b6296bad0fdf16df0811053e5c5cee71946d05e06222324e76dc26ec676ff976

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CompatTelRunner.exe
Size 3.7MB
Sample260828-pscwfsxwhy
SHA256 b6296bad0fdf16df0811053e5c5cee71946d05e06222324e76dc26ec676ff976
MD5 579933376ffc365ca48eb14046655171
SHA1 58376e7466c7ca80e9040d28a17d16800ff7d956
SHA512 41520a02bb78293a48989f0d7f9642cb86dfa718deaa1493a2998562dba51e978c8afc7c24790c3c46beac64e57f182c046b6e9cc3464154b499bfcb109685ac
SSDEEP 98304:/vtzlHKBX04WDFZouJ8NcAERHVX0IYi7ZWO+4:9oBE4WDFZos8NcAERHmroX
TLSH
T14C06AE1143901C8BF267E5BD12119F3BF4F57286BB207B57A69DAF7A1F3B0228921709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CompatTelRunner.lnk	CompatTelRunner.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CompatTelRunner.lnk	CompatTelRunner.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 47 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	CompatTelRunner.exe
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svp0oe8nn3aa6r = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\CompatTelRunner.exe\""	CompatTelRunner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svp0oe8nn3aa6r = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\CompatTelRunner.exe\""	CompatTelRunner.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3632	chrome.exe
4172	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
4796	CompatTelRunner.exe
4796	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
5948	chrome.exe
5948	chrome.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe
6004	CompatTelRunner.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	6004	CompatTelRunner.exe
Token: SeShutdownPrivilege	5948	chrome.exe
Token: SeCreatePagefilePrivilege	5948	chrome.exe
Token: SeDebugPrivilege	3328	chrome.exe
Token: SeDebugPrivilege	4796	CompatTelRunner.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe
Token: SeDebugPrivilege	2748	chrome.exe
Token: SeShutdownPrivilege	4900	chrome.exe
Token: SeCreatePagefilePrivilege	4900	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5948	chrome.exe
5948	chrome.exe
4900	chrome.exe
4900	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 5948	6004	CompatTelRunner.exe	92
PID 5948 wrote to memory of 4112	5948	chrome.exe	93
PID 5948 wrote to memory of 3328	5948	chrome.exe	94
PID 5948 wrote to memory of 3632	5948	chrome.exe	95
PID 5948 wrote to memory of 5024	5948	chrome.exe	96
PID 5948 wrote to memory of 2736	5948	chrome.exe	97
PID 5948 wrote to memory of 6060	5948	chrome.exe	98
PID 5948 wrote to memory of 6116	5948	chrome.exe	99
PID 5948 wrote to memory of 3408	5948	chrome.exe	100
PID 5948 wrote to memory of 5972	5948	chrome.exe	101
PID 5948 wrote to memory of 4656	5948	chrome.exe	102
PID 6004 wrote to memory of 3328	6004	CompatTelRunner.exe	94
PID 6004 wrote to memory of 3328	6004	CompatTelRunner.exe	94
PID 5948 wrote to memory of 4548	5948	chrome.exe	104
PID 4796 wrote to memory of 4900	4796	CompatTelRunner.exe	106
PID 4900 wrote to memory of 4932	4900	chrome.exe	107
PID 4900 wrote to memory of 5208	4900	chrome.exe	108
PID 4900 wrote to memory of 4172	4900	chrome.exe	109
PID 4900 wrote to memory of 4068	4900	chrome.exe	110
PID 4900 wrote to memory of 1612	4900	chrome.exe	111
PID 4900 wrote to memory of 5008	4900	chrome.exe	112
PID 4900 wrote to memory of 4292	4900	chrome.exe	113
PID 4900 wrote to memory of 2864	4900	chrome.exe	114
PID 4900 wrote to memory of 6068	4900	chrome.exe	115
PID 4900 wrote to memory of 2748	4900	chrome.exe	116
PID 4900 wrote to memory of 3344	4900	chrome.exe	117
PID 4796 wrote to memory of 2748	4796	CompatTelRunner.exe	116
PID 4796 wrote to memory of 2748	4796	CompatTelRunner.exe	116

