

memory/4992-1-0x000000001B600000-0x000000001B610000-memory.dmp

Download

memory/4992-126-0x000000001B600000-0x000000001B610000-memory.dmp

Download

memory/4992-469-0x000000001B600000-0x000000001B610000-memory.dmp

Download

memory/4992-533-0x000000001B600000-0x000000001B610000-memory.dmp

Download

memory/4992-534-0x000000001B600000-0x000000001B610000-memory.dmp

Download