f975c5077bd774863457e039c3fda9463cc954d891fbf9546763bf38fbd755ea

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
super agent.exe
Size 5.1MB
Sample260813-wtm65sce28
SHA256 f975c5077bd774863457e039c3fda9463cc954d891fbf9546763bf38fbd755ea
MD5 491757de5a46115ed5d9ca8fa04414a4
SHA1 0ae98b6923dea5c1c2c6e027d8b234a3a833ccd1
SHA512 732e39b76b6806c8ef70ebfa232623b089db7a30f48992e35f948acec1a56affb42abad2160d00938454d0955cf2b52841c3e0ce10a39bf8837b6522b9ea54c4
SSDEEP 98304:HG8xo4tZLOuLPATULj2gohT3higkVgohT3higk:m8xnrJ+q
TLSH
T1EA465A22558017E8E17FC179898A5E12FF327009136567EF099045A3EEA7AF0BE7F352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2396	msedge.exe
3712	msedge.exe
2480	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5156	chrome.exe
5156	chrome.exe
904	super agent.exe
904	super agent.exe
904	super agent.exe
904	super agent.exe
904	super agent.exe
904	super agent.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeShutdownPrivilege	5156	chrome.exe
Token: SeCreatePagefilePrivilege	5156	chrome.exe
Token: SeShutdownPrivilege	5156	chrome.exe
Token: SeCreatePagefilePrivilege	5156	chrome.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe
Token: SeRestorePrivilege	904	super agent.exe
Token: SeDebugPrivilege	904	super agent.exe
Token: SeBackupPrivilege	904	super agent.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5156	chrome.exe
4232	msedge.exe
4356	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
904	super agent.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 5156	904	super agent.exe	91
PID 5156 wrote to memory of 5720	5156	chrome.exe	92
PID 5156 wrote to memory of 6040	5156	chrome.exe	93
PID 5156 wrote to memory of 2480	5156	chrome.exe	94
PID 5156 wrote to memory of 3184	5156	chrome.exe	95
PID 5156 wrote to memory of 1048	5156	chrome.exe	96
PID 5156 wrote to memory of 4808	5156	chrome.exe	97
PID 5156 wrote to memory of 5640	5156	chrome.exe	98
PID 5156 wrote to memory of 5312	5156	chrome.exe	99
PID 5156 wrote to memory of 2216	5156	chrome.exe	100
PID 904 wrote to memory of 5156	904	super agent.exe	91
PID 904 wrote to memory of 4232	904	super agent.exe	103
PID 904 wrote to memory of 4232	904	super agent.exe	103
PID 4232 wrote to memory of 4672	4232	msedge.exe	104
PID 4232 wrote to memory of 5760	4232	msedge.exe	105
PID 4232 wrote to memory of 2396	4232	msedge.exe	107
PID 4232 wrote to memory of 5760	4232	msedge.exe	105
PID 4232 wrote to memory of 5760	4232	msedge.exe	105
PID 4232 wrote to memory of 4488	4232	msedge.exe	108
PID 4232 wrote to memory of 4488	4232	msedge.exe	108
PID 4232 wrote to memory of 2116	4232	msedge.exe	109
PID 4232 wrote to memory of 2116	4232	msedge.exe	109
PID 4232 wrote to memory of 2116	4232	msedge.exe	109
PID 4232 wrote to memory of 2608	4232	msedge.exe	110
PID 4232 wrote to memory of 2608	4232	msedge.exe	110
PID 4232 wrote to memory of 2608	4232	msedge.exe	110
PID 4232 wrote to memory of 5332	4232	msedge.exe	111
PID 4232 wrote to memory of 5340	4232	msedge.exe	112
PID 4232 wrote to memory of 5332	4232	msedge.exe	111
PID 4232 wrote to memory of 5332	4232	msedge.exe	111
PID 4232 wrote to memory of 5340	4232	msedge.exe	112
PID 4232 wrote to memory of 5340	4232	msedge.exe	112
PID 4232 wrote to memory of 1492	4232	msedge.exe	114
PID 4232 wrote to memory of 1492	4232	msedge.exe	114
PID 904 wrote to memory of 4232	904	super agent.exe	103
PID 904 wrote to memory of 4356	904	super agent.exe	115
PID 4356 wrote to memory of 5396	4356	msedge.exe	116
PID 4356 wrote to memory of 3184	4356	msedge.exe	117
PID 4356 wrote to memory of 3712	4356	msedge.exe	118
PID 4356 wrote to memory of 4168	4356	msedge.exe	119
PID 4356 wrote to memory of 5640	4356	msedge.exe	120
PID 4356 wrote to memory of 2720	4356	msedge.exe	121
PID 4356 wrote to memory of 2968	4356	msedge.exe	122
PID 4356 wrote to memory of 5300	4356	msedge.exe	123
PID 4356 wrote to memory of 4868	4356	msedge.exe	124
PID 4356 wrote to memory of 404	4356	msedge.exe	125
PID 4356 wrote to memory of 2944	4356	msedge.exe	126
PID 4356 wrote to memory of 1192	4356	msedge.exe	127
PID 4356 wrote to memory of 1876	4356	msedge.exe	128
