Overview

overview

8

Static

static

3

_3e982ec9e...93.exe

windows10-2004-x64

7

_3e982ec9e...93.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/06/2026, 14:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _3e982ec9ece55bc3e565186182caea369338d277c078f4380fe2258342ca4893.exe
  • Size 1.1MB
  • Sample260622-r28etsdv81
  • SHA256 3e982ec9ece55bc3e565186182caea369338d277c078f4380fe2258342ca4893
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecollectiondiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs
    collection
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\_3e982ec9ece55bc3e565186182caea369338d277c078f4380fe2258342ca4893.exe
    "C:\Users\Admin\AppData\Local\Temp\_3e982ec9ece55bc3e565186182caea369338d277c078f4380fe2258342ca4893.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:4568
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf"
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb1f30c728,0x7ffb1f30c734,0x7ffb1f30c740
        3⤵
          PID:2456
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,14294447896719315026,17101641187827880057,262144 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
          3⤵
            PID:1420
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --force-high-res-timeticks=disabled --metrics-shmem-handle=1972,i,6034290715794404872,597389964105302073,524288 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
            3⤵
            • System Time Discovery
            PID:2464
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --force-high-res-timeticks=disabled --metrics-shmem-handle=2132,i,6843669475142403839,10946894804515476492,524288 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:13
            3⤵
              PID:3724
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2924,i,9581145658799841138,4445290715578757905,2097152 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:1
              3⤵
                PID:2656
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2700,i,18272440125200093059,7972532017634139765,2097152 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:1
                3⤵
                  PID:2312
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3208,i,5024999675601547507,1073892714802907700,2097152 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
                  3⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4128
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3220,i,10802246051082643480,3809741020421701064,2097152 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:9
                  3⤵
                    PID:5008
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3732,i,12185097862260453883,3664582968954577927,2097152 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:9
                    3⤵
                      PID:3036
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4232,i,9323913159366398862,7087601079748181698,2097152 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
                      3⤵
                        PID:5680
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --force-high-res-timeticks=disabled --metrics-shmem-handle=4372,i,634900603245428966,9199060487086197429,524288 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
                        3⤵
                          PID:1516
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --force-high-res-timeticks=disabled --metrics-shmem-handle=3200,i,12495609270504111960,2931020114701726791,524288 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
                          3⤵
                            PID:1656
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf" --force-high-res-timeticks=disabled --metrics-shmem-handle=4472,i,647314318970679896,3870058733073424236,524288 --field-trial-handle=1900,i,8530513031094491130,10408396306976254091,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
                            3⤵
                              PID:5660
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                          1⤵
                            PID:4400
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            1⤵
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of WriteProcessMemory
                            PID:1980
                            • C:\Windows\explorer.exe
                              explorer.exe /LOADSAVEDWINDOWS
                              2⤵
                              • Boot or Logon Autostart Execution: Active Setup
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              PID:2768
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1180
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:888

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Active Setup

                                1
                                T1547.014

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Active Setup

                                1
                                T1547.014

                                Defense Evasion

                                Modify Registry

                                2
                                T1112

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                2
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Credentials in Registry

                                1
                                T1552.002

                                Discovery

                                Browser Information Discovery

                                1
                                T1217

                                Peripheral Device Discovery

                                2
                                T1120

                                Query Registry

                                4
                                T1012

                                System Information Discovery

                                3
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                System Time Discovery

                                1
                                T1124

                                Lateral Movement

                                Collection

                                Data from Local System

                                2
                                T1005

                                Email Collection

                                1
                                T1114

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                prep_Activatable Class_Hermes_perf.cache
                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                • Size 599B
                                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                settings.dat
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Crashpad\settings.dat
                                • Size 40B
                                • SHA256 27c9a41e8a6c9f8f1991e4102a02236b51d3c1ef973483e9daad81a07fc4af41
                                • MD5 SHA1 SHA512
                                Submit Download

