af938b992a46781adb7d58889dede566d751d1af9cb79e00476d91edfca89d4a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0000000151908257_signed.pdf.exe
Size 1.5MB
Sample260804-pw13fseq8t
SHA256 af938b992a46781adb7d58889dede566d751d1af9cb79e00476d91edfca89d4a
MD5 5510274ddccea5a463af2ea84ad15d02
SHA1 cbb02b4a3aeccab9c1abc0c82fb61d4bce785545
SHA512 07b50e2e55eba3eb1da619b16a31c919ee71e65be2ca033a19ef4437dbfbe9ce06d0cfd76e8044a6d67045457e4ab8160c90f4c2c98e3e9b7d778b37a0d3702d
SSDEEP 49152:e/3DmD9eTxuoX3wzrB6j7qoVzGomXn/eImKwPrb:i34ekM3Ai7xM/durb
TLSH
T153752358825ACC23ECDA53B95AB5D77613618E8EF02BD3A397FDAEEB35201181C047D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0000000151908257_signed.pdf.lnk	0000000151908257_signed.pdf.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 39 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook	0000000151908257_signed.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	0000000151908257_signed.pdf.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/4768-5-0x0000000005880000-0x0000000005894000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 5384	4768	0000000151908257_signed.pdf.exe	86

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0000000151908257_signed.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0000000151908257_signed.pdf.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
908	chrome.exe
4644	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
3140	chrome.exe
3140	chrome.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
3140	chrome.exe
3140	chrome.exe
3140	chrome.exe
3140	chrome.exe
3140	chrome.exe
3140	chrome.exe
3140	chrome.exe
3140	chrome.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5384	0000000151908257_signed.pdf.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe
5888	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5384	0000000151908257_signed.pdf.exe
Token: SeShutdownPrivilege	3140	chrome.exe
Token: SeCreatePagefilePrivilege	3140	chrome.exe
Token: SeShutdownPrivilege	3140	chrome.exe
Token: SeCreatePagefilePrivilege	3140	chrome.exe
Token: SeDebugPrivilege	3140	chrome.exe
Token: SeDebugPrivilege	5888	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3140	chrome.exe
3140	chrome.exe
1452	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 5384	4768	0000000151908257_signed.pdf.exe	86
PID 4768 wrote to memory of 5384	4768	0000000151908257_signed.pdf.exe	86
PID 4768 wrote to memory of 5384	4768	0000000151908257_signed.pdf.exe	86
PID 4768 wrote to memory of 5384	4768	0000000151908257_signed.pdf.exe	86
PID 4768 wrote to memory of 5384	4768	0000000151908257_signed.pdf.exe	86
PID 5384 wrote to memory of 3140	5384	0000000151908257_signed.pdf.exe	92
PID 3140 wrote to memory of 5720	3140	chrome.exe	93
PID 3140 wrote to memory of 552	3140	chrome.exe	94
PID 3140 wrote to memory of 908	3140	chrome.exe	95
PID 3140 wrote to memory of 5064	3140	chrome.exe	96
PID 3140 wrote to memory of 5788	3140	chrome.exe	128
PID 3140 wrote to memory of 3708	3140	chrome.exe	98
PID 3140 wrote to memory of 3232	3140	chrome.exe	99
PID 3140 wrote to memory of 5876	3140	chrome.exe	100
PID 3140 wrote to memory of 3412	3140	chrome.exe	101
PID 3140 wrote to memory of 2524	3140	chrome.exe	103
PID 3140 wrote to memory of 3636	3140	chrome.exe	105
PID 5384 wrote to memory of 3140	5384	0000000151908257_signed.pdf.exe	92
PID 5384 wrote to memory of 3140	5384	0000000151908257_signed.pdf.exe	92
PID 5384 wrote to memory of 1452	5384	0000000151908257_signed.pdf.exe	108
PID 1452 wrote to memory of 4900	1452	msedge.exe	109
PID 1452 wrote to memory of 4728	1452	msedge.exe	110
PID 1452 wrote to memory of 4644	1452	msedge.exe	111
PID 1452 wrote to memory of 956	1452	msedge.exe	112
PID 1452 wrote to memory of 3736	1452	msedge.exe	129
PID 1452 wrote to memory of 5024	1452	msedge.exe	114
PID 1452 wrote to memory of 2852	1452	msedge.exe	127
PID 1452 wrote to memory of 432	1452	msedge.exe	116
PID 1452 wrote to memory of 1044	1452	msedge.exe	117
PID 1452 wrote to memory of 856	1452	msedge.exe	118
PID 1452 wrote to memory of 1104	1452	msedge.exe	119
PID 1452 wrote to memory of 1512	1452	msedge.exe	120
PID 1452 wrote to memory of 3536	1452	msedge.exe	121
PID 1452 wrote to memory of 4996	1452	msedge.exe	122
PID 1452 wrote to memory of 5888	1452	msedge.exe	123
PID 1452 wrote to memory of 4020	1452	msedge.exe	124
PID 5384 wrote to memory of 5888	5384	0000000151908257_signed.pdf.exe	123
PID 5384 wrote to memory of 5888	5384	0000000151908257_signed.pdf.exe	123
PID 1452 wrote to memory of 2852	1452	msedge.exe	127