PID 4356 wrote to memory of 3620	4356	msedge.exe	129
PID 4356 wrote to memory of 5052	4356	msedge.exe	130
PID 4356 wrote to memory of 792	4356	msedge.exe	131
PID 904 wrote to memory of 4356	904	super agent.exe	115

C:\Users\Admin\AppData\Local\Temp\super agent.exe
"C:\Users\Admin\AppData\Local\Temp\super agent.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281" --headless=new --disable-gpu --no-first-run --noerrdialogs --no-sandbox --disable-extensions --window-position=-32000,-32000 --window-size=1,1 about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff80c3cc728,0x7ff80c3cc734,0x7ff80c3cc740
    3⤵
    PID:5720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1880,i,17693254300706362602,9410722094125877640,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
    3⤵
    PID:6040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281" --force-high-res-timeticks=disabled --field-trial-handle=1880,i,17693254300706362602,9410722094125877640,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281" --force-high-res-timeticks=disabled --field-trial-handle=1880,i,17693254300706362602,9410722094125877640,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:13
    3⤵
    PID:3184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1880,i,17693254300706362602,9410722094125877640,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1880,i,17693254300706362602,9410722094125877640,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
    3⤵
    PID:4808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1880,i,17693254300706362602,9410722094125877640,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:5640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1880,i,17693254300706362602,9410722094125877640,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:9
    3⤵
    PID:5312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1880,i,17693254300706362602,9410722094125877640,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:9
    3⤵
    PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x304,0x308,0x30c,0x300,0x314,0x7ff8068fc188,0x7ff8068fc194,0x7ff8068fc1a0
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,15657383832794642781,15433209179758121327,262144 --field-trial-handle=2356,i,6145937881101731853,4627140946724043916,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,4917593965589710711,6194746369215486954,524288 --field-trial-handle=2356,i,6145937881101731853,4627140946724043916,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,15690740137498707110,13232470577151402610,524288 --field-trial-handle=2356,i,6145937881101731853,4627140946724043916,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,12340443152267699140,2851979655224862967,2097152 --field-trial-handle=2356,i,6145937881101731853,4627140946724043916,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,14294244951305832280,16390354299576822289,2097152 --field-trial-handle=2356,i,6145937881101731853,4627140946724043916,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,1212129995972433567,9177494075813542349,2097152 --field-trial-handle=2356,i,6145937881101731853,4627140946724043916,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
    3⤵
    PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,2654331112701176357,16820575505561732058,2097152 --field-trial-handle=2356,i,6145937881101731853,4627140946724043916,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,8756394334872550497,4339092772425400451,524288 --field-trial-handle=2356,i,6145937881101731853,4627140946724043916,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
    3⤵
    PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --headless=new --disable-gpu --no-first-run --noerrdialogs --no-sandbox --disable-extensions --window-position=-32000,-32000 --window-size=1,1 about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x268,0x7ff8068fc188,0x7ff8068fc194,0x7ff8068fc1a0
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:2
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:13
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:9
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:9