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	CompatTelRunner.exe

C:\Users\Admin\AppData\Local\Temp\CompatTelRunner.exe
"C:\Users\Admin\AppData\Local\Temp\CompatTelRunner.exe"
1⤵
- Creates a file in the Startup directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbcee6c728,0x7ffbcee6c734,0x7ffbcee6c740
    3⤵
    PID:4112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1656,i,524217655300924975,13313041716787816152,262144 --field-trial-handle=2008,i,9980677052109442222,2680112008033429454,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1848,i,18360689742224888182,2386901514300973002,524288 --field-trial-handle=2008,i,9980677052109442222,2680112008033429454,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk" --force-high-res-timeticks=disabled --metrics-shmem-handle=2084,i,15322977075409483090,13730770935475107751,524288 --field-trial-handle=2008,i,9980677052109442222,2680112008033429454,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
    3⤵
    PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2972,i,11576366378400397730,10387341832458426090,2097152 --field-trial-handle=2008,i,9980677052109442222,2680112008033429454,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2976,i,8544159272847033721,13098943223128583241,2097152 --field-trial-handle=2008,i,9980677052109442222,2680112008033429454,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:1
    3⤵
    PID:6060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3204,i,5067233512149425100,7228318829298295176,2097152 --field-trial-handle=2008,i,9980677052109442222,2680112008033429454,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:6116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3216,i,2505961471691268298,339410742461962420,2097152 --field-trial-handle=2008,i,9980677052109442222,2680112008033429454,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:9
    3⤵
    PID:3408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3780,i,7822756983993300188,13269092321336056316,2097152 --field-trial-handle=2008,i,9980677052109442222,2680112008033429454,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:9
    3⤵
    PID:5972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4272,i,10464077691531749808,17918508570207187993,2097152 --field-trial-handle=2008,i,9980677052109442222,2680112008033429454,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk" --force-high-res-timeticks=disabled --metrics-shmem-handle=4364,i,8196142881547879586,9973875285897699681,524288 --field-trial-handle=2008,i,9980677052109442222,2680112008033429454,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
    3⤵
    PID:4548