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	0000000151908257_signed.pdf.exe

C:\Users\Admin\AppData\Local\Temp\0000000151908257_signed.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\0000000151908257_signed.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\0000000151908257_signed.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\0000000151908257_signed.pdf.exe"
  2⤵
  - Creates a file in the Startup directory
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbc783c728,0x7ffbc783c734,0x7ffbc783c740
      4⤵
      PID:5720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1732,i,6794486055656894101,13992200720487719597,262144 --field-trial-handle=1904,i,3616056664891733612,7413949422183827339,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
      4⤵
      PID:552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p" --force-high-res-timeticks=disabled --metrics-shmem-handle=2032,i,3269889837813394207,3647573322302170447,524288 --field-trial-handle=1904,i,3616056664891733612,7413949422183827339,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:3
      4⤵
      System Time Discovery
      PID:908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p" --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,10276914335559060580,18057630659284154585,524288 --field-trial-handle=1904,i,3616056664891733612,7413949422183827339,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
      4⤵
      PID:5064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2812,i,546674138441617,13143252241681240810,2097152 --field-trial-handle=1904,i,3616056664891733612,7413949422183827339,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2816,i,4037831563589740765,5894061537613932239,2097152 --field-trial-handle=1904,i,3616056664891733612,7413949422183827339,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:1
      4⤵
      PID:3708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3052,i,16889404712447424909,2385108668429789609,2097152 --field-trial-handle=1904,i,3616056664891733612,7413949422183827339,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:1
      4⤵
      PID:3232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3064,i,17103300060755247560,3555309947874462539,2097152 --field-trial-handle=1904,i,3616056664891733612,7413949422183827339,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:2
      4⤵
      PID:5876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3628,i,4092093247880885267,16477645333161169339,2097152 --field-trial-handle=1904,i,3616056664891733612,7413949422183827339,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:2
      4⤵
      PID:3412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4060,i,367378760627141921,12550113187341225162,2097152 --field-trial-handle=1904,i,3616056664891733612,7413949422183827339,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
      4⤵
      PID:2524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p" --force-high-res-timeticks=disabled --metrics-shmem-handle=4216,i,15979462609263718470,12988340442736311062,524288 --field-trial-handle=1904,i,3616056664891733612,7413949422183827339,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:8
      4⤵
      PID:3636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffbb09bc188,0x7ffbb09bc194,0x7ffbb09bc1a0
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1616,i,17174769188593679618,16358287385234093809,262144 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,9840277209339514757,9777618711920022552,524288 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      System Time Discovery
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,10616635523888844936,12640348720527153107,524288 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:8
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3060,i,15874905903504448893,12484902720630850715,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3064,i,2448515750734886272,5954070316117388327,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3568,i,11080505295364168242,4544630965952262095,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3616,i,14506213941674487730,9789752554529837509,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:2
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3636,i,5387813776386034743,2048792374689880223,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3684,i,10492121746523118446,10891947615771569770,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:2
      4⤵
      PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3648,i,13511862435894105151,2747302458784341703,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3736,i,3704325021605746482,3870658366045956576,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:2
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3764,i,9970679824725016838,9561526715862580911,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3824,i,5481474680165950014,17356686839434572975,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:2
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3856,i,3875867063277556335,9955756432991778465,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3880,i,17959786794074706868,14964190661632737170,2097152 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:2
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,1973228774475177511,10848195499358702485,524288 --field-trial-handle=2192,i,12055097153329784182,17521595682231999225,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
      4⤵
      PID:2852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:5788

