6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/05/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Size 488KB
Sample260506-kyppzset5z
SHA256 6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2
MD5 23e505ce3759a9e1793590c14b62abc8
SHA1 6d31324f3eb441f6b37841e4f87457b777a491ba
SHA512 1a751179a8aa4a2602a978dec22e91302ad853af07ff2d655fc7c2fcc9b0e7365c5cecb495135de2d92142625e7aa041a851ed0904bc9376acde45a4d0e3f99f
SSDEEP 12288:tVS89/1j8w6Jdrx5ozr/nB/k83xWccbfPWBfKcDOiQ+XF:tVS891AJdr3ozznRWbmbDOi
TLSH
T1EFB4234CAD570132E6733EF460F6EBBF54226D239C65F938D709E050AF42AE89E6520D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.lnk	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2372	chrome.exe
1884	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
2376	chrome.exe
2376	chrome.exe
4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
1560	chrome.exe
1560	chrome.exe
4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
2164	msedge.exe
2164	msedge.exe
4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeShutdownPrivilege	2376	chrome.exe
Token: SeCreatePagefilePrivilege	2376	chrome.exe
Token: SeDebugPrivilege	1560	chrome.exe
Token: SeDebugPrivilege	2164	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2376	chrome.exe
2376	chrome.exe
1400	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 2376	4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe	86
PID 2376 wrote to memory of 5780	2376	chrome.exe	87
PID 2376 wrote to memory of 2676	2376	chrome.exe	88
PID 2376 wrote to memory of 2372	2376	chrome.exe	89
PID 2376 wrote to memory of 2888	2376	chrome.exe	90
PID 2376 wrote to memory of 3820	2376	chrome.exe	91
PID 2376 wrote to memory of 4088	2376	chrome.exe	92
PID 2376 wrote to memory of 4968	2376	chrome.exe	93
PID 2376 wrote to memory of 3704	2376	chrome.exe	94
PID 2376 wrote to memory of 1560	2376	chrome.exe	95
PID 2376 wrote to memory of 3444	2376	chrome.exe	96
PID 2376 wrote to memory of 988	2376	chrome.exe	97
PID 4424 wrote to memory of 1560	4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe	95
PID 4424 wrote to memory of 1560	4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe	95
PID 4424 wrote to memory of 1400	4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe	99
PID 1400 wrote to memory of 3116	1400	msedge.exe	100
PID 1400 wrote to memory of 5448	1400	msedge.exe	101
PID 1400 wrote to memory of 1884	1400	msedge.exe	102
PID 1400 wrote to memory of 2164	1400	msedge.exe	103
PID 1400 wrote to memory of 3480	1400	msedge.exe	104
PID 1400 wrote to memory of 1588	1400	msedge.exe	105
PID 1400 wrote to memory of 1280	1400	msedge.exe	106
PID 1400 wrote to memory of 4480	1400	msedge.exe	107
PID 1400 wrote to memory of 4904	1400	msedge.exe	108
PID 1400 wrote to memory of 5796	1400	msedge.exe	109
PID 1400 wrote to memory of 5228	1400	msedge.exe	110
PID 1400 wrote to memory of 1712	1400	msedge.exe	111
PID 1400 wrote to memory of 3608	1400	msedge.exe	112
PID 1400 wrote to memory of 5628	1400	msedge.exe	113
PID 1400 wrote to memory of 5156	1400	msedge.exe	114
PID 1400 wrote to memory of 3940	1400	msedge.exe	115
PID 1400 wrote to memory of 5168	1400	msedge.exe	117
PID 1400 wrote to memory of 4328	1400	msedge.exe	118
PID 4424 wrote to memory of 2164	4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe	103
PID 4424 wrote to memory of 2164	4424	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe	103