C:\Users\Admin\AppData\Local\Temp\CompatTelRunner.exe
"C:\Users\Admin\AppData\Local\Temp\CompatTelRunner.exe"
1⤵
- Creates a file in the Startup directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbcee6c728,0x7ffbcee6c734,0x7ffbcee6c740
    3⤵
    PID:4932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,9181552648936045663,13097787994551301099,262144 --field-trial-handle=2036,i,11796585163407933579,15746527612224131073,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
    3⤵
    PID:5208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1892,i,7243737198155296433,10047853028581090260,524288 --field-trial-handle=2036,i,11796585163407933579,15746527612224131073,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y" --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,6273888937611036922,18097156946063913384,524288 --field-trial-handle=2036,i,11796585163407933579,15746527612224131073,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:13
    3⤵
    PID:4068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2984,i,1784480595572257552,752196246421432076,2097152 --field-trial-handle=2036,i,11796585163407933579,15746527612224131073,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:1
    3⤵
    PID:1612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3004,i,16378869699232146433,4118145451919566704,2097152 --field-trial-handle=2036,i,11796585163407933579,15746527612224131073,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3280,i,6805672717497651640,7567949153212051572,2097152 --field-trial-handle=2036,i,11796585163407933579,15746527612224131073,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:4292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3312,i,14367269829236362182,13472587957902618013,2097152 --field-trial-handle=2036,i,11796585163407933579,15746527612224131073,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:9
    3⤵
    PID:2864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3832,i,14400083529823317163,5433808274128464977,2097152 --field-trial-handle=2036,i,11796585163407933579,15746527612224131073,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:9
    3⤵
    PID:6068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4360,i,11184243674302489671,11059804944258322570,2097152 --field-trial-handle=2036,i,11796585163407933579,15746527612224131073,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y" --force-high-res-timeticks=disabled --metrics-shmem-handle=4248,i,2620384176522979563,8521300534240041539,524288 --field-trial-handle=2036,i,11796585163407933579,15746527612224131073,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
    3⤵
    PID:3344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\hcbh2zis.u5y\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Crashpad\settings.dat
Size 40B
SHA256 9870530cfccd4438a24457223bcdb8b43bc77523338a79f915496a50c213a24b
MD5 ad340e2a6865c02aa386d6eeba02b3fb
SHA1 83bd70ee662ebe89841002a85a1d691396188c75
SHA512 98759039895512b64829d05be7098b71db442b2008fdf64cc15766bccb42bac3568293afc34fdc89f8b6c471c1f8d314470ab2fcd0fe3cf45ad4dc830c377dee
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 043899d7b88cb54a1970a8ae64a294cf290f2fce5858b8b77d81a12de59b2699
MD5 5017ab9a80db629a15e6e133732560ba
SHA1 173854ec228a2635e8d26cd86e140b0c574fe93d
SHA512 49ecb4816e3f200e1328f61a28372fbeb8e300d7313c7022c01cba22fd398d5bd0c1c443e145bec8c5847f520dbbc9dcc78d4691c198968b1e57840c430ebd3b
SSDEEP 3:MsFlthltlluIs3D3Btl1+flxB450dD3BH+6N8OoKHtKTbBdrl1mC+elyblX:/F8L3T7WNYKdTh+7bKHte/rvmC+elI
TLSH
T105134CADF0D52D07C745717C50E363B0667068C9C5766E7B75FC653170957B1036C210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 5bd3d1c210a5031adcf7786dc4581e8d3698c0efccc15f7af5a4264aba4c1d7e
MD5 6c422d35891c1361a230caa4b6edd829
SHA1 bbd0c5b531173e37a606bdb4111187105be25ae7
SHA512 87ef69d779f01a595068208fd9b648dab3539ecc395d8a91ffaf3fd2ec1c6a743d64f02daf9497ef3ed5533b9dde4e96465b865f60dcb56a1dbe35a9576441a2
SSDEEP 12:U/5YqlkDBpqp9iAHCytflkuWpqp9ikiIfpqp9iv+lpqp9iAZY/Bkl9G6ez3lk3zt:5SCMflkfIl+iYJkf2lk3z/mizblXZ
TLSH
T1624488E3B800024BCA50E2FD1111327C8A36D1093DEADDEFE1A914B25080F79A3684D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 827ef243196049910e11ba02d54aa0002d2172d1e2712bff54824b3421a94942
MD5 6db89256b27ffde86a079f536d403dfe
SHA1 05e5679375ee3853f2c872fd44e9e3fef7b7550d
SHA512 c8fcf08d4cb11c02fe300187f7738cb5b779a60a68112c88419c8fdb014a8d5ec462bf0c712edb3a001bcccd6742e15298371e36a45ac027eaa7fa42fa257e7b
SSDEEP 768:oUfDPLSgcRUv+I4BfDPLSgcRUv+i4rUfDPLSgcRUv+T4:58w
TLSH
T191161AF24F287986D786DBB0ABC9DE183D711298EC935C92F13292695BE1FC10BC125D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Cache\Cache_Data\index
Size 256KB
SHA256 85f0dbc4d2cd4ff8a64019ee98dfc40b5f065e82da8847cf45e81c2935cca652
MD5 fc708a8fa62bf4c065efdc0602ced18c
SHA1 4c734a7ba02c667a053a77d0c4fee7926e3d6ccf
SHA512 091b64f78080ac1829e56bcdc38361904866120d2d8dfd5437a8d87d09f15997f2de3f3d75d344419bc8b96e8c18e94fe4f21bc21dda2bd5b097912c01119d3b
SSDEEP 3:LsYllOlNllklkXlBd1/zll8mltcNtlNlXlpNtlQl:LsL3lPBdBWNz
TLSH
T1D044026FC3D14C06C5D0017DC40783215734C5C5C54FC357030825203CD17B11F0D061
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 e4f99697f18f92064d306b0c68562defd48e9497e0c240219bb04075d393cd96
MD5 f278434371570d8d36b60094729bd7e9
SHA1 5a944c362f51c5cab9556faa3ef0dd4da45e1572
SHA512 882be5b6a71dc403b3b63a2b6a2f9d15f446296d307dfb2f43b4b23073929e7a2fe845291bf6452e076f6769c9a0bedaa7e219a0fd6fbaccb473668d4f4bf641
TLSH
T16AE02B81C34C1F0DD32E96F7CDAA03048A0A42D429BE3A03A981C2C273168245288123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 532e04d55c4b89bcb7cbe36f9953330440c4d3713f5a19d129e48a18570bdbff
MD5 24741c68bc51f5ea1d77b876bd092eb3
SHA1 ada89374da7fbcd58dcfc585b50a841595552263
SHA512 7cf61e8a94ca0a7dc0d1c7fa4843f9faa3af52c664dd091d2d166745a4c8b43dd767b922bcb09472c012be7cb2fd900b9d5776bb4e9bd5c3dba59654bca3c5fb
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\DawnGraphiteCache\index
Size 256KB
SHA256 9e6d92d34daa358a812efd5e525c53b8adb5c6cb9c0de56d90b20eb0e74141c3
MD5 ac78717a648b8d6b68bf2a9d1f88bee6
SHA1 7f80bc9e07fd296a59d2fd64a88d429a3813992c
SHA512 55040ddca4aabd954f173b6050a948342fba31c2a1b2eda5b75ac0aa61d0f6b06e44ece344b6f195551e74bda4c327a15b4b4a8e64be1cb61cb0427f4641458e
SSDEEP 3:LstlNllklkXlp+/:LsX3lPpu
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\DawnWebGPUCache\index
Size 256KB
SHA256 7088b14e2a06c7364953c4b45b9a5a307b88ba2f844e712cb7154fddabdb9f44
MD5 3ad053b2e59f69e493b241a697b2203a
SHA1 b8385331c86679c56c53f84e89aa65f89c2c2fc1
SHA512 016132fd8ec6de2702d0c457059fe994fc7a3777bdb9cdecc0f85fabb1b84d782d15729b0043ffd3bb838e73de962d5b3e1aecfd7e4c6db360e4983687f18e5a
SSDEEP 3:LstlNllklkXlnd3Kl/:LsX3lPd3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\GPUCache\index
Size 256KB
SHA256 a15d6a31658d72f8dd63bf641681d54758d9d95398c43c16d9b0d2fdcfea963f
MD5 2c7ec328d7946a975950d8fb6708cadb
SHA1 3edd4ad17942e6e7f90a6bfd1795d300ea7cd197
SHA512 c7cc3d31a54aa0b727486858b4e11915f00fd605068da4de26361d619d4a012cffe10d921b48bfa9282f678e9aab8dda6bc53520dff50d61f50a42000ef77d10
SSDEEP 3:LstlNllklkXled+:LsX3lPed+
MD5 SHA1 SHA512 SSDEEP