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0000000151908257_signed.pdf.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0000000151908257_signed.pdf.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
TLSH
T104219B303222B5D84D022F530C0869C513EF4759BB64EE2CB959231EDD2A457AB211E3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m\Crashpad\settings.dat
Size 280B
SHA256 fff79c0ee9b1c30f60dc9ccb4560b2021344a82c53b50ef10a63974ee41d72af
MD5 2853acb901ccb1f0e2bdd45aa22d96e4
SHA1 35cd17ec7897f07b3e259f9365f6ad997f0c999c
SHA512 d67907571dc7131b2cfce2991743bc755abee4cb168628e74d883a64aeec68254e1923c5b3a41d208c41a0ad836cf70b40d9b67ab0ab32a4e08436bc79949b78
TLSH
T1B0D01122B28AB008C0AF233A2A288A088E008808880A0AA080A2008828E8020222A03B
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m\Local State
Size 3KB
SHA256 65b51eeaf442c31ebd646832252ab26530c09ed59949adb8b2f00f1808e311ec
MD5 5961da76ceb7026424a233071b28bc64
SHA1 227443a201776fe84796933e0572409b4eaffa37
SHA512 aa41e66f56e856f71bbd9e2f6ed2a389a006df7fe7b4940efab7dfb576f42219f735e5131bdc144ff50fd4553efbd612928bafa46cb499314dacceca3862ae16
TLSH
T10A81B7717424FC3B85E96548F49A3AA39E787073EC51AF54E2C9631801EB3482F4E827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m\Local State
Size 4KB
SHA256 a137d9bd10a066c3aa71f394ae97d1d0adc0c56e2c48ff73565e179505a698b9
MD5 43ac7d433eafe87b7dcc06eca8d1643a
SHA1 f1083fa9fcebe709608a8e01008b07d513ef8fdd
SHA512 cb10fe370ca6c521e0e5e823aabe0e4aca3e5af7c8695d8b34595807a1470392627a32cc75a4af9c91fd6661baecfb4f9db510419c13c5446dedbf5cf57c0c09
SSDEEP 96:lqGNk4QsFf1+urVS58Frh/cInURoDotovMRDLBjeve/cSPC0eUnnH7q4a:cGNoYNrfooDUwq1VcSaqnU
TLSH
T174A1A8716424FC2B49E5A908F4D63793AFA47033E895BF98E2D81A1C01D73842749C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe585ec5.TMP