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe

C:\Users\Admin\AppData\Local\Temp\6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe
"C:\Users\Admin\AppData\Local\Temp\6c75b393c1f2fa52d35b38efef09c4cbee97f97b9a65de99f1caaff7a53974c2.exe"
1⤵
- Drops startup file
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd8e52c728,0x7ffd8e52c734,0x7ffd8e52c740
    3⤵
    PID:5780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1676,i,11857168974501678743,11656103201162767225,262144 --field-trial-handle=1940,i,14292003683176241414,7405131840167689444,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
    3⤵
    PID:2676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa" --force-high-res-timeticks=disabled --metrics-shmem-handle=2008,i,16150239833644875745,11253812057162091833,524288 --field-trial-handle=1940,i,14292003683176241414,7405131840167689444,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa" --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,13292632520617177729,556155660189081320,524288 --field-trial-handle=1940,i,14292003683176241414,7405131840167689444,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:8
    3⤵
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2864,i,10811179849609800642,9768425255464006784,2097152 --field-trial-handle=1940,i,14292003683176241414,7405131840167689444,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:1
    3⤵
    PID:3820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2876,i,6333014996264092735,12404140710862641615,2097152 --field-trial-handle=1940,i,14292003683176241414,7405131840167689444,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:1
    3⤵
    PID:4088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3080,i,17346722536334108099,15704293521756688685,2097152 --field-trial-handle=1940,i,14292003683176241414,7405131840167689444,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
    3⤵
    PID:4968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3092,i,14998773016271232923,16864799405888201560,2097152 --field-trial-handle=1940,i,14292003683176241414,7405131840167689444,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:2
    3⤵
    PID:3704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3484,i,16804980279247848019,14441713307080076534,2097152 --field-trial-handle=1940,i,14292003683176241414,7405131840167689444,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3836,i,13164952071380960315,11844747882293507164,2097152 --field-trial-handle=1940,i,14292003683176241414,7405131840167689444,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:2
    3⤵
    PID:3444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa" --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,18376712280696202834,4429270811099956062,524288 --field-trial-handle=1940,i,14292003683176241414,7405131840167689444,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
    3⤵
    PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffd7dd1c188,0x7ffd7dd1c194,0x7ffd7dd1c1a0
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1752,i,11192863263168461705,8230610795156519814,262144 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
    3⤵
    PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,9817726379713517727,179977202873288934,524288 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,13809401654586523752,6848546291642581414,524288 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3128,i,3924573412783800439,10371822958204326396,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3136,i,8229986770809760156,2099384057692670884,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3656,i,17614394042871321512,9789069051944908042,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3672,i,13528833321114205535,13553210305560815928,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:2
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3680,i,12021824265924769921,14180866924202752905,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3748,i,10949884432568303183,5934003113174780835,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:2
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3768,i,1564275286489391948,16853844856018146612,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3796,i,11838696062589734796,2318614797471494128,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:2
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3840,i,13869062511906586052,10060826144486224445,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3880,i,18109886204100375571,7475059599790350996,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:2
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3924,i,7246238282195818271,4672211054913420933,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3964,i,5699246250260729883,130358821130913565,2097152 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:2
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,2356059022290323990,14122625322691332183,524288 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:8
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3176,i,2632384389946324058,9117233982615066161,524288 --field-trial-handle=2252,i,16773739556292128929,6511605831950447453,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
    3⤵
    PID:4328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor\Crashpad\settings.dat
Size 280B
SHA256 62d0e21e261d01fe83555048239d5db7e5dfbd7d7ec3898474997b10e2c43f58
MD5 f69bd4dd42995abe6442249a2dc6ac20
SHA1 3d8fed0f1cafc2764d1468bfb85d967c5892cdf6
SHA512 383c6ae0b271a1a90ecb8239aa305b78897033c537a27dddba13019fed170c39c2b7629c05c9b12c0811d52359d2b1845ff1b60f2619f6da3f0d9803b0aa46b5
TLSH
T1D2D0019CBB899464E8542432A96A8AC54207CA646063A642A8576C969A921A602625AC
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 8KB
SHA256 35bb2f189c643dcf52ecf037603d104035ecdc490bf059b7736e58ef7d821a09
MD5 259e7ed5fb3c6c90533b963da5b2fc1b
SHA1 df90eabda434ca50828abb039b4f80b7f051ec77
SHA512 9d401053ac21a73863b461b0361df1a17850f42fd5fc7a77763a124aa33f2e9493fad018c78cdff63ca10f6710e53255ce891ad6ec56ec77d770c4630f274933
SSDEEP 3:MsEllllkXl:/M/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor\Local State
Size 4KB
SHA256 e99842ed42358a4a0cff37cad5a2dd60effb4fa666ac01f9d5762c25f405205d
MD5 66a6745fa3ae7fe10604a03fc872d3d5
SHA1 2dc4fbfba928fcfb1983070da449d1c1e5d4f3f4
SHA512 22d76651b1b22a30a94528f13ca44fb4fb275c5cf178329c357f9c4f32f06a861ebb700f630f934bb92dd05099d5d61333915bf5ae0d5401207d8b2d595220b9
SSDEEP 96:oqGNkv5QsFfxx6YbL58Frh/cInURoDotovyEDEBrpvwu4OUgEe0eUn+Rb0e+q4a:zGNBoxoooDUwJogvgfq+Npj
TLSH
T1FBA1D7716475EC275EE5A944B8CA37536FA87073E889BF89E5DC1B0C04D7388274AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor\Local State
Size 3KB
SHA256 f2131bc38e93fc634749b1064f5061948ee0dbe34109f5878953389a82a610fe
MD5 eae73b523c1b955781525f79c183d1e6
SHA1 75b853e932268711d1cfcf1bffadce611f2a490e
SHA512 9a228374afb0b31a1d4cc06c7a17facbda66309826a769cc0f735f61f9ebd0c0138ac9383f455e8c803b11b9fbe192254116a97abd92f23161bd3e81816488fe
TLSH
T16081C7716425EC379AE96944B89A3AA34E7870B3EC46EF44E5C9570C04EB35C2B0DC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe583841.TMP