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0c645737060268fd9b28bc7333abae90643ff7632c8953c111f0982afcd90c25
MD5 329ba27260e73d683889616cbcc4ea2b
SHA1 d398ecd6edce29315dae577aaa7f432679aff2c5
SHA512 4d33ee465bbc1035754c9566c8f51e130bccc84b0773748484c9cd1c496e1b94eff27b0ed15ed66d072be4c2b625ddeb9ae9edf32bea1aca0911207a2e7f3814
TLSH
T19DA0021103808521D20416B0280187C85640B9258140432776D003478C642604F52544
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 ce995fb31f95571adb5b7aefc88f9d276de36a3ba821820b3cf50c276de0a998
MD5 720d57aa871c1c4b77820f86a7cd0130
SHA1 ecd41ae90d6f55d2f3d748ae21700716932d6270
SHA512 63d2888fcf0dd336715c24c2272e1c4cc8a458924d5a1985f617b1e03a96654d168db9c1c52bd67c746ca0b338db456153ba6936c623c37c6b83548e8744145d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\GrShaderCache\index
Size 256KB
SHA256 6928214e717407958d0c7897b51ee204fa051a387ea3b6c194968ebb30b6c8a9
MD5 4bf7dc9623e4e3d591c2a114ce4530da
SHA1 7a54fce010508b30cfba87307c24a61ef8a40bcc
SHA512 29973590a94b9959d75e3bc8061b3f528d659684bc0b034ac87798109972e50ed248c78db1f454c00b241e1047144e58462b0fdb907a114ae61100a0030ab144
SSDEEP 3:LstlNllklkXl0CXIl:LsX3lP0KY
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\GraphiteDawnCache\index
Size 256KB
SHA256 0923da6296295dcdcaecf2d5d009d9c1c6efb46b37d75f858669377dc90822e2
MD5 4371d31277afc20d361b459078f8aeb2
SHA1 d14de2e51b2cd71647f348aba26952c5585e4f8e
SHA512 e1f7c48f0ab39aec79886a60ad1e45b75cc9ebb01880a0ab345a5fa650efa42d30df97f74078463887722ba3d8b32c880b9588b0f7dfa5cfb51bdfc882e53e74
SSDEEP 3:LstlNllklkXllKYll:LsX3lPt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mudgsvkc.2wk\Local State
Size 1KB
SHA256 0e28b08536ad9d267bece487d214b1501145279b9e5f7e474cff30cd0ba40d02
MD5 c1ad56206edea8706b35fca07945a0f0
SHA1 bc1a0c702134e5d4e5de54ba7d37c4f42cd5040a
SHA512 bf894d8d246c3f67a87635c01e902a4e5b4931b5e46b6c7aa58d3143cf24faf2c8a9912121852fbcb4c68d88e05ecb849340da58da793c4b14f034376e2557ca
TLSH
T16E1132B03A6933355C818518D602E7AB6F3A6377C05259487ECD1A4006F9FEE271FC35
MD5 SHA1 SHA512 TLSH