Path C:\Users\Admin\AppData\Local\Temp\tq12qpgz.g4m\Local State~RFe585ec5.TMP
Size 1KB
SHA256 435a0efc08adec0d8788e32560482c35f38a857d81caf0d07b44d3a391bc453b
MD5 59152ed35d1db1438cbf6dea1e821470
SHA1 6fd236713632d8083f790df87fa08e5ac044dfb6
SHA512 6c6f545392f99ebf02285bddba7dd0a799fa6b4cc6e4a54fdf20f9c1cbb254a0ffc069f0e60f147360aa2c9bb4f7438b01ddd9262a866ea071d916648c097ef8
TLSH
T18531977078247C7BD4E5420DF24EBE636F74B13190A56F9882DD612C12E328C154E83B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Crashpad\settings.dat
Size 40B
SHA256 fb3e69d1a15f49f1d2a27687a52b51d4701ac213f76e698405638f748722ba7c
MD5 f94d0afd00919895352aa547a6f26415
SHA1 aadbeb6c47418b6cf6a1c45393409e024ed0121e
SHA512 dc6733a0d6d85efc80a2b638308d30cca7dab86085ab833f1773a6d71d3b482b8018f265050eb904e9b58f1659f0025f04ed958cf7758fcbc627d68e6ced6874
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 0261befb70cdd68bf63b4721771fe1d94eedbb4e2e792ff7a4ef06679237d92f
MD5 0a5b4d04630f5c7dfe5e9c00cb126a5b
SHA1 f2b5affd3e9f0433f5c10f4f408a424b43fccaf2
SHA512 4e482e5a3e8797cf043251d30d4f92131058e976efda241cc5181ccb8672679d5c39431dd86a2134a8e5782a66bb9036e50394d15b27954367f258ca4eaface5
SSDEEP 3:MsFl8lhtllKlll6llPLGyCkell/K2Xw6nD2wrPQDnrKlAplE1ll1hflVluYRmHBp:/Fii2RLZCkeqWwUr5sk5MYRiyYYE
TLSH
T1E71312BFA2877D03C245043C59CB9B740337B159B922C253816CEE51FCEE751C0682D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 a78a910f45f2778d229e176828c130bbbf122fb002ad4532cfe85d64e4095cc0
MD5 6af72b4935dcbfa429d91a678a480ffb
SHA1 a09056bda1704a629cf6bf3fe7c2c1bc884b2b29
SHA512 6c73950d4e7aad2eea8f29b738051077c2edf71404f475bff01e364601f2cb52092a7e49e08701919b5c11b4e48755000ab3ab8786e5ec2417414f2ee85c5497
SSDEEP 24:7CFolkUE/fdYJkf2lk3z/mizblQZnuinw6M1CwNO:molK9YSP3zlblQZM1Xg
TLSH
T13B44F1E738065A87DB18DBF41940513C8D33D1163CAADDBEF52505F29544EE2B1789E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 27dbbec63bc923baf0e9144dc1eebf6b375e0632ee8f347ad8364593aa100819
MD5 99924bddebfd974faa5127e07ecf670d
SHA1 54046e0b28c9680a25c722cdfb33bff240096327
SHA512 52cf43f9d075cf2d0e4409c31ae94a80e0a661ab2f2a6485ff24f4cda383fe2233b1e19a72522f759aab4858b457132160774c16fe2b64e30f99c0270ba2a5ba
SSDEEP 768:hUfDPLSgcRUv+94iUfDPLSgcRUv+b4tUfDPLSgcRUv+S4:BBf
TLSH
T174162CB64F64798BD781DBB0ABC8DE183CB122C9EC925C92F521A3594BE4FC41BC521D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 bfb6a52abf5ca62a6485e9a2b36aa5142298e9449bcedfbccb02ae66a0881e14
MD5 4b12d6b7d1be0569e66691d4e7cfac17
SHA1 bb8287253cb2b77f91bbcc3c12434152a9142f34
SHA512 7d84f0570073e081610b13ae68a0d4b77c3d14958f5c63a7d52233e912ab64dcd14f3fd008804258cef2fbf6770b622a1a9149835a32bc7e821404b4d07f4f94
SSDEEP 768:/bgF36neLkw7LJVmzL2+9BnrrtXhkJDLC0rt0tvlMyYA:EBuehsf2+fvtXjMtoiA
TLSH
T1EF03F17C72EA8398109D32A14F55E6EB89BE24D43346F9B79F7091E186C1B3D3946330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Cache\Cache_Data\index
Size 256KB
SHA256 1dd2e5b4e039f99af5e8de6a7356b2818334d90c5cf94859e30aa56b33dc8d92
MD5 f04338d47a0f5793a74611ef08798bfb
SHA1 14e94e70a249f24429a4c640ad9409784ad294e7
SHA512 afd979b44bc8e3489fc8dd09fefbda3887da109fa3c7092f087c3482e09745699f2dd340262523691f8eb17619d4b4b0d676b717d5aa7c6e1e06717fb09fca6a
SSDEEP 3:LsBltfltlNllklkXloBQt/6ltLll/ncNtlNlXlsE/5NtlQl:Ls513lPo16NGEB
TLSH
T17344012AEB869D09D2C005BCC82787712B28C48EC59A8387034856602CC27A98FAE181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 6b02eb37bf448cab89bce807fd504f0679458908ee3136f1a38d0e328e3ee5bf
MD5 2ab9a722f22cd3a6a56e6c926f7cb787
SHA1 8244c370e4602354b39e651d746c008a92aae626
SHA512 886413ad0ce3a695dbdca1f98195be8e51ca37395dc04b171953b9a92f8caa964c5b67cb3dfc3a9cb90c80aeb5fdd16a360309f20c8c724beadc56aa056c5b74
TLSH