Path C:\Users\Admin\AppData\Local\Temp\fyxkubgn.zor\Local State~RFe583841.TMP
Size 1KB
SHA256 f56ec455145591a1dd61aaed5107eaf4e85259478154beeb00575f37777bd2ce
MD5 7c2d19cd3b4e58c0ee38ebfc9c6d913c
SHA1 fe208ffdd5ce3f28d614cf7de678e1e34421842e
SHA512 129b4133b84e4fcbb60763536bcb0773a13f6cc33388674f9f45846592d62830da5bf3a98e1ba54c6667de2ea72b8e151cc0ed5e7cf9b71250529c927834f1d4
TLSH
T1453195F1A4A82C37F9E05A46F28A6F6B1F74A131919A6F4891DD0A0D05E73DC171EC37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Crashpad\settings.dat
Size 40B
SHA256 94508761cc00312592a61e23ac6307fd024ed487bd490f51060822a892bfe31d
MD5 86905198c899ce6be60d3050b0ce28ee
SHA1 6d93d79d88b73559044b823775a6879c6a6c3e13
SHA512 c41eefcc2a5dbad7d7433fee9107fab7fd44f170754caf3ada7a9acf9875b5bf8c9dd80e272e9dc6898ce799c89ae4b1e05e7680fa2bb5fb8fe81a24068973ab
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 08aeec7a4b2abc2f8965ce430cae75fc1a923f39c6527614f1828f997d9a9ac1
MD5 ee8f0dc864ff08f9e86e5126024de105
SHA1 bfda2761eefd7d6c4e233fa88b523efb4a77ff5a
SHA512 33af75c8185b72f5cbdc017f5b84384eb2420bb39a2de9d536a278869156890d3b9b39743a254b497cc30a055b69560766a21a7006c867534ce77ffbb61c5854
SSDEEP 6:/FoEXEedGDCkNolPYKKlu4IKlPYKKlkf7asRBOd3GkEXmQdkll6+UV:d7X5gDnNolQRlAKlQRlkz03GkEG/
TLSH
T1AF139E6CEA501D13D1E6183C54E7F77143B2C704AA6E17A714B5303B7754722406E676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 1b9fb597e7d9acd5fb1f55df6d97d4e022ebb89fefa416211b5b555525eab5a6
MD5 aa5f2108b0a82c56d497540e2b571730
SHA1 8fd8e9f33269a84416db00a30e18a7e037d17559
SHA512 7c14da2179cf656a0d48e3e8d1b396a60b626c1dd01c2b04f274a5c3c188d4dac27b25c0678b1fdae512296e702a09f9f71450ac539cf9a2ba6a7eeb0f3e6e53
SSDEEP 48:0lzLDfgYFvlaM1XggXFASMmX5dVEPLVBKWwtl:cztxlauggFASj/VOLHKWol
TLSH
T1374485F72801DEC3E715DAB96851922C8E3247221D9EEE76F63844A302509F3312C6B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 cbf012333b4adc46fb184ae700fa5ed2a9fe1d24b87721f6b4719a814556d594
MD5 dfaeca01d26b8424dab4d72573a8ab41
SHA1 059cd5ffa58fa2ebd35c97c290e45247da086a8a
SHA512 3d6f014869b6ec35d0326d11f30103111e25e183cf661caf048008fb952816ff1481dbe34a49dc2dc0f562fd19797d3a550fcfaef57d4e58d900b82b8164fb1d
SSDEEP 48:phLCg1i+Nq5w1Ei9dBVybmzu9G7CCXiwpBTaTxXPetR74OVIsBvppIvF:pU5Hi2bp9MCHXl074AIsBvjw
TLSH
T1BA252A50B9296FD1DB0856B1350AC3E8CE5BC99CB771591B097E6C7CF40C809AB3507A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 a1b00ce3526e9ceb39bb040a507c1227ae1399865ab74ce549c954721aa967d7
MD5 fed9a2233863e3878416e52fdfc26727
SHA1 3df2eb813abef978e836b433279e44ddbd237e99
SHA512 5b7058e16a0c861c01be691dd45776a458ee602f639621e2710e19e4aac2dfe2a5ebbded5bb5e040ce72a8ddb3964d8ca3ff821ff1c626d4c7e8f05c22938e1b
SSDEEP 768:UEfDPLSgcRUv+I4hvxT44Ex54WEUfDPLSgcRUv+8407o4tb7o4i7o4:UeWVnwR9FoQoXo
TLSH
T12D163AE60F28A586EA86EFB0BBCDDD1C3C7022D5FCD36892E123527946E1BC4278515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 0d07a0b70566e690c3f18f7f828c5cdd00ba20eb3ea362ed5359ce9155819c29
MD5 a54dd4d716f70b15d73328f6d964860b
SHA1 a4c5996bfde83a76f99c38455c818d468a607ccf
SHA512 7844c35b0debe3f6232f1d413b605e17bd2dc75da485540af588e1158096e18e1d9c453026ceee9d0077e0c4aacf0b9eb20f43b6bd2275dd53efc975c7f5b727
SSDEEP 768:BOZFN+SgsLEq0ZH6ENhGmRoEg7b3BRHyi9Fmq0:6gsLbsH6ENhjC7LLHhV0
TLSH
T1DEF2F20C86165C97C24E59A1A61F1171540BC5E2EF1DE874A4BF3FCDA2A0C963ACCE19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Cache\Cache_Data\f_000002
Size 67KB
SHA256 50f31d19b1aa0b5ef65e000533d4dbabb9907befa07b6f0ebfbb11d2597c8b83
MD5 df1ca1e1cb004574d666faebe5a13445
SHA1 1d6395dfab6df8ad8e1bad4174bebc7d4c28d8d4
SHA512 c114db5c2a47f04b6c4da4c2e9f5a624ba6c60d879c167a1c5b4818d39b03299dd63d25eba18d8f400e8c6ebceb64a31c8fdec49310765bb399f371d6a2b77de