                                data_0
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Cache\Cache_Data\data_0
                                • Size 44KB
                                • SHA256 683319896e2af43c8b3a070a39f32340ad1e1af8bdca721961dc6df857200c98
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                data_1
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Cache\Cache_Data\data_1
                                • Size 264KB
                                • SHA256 6be1de771ff7662986bc083f8f482fd886cb6c2c500c2e37c32f8067c643471e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                data_2
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Cache\Cache_Data\data_2
                                • Size 1.0MB
                                • SHA256 7b5b2bd8bfdaf7d08aab7b3d0e364b34fc8494cc893936feb6347ae5f1e4ee90
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                data_3
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Cache\Cache_Data\data_3
                                • Size 4.0MB
                                • SHA256 41291c65af55b0d9c0cbc829f3a55dc68a9779cab34670bb113de986b0f38144
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                f_000001
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Cache\Cache_Data\f_000001
                                • Size 31KB
                                • SHA256 6ba4bd0705d8e029ca84d92ebe878002e7a1437d362f413afe075dce52a109d5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                f_000002
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Cache\Cache_Data\f_000002
                                • Size 35KB
                                • SHA256 3317dfcac78bde3c4ec74ac180749a13a43b46eaaaeceed4c1474d9d525309cb
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                f_000003
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Cache\Cache_Data\f_000003
                                • Size 68KB
                                • SHA256 6dab77d2ec69288c4f4741b0c3027b813a2036250c07fcae68cde0418ba95f0b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                index
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Cache\Cache_Data\index
                                • Size 256KB
                                • SHA256 8e9126c13c74958e9fad2333cc6cf5abaa49d82ad230e0f73e0c953ba734e6cf
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ba678a2fbd8c358c_0
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Code Cache\js\ba678a2fbd8c358c_0
                                • Size 298B
                                • SHA256 1ea533ea8254ede85b9666f2036d10ca3ca85eab847a3f951aee3e1c21dcb762
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                the-real-index
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Code Cache\js\index-dir\the-real-index
                                • Size 48B
                                • SHA256 f75217468662e5d659754d8edbc28e6bc0e35be221da5320a1f6fe73b31c7f42
                                • MD5 SHA1 SHA512
                                Submit Download

                                the-real-index
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Code Cache\wasm\index-dir\the-real-index
                                • Size 48B
                                • SHA256 50398117137ef3111a81101903b7b166eefd6bd4c7102588bd01285ece9b1511
                                • MD5 SHA1 SHA512
                                Submit Download

                                index
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\DawnGraphiteCache\index
                                • Size 256KB
                                • SHA256 7d4367a1478af05e1d68d36ec0e79d757479a6125ce17ed9d1a94b8892c616c9
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                index
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\DawnWebGPUCache\index
                                • Size 256KB
                                • SHA256 7adce908d9c4632be4a66fe2c0ab91fefd80a15760c84e2607f95af6ecd3ff13
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                CURRENT
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Extension Rules\CURRENT
                                • Size 16B
                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                • MD5 SHA1 SHA512
                                Submit Download

                                MANIFEST-000001
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Extension Scripts\MANIFEST-000001
                                • Size 41B
                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                • MD5 SHA1 SHA512
                                Submit Download

                                index
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\GPUCache\index
                                • Size 256KB
                                • SHA256 8e4f613c6fafceb5300915cb049a445c09b759406b429a21176b0ce95d9973f0
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                SCT Auditing Pending Reports
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Network\SCT Auditing Pending Reports
                                • Size 2B
                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                • MD5 SHA1 SHA512
                                Submit Download