T16CE02B81824C0F0DD32D96F7CDA603044A0B42C42ABE3603A880C2C137129741248622
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 3f9e97df0d77bd46c9e2f145fd4a5f94040b8195f3be05eeec4774861249b347
MD5 61ecfbdb558e5942c30e37876594d46f
SHA1 a278d74dc58b78746436249847fef34abec0442c
SHA512 92e10752ee1080a932055b7347ad85681fb96ce293f27b1b2a2cab147b740832a90acd34f0807419847fd2f7dbc0effd0f732967e3f005eaae38f7883a1a1019
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 771349619c451a1cdc5afd6826a5acdd7c0dba8ee38f7bb03610ff63f163f6a1
MD5 e632c3aa2b4b979b00bff3f2d281c6b4
SHA1 dfa5bd824e418b3916d51bd48f8c32540771dcba
SHA512 3c04cbdfac84b5d7571c0cec473c90b50980a81f5bb23f36bfa1985348d27f2eba78df33d7e615c1e382fd1ff6a2e3be58fd56e7289a07c6ca8a546ff49e277c
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\DawnGraphiteCache\index
Size 256KB
SHA256 25533419c19894f1421dd8b6217d776332fde1d6d207e16af5f6e5f991dcef5c
MD5 51c73333bf269af54d9a2fb55741fd64
SHA1 8e5a899bd55f47a53690f5039cda6dc9b8bb1834
SHA512 7668b92c18bdcf3070178a9f7ba8b884029c3aefad401789a800d10f07f4321f26230865a486dc8943f694a03656bd6b691e3a0a251938fa7569c5a15fc28cae
SSDEEP 3:LstlNllklkXlhEp:LsX3lPQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\DawnWebGPUCache\index
Size 256KB
SHA256 c2003521e0157ab158e9734c84b3b0055c13694e26fcf72ae7369cab8b0697f1
MD5 858307fffc443b191a80d664a81b2fd6
SHA1 305d48003feab17ec828a7a2115ecbf74ff8d3dc
SHA512 2f7a85fe433e7b7d63fee55948fab47d61fd8a3f90410de0b9e63ad483eeca4fe5097578555cdd0c564d52c3ac0b9c1ac1969c1cc575c15f8d1c59ae373fde6f
SSDEEP 3:LstlNllklkXlCe:LsX3lPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\GPUCache\index
Size 256KB
SHA256 89d7e54aa1402c9ca5ab2f152c6f8d665d687cc119aa12673ef4e29458938f2d
MD5 f873ebc2c810ead78fb020e1be3c116c
SHA1 8efce5b79d9deff1823a517dff23ff81d4b1df9e
SHA512 a3586368605de28ca2968a187a01d639e1e6fad82bf60aa704b3bac3c7551939a6f19471e42144ab00a922cfc16c23e13df7a45a6ee4eb94111f3c6de6c4df7e
SSDEEP 3:LstlNllklkXlSiKl:LsX3lPl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b0a2f9b872b16195a96581ace91e009ab0c456f4a533cda97e095e7f217f7490
MD5 c482ab5b1c3ec26552a4a6cfa9934115
SHA1 2fbcddb86e15f7aa49d1357a141613673cc78b1d
SHA512 9e8364aa64e4156b1a03f5175da343a843f5fe633bf40e1c404e52b1c6a2649e5e68b15533a67d7d9fb4e30ddbaac161d6f65a9d092686ea7eee44e041095857
TLSH
T10BA002917245C520C95402B02805C7995200BA358000421377E053C68C61090CA61144
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 83c35160bd3bacc92699b13cfad12f4e18631adb8bc95bb945b8f4ec04459afa
MD5 bedf18785b14a6b23031b0d2e9c9011b
SHA1 14fdfdd66891f0b2aeed4aead0845a6e5ede6aee
SHA512 74f0a96ccbf0257416f754927b7d71de33ee9b3eee0ae0decdfc101345237a9e925fcd6d9fb7cc6444ac0e88cc4d7890a00b86bc9c4bddc87213ba43f8f419b8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\GrShaderCache\index
Size 256KB
SHA256 0e292aed4a35e05f4dae7b8334b3b56b3a93b37a6b64882aaa1bac79ea190d19
MD5 5a383ba2e94faa2aaff05ec0bd2f8c41
SHA1 0ef8e4bc4ec3aa3af5467fb630c58261b63bd269
SHA512 e4ea465e5820bdaddfd6b99237bbab84593f069b4a3f84e1828e621e5531a27f4959c9f29259c8f4a4fc774764d3835b180a9bb4b4c8cae388f10968cd772dc8
SSDEEP 3:LstlNllklkXlhiK:LsX3lPh
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\udjctikp.v1p\GraphiteDawnCache\index
Size 256KB
SHA256 aff5a8598be9ab9dfdccab142b7a32582c6105609c0e27167e8118b0e4b7f110
MD5 ff29401e9f410b4407d7699aabacb96f
SHA1 b4be494de02ba84622507ea46ea49baacaa55906
SHA512 6a9e89e76250f7778329fc5f19b9a870fac4430cdb7d38a03414ebfbe422a6e17a5c54e324797ad4972850a129ff02236961a8db3a10ba54ad7b813a24927352
SSDEEP 3:LstlNllklkXliG:LsX3lPiG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3140-155-0x000001DB28320000-0x000001DB28412000-memory.dmp