SSDEEP 1536:bdywojyhnRExdFcIdsDzFgr2F066INt7VdzQSDantp:bOMnRExdCIds/Fgr2O2Zc4antp
TLSH
T10663012B9A0161FBAC35C4FFD6DAC47A9605C78E3D6844FE46C0144E27B5B8E6BC034A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Cache\Cache_Data\index
Size 256KB
SHA256 298b4ce236394cbd6876ecfa14e3ea62266efd5a08b26c8ef0bd5c09a43aff96
MD5 993f31eb207ec00dc47b14167dea3bfa
SHA1 2a02cbf80e6f35bbcc3456c325e09678c8270d4f
SHA512 f289140a41fccb4e0645080d1828b9f090ff85b78eb508835d0ae5c723ed7db8ec421faf70bec987973fad68ee9b930458615065febf1cd5c4b79975da835daf
SSDEEP 3:LsLllFlklNllklkXldIlsKtllSllLll/ncNtlNlXl3Nl/lpllll/ZNtlQlell//:LsRa3lPLKtl4yNtdlllhHlt
TLSH
T1D144112E8380AE02C2C022FC80838BA02338C808CB8F83030300222A2EC03802E0F2A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 f23041d294c146ac8acbc215b2d56bdc9f1130acb9f810e71473e2f66dd8f979
MD5 cc9b3af6408f5daf1356beeba3084b22
SHA1 186fb67b03685b745f42b50b1cc5286392aa59e1
SHA512 16f508f4592f7eb3f267496ad3411cf76506626837f64545a16a5df37c8625706dd9178bba447eb8f8ff7ebb22f0aa05afc724c74ae071f42ba91e4e545a68c3
TLSH
T174E02B82C64C0F1DD32D96F7CDA603054B0B43C42AFE7603A880C2C133164241248522
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f4956f249420a8940aee01061cd38dbcc81cf51d4a345f31b97d84af7b591b36
MD5 4520fac9f806dff4e54155c752e28e9d
SHA1 d6548f2fb0101239393f975f6ac603527c735654
SHA512 eb7efb72d03a84b141173cc965f4ad46277153372ceb1827353ca1fc71c30f303f5b2073a861a25929c200116c6b6e54dcbd8ee6667d64317691adbd4e5a0040
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 36671664286e978debe55484fe6ca832fa4509f90039a2126b6179c1a2110265
MD5 6471762bc88315f631f920e96f048cd4
SHA1 2ed2258e87a1e43b1e65a4803adc3e3df03439e3
SHA512 136c4e59366c16b4326c4f84267acb7156ad61ddc0eb27259e0b84459097f74f0db7efb69c64dfb4d3891a51aa6717dc2fcbdaa94a1f5ee80ab502483b24cfc3
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\DawnGraphiteCache\index
Size 256KB
SHA256 3f74a44a6234f586f4411fe5f67fc1632155bce78dbeb5c1fbdb81ea5fc00286
MD5 3210ab87fde448487125bab20183331b
SHA1 d4a0991f56070d0ee3e85bb53a8770de230a82ea
SHA512 b888440d75b5f1693097371727409aab8039ead4ac932487b3d5de8f94f5a24e018ef1e4e00b9c4b4745a0c08eacae139eacd55b8b1e5281ea6afb539209238a
SSDEEP 3:LstlNllklkXlv:LsX3lPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\DawnWebGPUCache\index
Size 256KB
SHA256 50ad3504821a009335097264e02db8123d293573337d36307e9d637034b97240
MD5 0ab235475def2df70e61d86336b0d878
SHA1 3bc972e462de04e9f2f91c5d01845e6b9af50c04
SHA512 59f5d11e3c0149444de24773c0c0db75a6585052ffeb1db0763341cf18eac3d76a17791e71cee4a7a56170624e55148d6abba82964eb2d5907ccff5e5d8a4803
SSDEEP 3:LstlNllklkXl9GK+l:LsX3lPAK+
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\GPUCache\index
Size 256KB
SHA256 f3a70ae5f4c7471b4dd82943dd1cfe33ef8048725cef19f45a8fe1b59336e58f
MD5 42d7df23e53cbf4bfe95d4290d1bfe29
SHA1 4e3164618572709ff23b1f92887aa49945f6452d
SHA512 212b31e2c199ab000aa95750eb32d37a312d3368877bfd24a98997fd74e9039d9cbe74b50d933bcf5cf05c55abe8a201be50b962d196c968d9d8f70266cca3d4
SSDEEP 3:LstlNllklkXlE+:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 10KB
SHA256 a99acceb13eb9a30ce2abec2430fdc88a126b9411e5eb7e15312fd6b2a88fd0b
MD5 b63b8cfd9981a377a74c57c1f323da4c
SHA1 873d1aa54669a4951bf228edd6894170c9be8d8b
SHA512 72af63998acb5d2ded85fcacf5887b6264206489b49cdef62f6c8c0c75558913973ffe54381acf6aceb3c4c874906bd5834f70c73eeeaa3d59f431f809d00e0a
SSDEEP 192:QORKXKKUEUu3gaYllgqJIUwNTvyDJPs/9QLP0J:QKOKKaL2yDJPse0
TLSH
T15C22D74A87F702A59065D1756F8F61839629811F2A19F54E3CDE43B46F06B3092FEFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb013792b196a35_1