                                README
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\README
                                • Size 180B
                                • SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                dark_logo
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Search Logos\dark_logo
                                • Size 15KB
                                • SHA256 b50d5a1819d5750116692fbc2d84aa7da7bcad565289b868ad5594970e8b3641
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                logo
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Search Logos\logo
                                • Size 15KB
                                • SHA256 29f6300c243e7df4cbf0d5a85a3fefbee35f27512f45ea69e60bfbbb93303a29
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                metadata
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Search Logos\metadata
                                • Size 1KB
                                • SHA256 76684fcee78b8f4159592d50a98c1c5ed9fb67969f24055a6a4e3874afe055e9
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                2cc80dabc69f58b6_0
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
                                • Size 472B
                                • SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                the-real-index
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                • Size 72B
                                • SHA256 83ed1a337be3462f58ea8f8fd730bf1923531371f92fef48d99c2b90bde349a8
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                index
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Shared Dictionary\cache\index
                                • Size 24B
                                • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                • MD5 SHA1 SHA512
                                Submit Download

                                the-real-index
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\Default\Shared Dictionary\cache\index-dir\the-real-index
                                • Size 48B
                                • SHA256 c688380a01c49eed4a66eff2a248b541e0ab493b481f93074ef8278d6af41573
                                • MD5 SHA1 SHA512
                                Submit Download

                                data_0
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\GrShaderCache\data_0
                                • Size 8KB
                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_1
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\GrShaderCache\data_1
                                • Size 264KB
                                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_2
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\GrShaderCache\data_2
                                • Size 8KB
                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                data_3
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\GrShaderCache\data_3
                                • Size 8KB
                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                index
                                • Path C:\Users\Admin\AppData\Local\Temp\3fwuaa3c.ktf\GraphiteDawnCache\index
                                • Size 256KB
                                • SHA256 cabd2bf7201022c375fa10b0a919d007a2462baebec2745459094990139a95e1
                                • MD5 SHA1 SHA512 SSDEEP
                                Submit Download

                                memory/1180-258-0x000002E294290000-0x000002E2942B0000-memory.dmp
                                Download

                                memory/1180-212-0x000002E2801E0000-0x000002E2802E0000-memory.dmp
                                Download

                                memory/1180-227-0x000002E282E90000-0x000002E282F90000-memory.dmp
                                Download

                                memory/1180-225-0x000002E282A30000-0x000002E282A50000-memory.dmp
                                Download

                                memory/1180-244-0x000002E282D70000-0x000002E282D90000-memory.dmp
                                Download

                                memory/4128-149-0x00000244AEF20000-0x00000244AF012000-memory.dmp
                                Download

                                memory/4568-11-0x00000000077E0000-0x0000000007872000-memory.dmp
                                Download

                                memory/4568-8-0x0000000007480000-0x00000000074B2000-memory.dmp
                                Download

                                memory/4568-7-0x0000000007000000-0x00000000070F2000-memory.dmp
                                Download

                                memory/4568-6-0x0000000005AA0000-0x0000000005AEC000-memory.dmp
                                Download

                                memory/4568-5-0x0000000005940000-0x0000000005A18000-memory.dmp
                                Download

                                memory/4568-4-0x00000000057C0000-0x000000000583C000-memory.dmp
                                Download

                                memory/4568-3-0x0000000073770000-0x0000000074A56000-memory.dmp
                                Download

                                memory/4568-2-0x0000000005570000-0x0000000005636000-memory.dmp
                                Download

                                memory/4568-209-0x0000000073771000-0x0000000073862000-memory.dmp
                                Download

                                memory/4568-210-0x0000000073770000-0x0000000074A56000-memory.dmp
                                Download

                                memory/4568-1-0x0000000073771000-0x0000000073862000-memory.dmp
                                Download

                                memory/4568-208-0x0000000007790000-0x00000000077A2000-memory.dmp
                                Download

                                memory/4568-9-0x00000000075D0000-0x0000000007636000-memory.dmp
                                Download

                                memory/4568-0-0x0000000073770000-0x0000000074A56000-memory.dmp
                                Download

                                memory/4568-10-0x0000000007E50000-0x000000000840A000-memory.dmp
                                Download

                                memory/4568-12-0x0000000007720000-0x0000000007770000-memory.dmp
                                Download