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 40B
SHA256 f726397df5f0ed71884b5352b37dd4272c4097e8f96c84809c8babfa92506daf
MD5 ccac76c22419b18eca859f8412d5d31c
SHA1 315a53b44931bb46d1e66306100e4efeaaf74ae1
SHA512 b6bbc6ca60be273e0fa22d34f2e65b06742df3ac8c03b26d35406025f8a016e42ffff7f056775f493360d0edd8ce3005342952cc5819eab2b12d60805596ad03
MD5 SHA1 SHA512

Submit Download

memory/2748-798-0x0000020F3BF10000-0x0000020F3BF42000-memory.dmp

Download

memory/2748-797-0x0000020F23860000-0x0000020F2394C000-memory.dmp

Download

memory/3328-591-0x000001900FC20000-0x000001900FD0C000-memory.dmp

Download

memory/3328-592-0x000001900FA20000-0x000001900FA52000-memory.dmp

Download

memory/4796-659-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-459-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-466-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-467-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-661-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-660-0x0000021995790000-0x00000219957C2000-memory.dmp

Download

memory/4796-462-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-653-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-460-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-800-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-236-0x00007FFBEDFC0000-0x00007FFBEE087000-memory.dmp

Download

memory/4796-235-0x00007FFBEC510000-0x00007FFBEC8B1000-memory.dmp

Download

memory/4796-457-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-458-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-456-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-455-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/4796-461-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-232-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-223-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-454-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-493-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-0-0x000001C272AD0000-0x000001C272AD1000-memory.dmp

Download

memory/6004-234-0x000001C2756D0000-0x000001C27571C000-memory.dmp

Download

memory/6004-233-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-480-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-651-0x000001C275B00000-0x000001C275B12000-memory.dmp

Download

memory/6004-231-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-230-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-226-0x000001C275570000-0x000001C2755EC000-memory.dmp

Download

memory/6004-228-0x000001C2755F0000-0x000001C2756C8000-memory.dmp

Download

memory/6004-229-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-227-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-225-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-224-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-557-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-222-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-215-0x000001C2753A0000-0x000001C275470000-memory.dmp

Download

memory/6004-221-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-213-0x00007FFBCBD6F000-0x00007FFBCBD70000-memory.dmp

Download

memory/6004-1-0x00007FFBEC510000-0x00007FFBEC8B1000-memory.dmp

Download

memory/6004-652-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-474-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-654-0x000001C275C20000-0x000001C275C96000-memory.dmp

Download

memory/6004-655-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-656-0x000001C275BA0000-0x000001C275BBE000-memory.dmp

Download

memory/6004-658-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-472-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-469-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-468-0x000001C275B50000-0x000001C275BA0000-memory.dmp

Download

memory/6004-2-0x00007FFBEDFC0000-0x00007FFBEE087000-memory.dmp

Download

memory/6004-465-0x000001C275770000-0x000001C2757A2000-memory.dmp

Download

memory/6004-464-0x000001C2758B0000-0x000001C27599C000-memory.dmp

Download

memory/6004-463-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download