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Size 6KB
SHA256 dd618b52eda57ef47dcdb654e9dbe4c1085ff7219e45a78b6f98730ae601017c
MD5 03d2f0ece50763b57d1081d382f978b1
SHA1 28310dd7a845adc2f10047ccf28e5ac01b006ce1
SHA512 9f97366a06e47759a95fe263f387595e62918521d217e16ac0109cd0762da4d97e20faca547412120a5496567dab5b6eb1bae1edc3490e83092a33742722562b
SSDEEP 192:E6dUlGlL13Xn0uqkSnTrT6n6A+t16t9HD996:tdzlL1Hnjq7TrT6n6nt2P
TLSH
T154E1E89283329627CB2543FB41A7925333FD5548BFC2E12A6DA697E52C123F278DDD01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1f2895ec8a05076df81eb93335984f4acd7c2d902f6c74bb4e84685ac00d380e
MD5 ff962f716aa7c4c7d800fb76187f7676
SHA1 462cbbcc911ba05092bcf2530fc447d2c9b9f282
SHA512 35f6852d1a253741724e6d02f88780c02699af9b633aa727fc8177b089ea77fd63af6d56586155f2af1c12d23c47c522c7624be3a9f7ee78db9e76a619a64ed1
TLSH
T13FA0022196408111D99803B02C81C7CC1211FA65C084021377D0034B8C6045159A219A
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 84d65429a5ebd4987e3a208d3ba31fd64c136035b5c057af02380686a2d8aea4
MD5 d90d5e082f3864ae142814676c8f8eb0
SHA1 c9fc6e3c42a748e0fcbc11543b032a7403b4fe67
SHA512 4a57d5f3d8f1af742f9d66cc3fed39e38de6a932e99e866ba1ed7612e933e1c85fc7e6cde306d25d154470f9160c36ec6da7fa34499ef8eb2473e64845df5102
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\GraphiteDawnCache\index
Size 256KB
SHA256 eb4117bdc35824227d5ee2863f3a1358bd45a1a96177b29be0f4f887adcf63bf
MD5 3cc6d824189b7d6f25374a9938ff313d
SHA1 f827ffded32ffe276a857b87a8f59b230ce5de4d
SHA512 b61836c97580c8ae705a09c88a5669fe565592646b9e7d395fc369a0030df06fd646b2d92ae934d75afa2f0641de33d97aa0001b79881f23691a02ac771418aa
SSDEEP 3:LstlNllklkXl3:LsX3lP3
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\sthl4kl4.kqa\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1560-154-0x000001FCB9130000-0x000001FCB9282000-memory.dmp