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:9
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:9
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2700,i,2909377669962357957,3762444287245136655,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
    3⤵
    PID:792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8d58b8531af22f6265df33aafebc9336d84d2bedeace3bf8cac0e3c41816052a
MD5 52c864293d54ad67323d36284b34399c
SHA1 82e8aa93497ce90c200029d6445c3553c8ea7532
SHA512 6faecc56152c323e29e7b808d3f671ce7107c0b3afd91199e8fda4b47213797e9d5107fb9bf64745f4ea22276014ab32ec9538e4908041890431c85fd5d0b8d3
TLSH
T1A9316CF783B4957E8A1196F0AA08AE1FCE6D0521431C7DAA85E06E2793F3461E045A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7b7dbf732cca696aee43f7389f13bacac7e6c50eb22de20becd4b9ebe97a5ad4
MD5 a8f4f263406fc148def568b2aa4e70fb
SHA1 a7747915a490bbbe8e713346c56d06f85471b253
SHA512 8d87efbaeeae484296f518a06b1e8f1c3661d376d7c43e63964916354306d5a79cb75534315c304dad77ed04a228554944f210cda2e67cca5ff9097fa27328f4
SSDEEP 768:srv+4UNbdz30VW/TBOWZAGMONXyer1IRCzniwFeVH1SK7:sbsbV3EWySIqn5EH1l
TLSH
T15603BF31E0A9DE334DE2A395B14777937FB8206789800B90EDDA1F4E069B59E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 048e25d66a6fa187c0001cdfe3aa5f482bfb7d3981438e46a4abc316a594fcbb
MD5 6ce74781f7c4961121ecc02951cc413c
SHA1 444bf66c29f76a042d3446ce2e82cc757281b882
SHA512 5ddf2d83c15b16fc7b7f6ec1b1b88f9ae7b91c4e12ead9cc67006c193d80aa01fd2e263fef9dec2f43d31ba3e1ddbb752f58f01a4391e813403c13e6437e7be0
SSDEEP 768:hrv+4UNbdz3F8/TBOWZAPONXyer1IRCzniBReVH1SK7:hbsbV3GCSIqnOEH1l
TLSH
T1ED03BF32E4A89E338DE2A3C5B14777437FB86057C6840B90EDEA2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240724281\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000\Crashpad\settings.dat
Size 280B
SHA256 19341ea2b86ab83d659ed170fe83ea3d181fd15cdc27a104decaf8f44ebffe73
MD5 81d401e1b3b8fa55e6bb6971845ee027
SHA1 a669273095b2907261bbdfa33a876534925c8e34
SHA512 bd2a78cc0bec02b47a41729138bde019eec7c4dbffd5c72fd974f4a75aaad965b08401476d82ba1fe9594d0677629a4054ec865b08e356eca56dc97b5c88fb77
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000\Crashpad\settings.dat
Size 280B
SHA256 2e2a03fdbfcb0628eea04416c8bfb3d8e4e0bf1d4ad56902db7dac3f4920e7ce
MD5 59404889e3b9a35905393f49d1757ee7
SHA1 77ced5a871b986946bf52c0a37284be5973bbdee
SHA512 95827645334c851aa27f4290a5dc9dc6bd8907092758e200147561f9b2968a37bc97c2351fc805c4229d0ade006ff386738dbf6234b8ac451f9ae66ab0f136a1
TLSH
T1EFD00265F243E2B9EC4EDD3D9033F74B55C0CD11C1970609D232060E1CE6853A3062C8
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000\Local State
Size 3KB
SHA256 62cc65dd05ae6de80919188c92ff10fe4d2f117f01f6237d4e1e26a18fd85352
MD5 1c1bb1104028ac9a2f5c995828c212db
SHA1 d260fd237e05340ffa1399f33d34a3a16ec2bbf5
SHA512 3d24e9b3bd46e0e63d202ac91216d33cbd3d5d2f51bcd2157b36b4b7fcb6df82a87e83ef48fa039957df014f79004f531612b92e01e8a21b4a1acfc823b0300c
TLSH
T10281B7716429ED3749D5A948B4863AA39F7870B3EC41AF44E6D9031801EFADC2B0EC27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000\Local State
Size 4KB
SHA256 e216332f605030703035fc08706b8d64e4540e0b9289f295e65029cbd6178dd3
MD5 24210119a165e439bde41ee4e5197df9
SHA1 65f43086ac6828861874c0adbaa1937face3b929
SHA512 7ad1ccc0b65c707db8143d4e048ea4acb427ea2fda13f2ea8893c8c94fc9a5d6db12cdd6fe20db586d415863c96e52bee4dc297e46ee321a2144975f9625d416
SSDEEP 96:jqGNkLQsFfbXaHtcYJM58Frh/cInURoDotov/L8DbB61v1qeqbu0eUcoKJ/Wq4a:mGNXeXSt5hooDUwmlreqbu15j
TLSH
T162A1B6726479EC274DE5A908B4C63B97AFA42173E881BF89D6EC061C05EB7DC170AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5945d9.TMP

Path C:\Users\Admin\AppData\Local\Temp\hype_abe_240731000\Local State~RFe5945d9.TMP
Size 1KB
SHA256 ddb8e23434af31bb93ccc4bbefd8e7fb5a44fc56f2d47d0e689b78ca711f0d51
MD5 03639bffc0e572a548742b6b81b74baf
SHA1 5e58f9a62e65703c7f5ef23585b264ea2dcc34b6
SHA512 d3ec03baa301f85663a8382319890f61482d0995c1d028b4950501a286c1258c4bef29dd6a24c74155eca26fb82c30afa3cb20f0f4dd61eb04957c25f372c33a
TLSH
T14931977098696D37E890960DB286FEA76F342171E0417E4896ED012D03E7DEC121D83B
MD5 SHA1 SHA512 TLSH

Submit Download