Download

memory/4768-8-0x00000000067A0000-0x0000000006904000-memory.dmp

Download

memory/4768-0-0x0000000000820000-0x00000000009A8000-memory.dmp

Download

memory/4768-1-0x0000000005920000-0x0000000005EC4000-memory.dmp

Download

memory/4768-2-0x0000000005230000-0x00000000052C2000-memory.dmp

Download

memory/4768-3-0x0000000005520000-0x0000000005530000-memory.dmp

Download

memory/4768-4-0x0000000005300000-0x000000000530A000-memory.dmp

Download

memory/4768-5-0x0000000005880000-0x0000000005894000-memory.dmp

Download

memory/4768-6-0x0000000005520000-0x0000000005530000-memory.dmp

Download

memory/4768-7-0x00000000066D0000-0x000000000676C000-memory.dmp

Download

memory/5384-17-0x0000000007080000-0x00000000070B2000-memory.dmp

Download

memory/5384-150-0x0000000005400000-0x0000000005410000-memory.dmp

Download

memory/5384-14-0x0000000005950000-0x0000000005A28000-memory.dmp

Download

memory/5384-13-0x0000000005580000-0x00000000055FC000-memory.dmp

Download

memory/5384-12-0x0000000005400000-0x0000000005410000-memory.dmp

Download

memory/5384-9-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/5384-16-0x0000000006E50000-0x0000000006F42000-memory.dmp

Download

memory/5384-157-0x00000000012C0000-0x00000000013C0000-memory.dmp

Download

memory/5384-18-0x00000000073C0000-0x0000000007426000-memory.dmp

Download

memory/5384-19-0x00000000075F0000-0x0000000007640000-memory.dmp

Download

memory/5384-20-0x0000000005400000-0x0000000005410000-memory.dmp

Download

memory/5384-15-0x0000000005A50000-0x0000000005A9C000-memory.dmp

Download

memory/5384-153-0x0000000005650000-0x0000000005750000-memory.dmp

Download

memory/5384-154-0x0000000005650000-0x0000000005750000-memory.dmp

Download

memory/5384-404-0x0000000005650000-0x0000000005750000-memory.dmp

Download

memory/5384-403-0x0000000005650000-0x0000000005750000-memory.dmp

Download

memory/5384-429-0x0000000007AE0000-0x0000000007AFE000-memory.dmp

Download

memory/5384-423-0x0000000005400000-0x0000000005410000-memory.dmp

Download

memory/5384-425-0x0000000007500000-0x0000000007512000-memory.dmp

Download

memory/5384-427-0x0000000005650000-0x0000000005750000-memory.dmp

Download

memory/5384-426-0x0000000005650000-0x0000000005750000-memory.dmp

Download

memory/5384-428-0x0000000008430000-0x00000000084A6000-memory.dmp

Download

memory/5888-421-0x000001A4B9600000-0x000001A4B96F2000-memory.dmp

Download