Download

memory/2164-426-0x0000016AEA600000-0x0000016AEA752000-memory.dmp

Download

memory/4424-444-0x0000000036030000-0x000000003604E000-memory.dmp

Download

memory/4424-152-0x000000002FC40000-0x000000002FD40000-memory.dmp

Download

memory/4424-153-0x0000000002D60000-0x0000000002E60000-memory.dmp

Download

memory/4424-157-0x0000000002D60000-0x0000000002E60000-memory.dmp

Download

memory/4424-438-0x0000000002D60000-0x0000000002E60000-memory.dmp

Download

memory/4424-424-0x000000002FC40000-0x000000002FD40000-memory.dmp

Download

memory/4424-425-0x0000000002D60000-0x0000000002E60000-memory.dmp

Download

memory/4424-53-0x0000000000910000-0x0000000000990000-memory.dmp

Download

memory/4424-442-0x0000000033D50000-0x0000000033D62000-memory.dmp

Download

memory/4424-447-0x0000000000910000-0x0000000000990000-memory.dmp

Download

memory/4424-443-0x0000000037180000-0x00000000371F6000-memory.dmp

Download

memory/4424-13-0x0000000035DB0000-0x0000000035E00000-memory.dmp

Download

memory/4424-12-0x0000000017E50000-0x0000000017E60000-memory.dmp

Download

memory/4424-11-0x0000000033B60000-0x0000000033BF2000-memory.dmp

Download

memory/4424-10-0x0000000036060000-0x0000000036604000-memory.dmp

Download

memory/4424-9-0x0000000033A50000-0x0000000033AB6000-memory.dmp

Download

memory/4424-8-0x0000000033910000-0x000000003395C000-memory.dmp

Download

memory/4424-7-0x00000000338B0000-0x00000000338FC000-memory.dmp

Download

memory/4424-6-0x00000000338A0000-0x00000000338A6000-memory.dmp

Download

memory/4424-5-0x0000000033700000-0x0000000033852000-memory.dmp

Download

memory/4424-4-0x0000000019D00000-0x0000000019DCA000-memory.dmp

Download

memory/4424-3-0x0000000019CA0000-0x0000000019CF8000-memory.dmp

Download

memory/4424-2-0x0000000017E50000-0x0000000017E60000-memory.dmp

Download

memory/4424-1-0x0000000017D60000-0x0000000017DCE000-memory.dmp

Download

memory/4424-0-0x0000000017E50000-0x0000000017E60000-memory.dmp

Download