880627b8212d9125e6ef18b1f1ea7ac91507c0f49eecad2ff301a666a4d56d51

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NULLSUB.exe
Size 1.6MB
Sample261107-pmfedsc13q
SHA256 880627b8212d9125e6ef18b1f1ea7ac91507c0f49eecad2ff301a666a4d56d51
MD5 2661f0e3c12e7994e62b9145f05980c7
SHA1 ba4a988f8e76164cedc649585ed5d1088f1970d4
SHA512 357400f57472bd9fc80828cc99b502a508c823ab864c7b850c40e0fcba5abf0259ddb353253580a046dfac3b14f7b13a0498f04a303e305c616e61670d77ea53
SSDEEP 24576:5ZDbBW6TgcDu82VMcxdecBZgnvfYCNByNgjDThfC9Q+iYQA:5ZDb/ZkitEgnfjxb+9
TLSH
T15F8502A1F8C59441C82FD231D643EE3123376FBEB9B188CA058C7786B2979414F6D96B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
39	6024	NULLSUB.exe

Executes dropped EXE 1 IoCs

pid	Process
4572	btxk5d5g.mtb.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NULLSUB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NULLSUB.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	btxk5d5g.mtb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	btxk5d5g.mtb.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3496	chrome.exe
3900	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	NULLSUB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	NULLSUB.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe
6024	NULLSUB.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	6024	NULLSUB.exe
Token: SeDebugPrivilege	6024	NULLSUB.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeDebugPrivilege	4572	btxk5d5g.mtb.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
832	chrome.exe
832	chrome.exe
1472	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 1960	6024	NULLSUB.exe	89
PID 6024 wrote to memory of 2412	6024	NULLSUB.exe	90
PID 6024 wrote to memory of 1960	6024	NULLSUB.exe	89
PID 6024 wrote to memory of 2412	6024	NULLSUB.exe	90
PID 6024 wrote to memory of 832	6024	NULLSUB.exe	93
PID 832 wrote to memory of 5812	832	chrome.exe	94
PID 832 wrote to memory of 3496	832	chrome.exe	95
PID 832 wrote to memory of 2780	832	chrome.exe	96
PID 832 wrote to memory of 2780	832	chrome.exe	96
PID 832 wrote to memory of 4136	832	chrome.exe	97
PID 832 wrote to memory of 4136	832	chrome.exe	97
PID 832 wrote to memory of 4316	832	chrome.exe	99
PID 832 wrote to memory of 5992	832	chrome.exe	98
PID 832 wrote to memory of 4316	832	chrome.exe	99
PID 832 wrote to memory of 5992	832	chrome.exe	98
PID 832 wrote to memory of 4508	832	chrome.exe	100
PID 832 wrote to memory of 2568	832	chrome.exe	101
PID 832 wrote to memory of 4508	832	chrome.exe	100
PID 832 wrote to memory of 2568	832	chrome.exe	101
PID 832 wrote to memory of 4372	832	chrome.exe	102
PID 832 wrote to memory of 4372	832	chrome.exe	102
PID 832 wrote to memory of 4736	832	chrome.exe	103
PID 832 wrote to memory of 4736	832	chrome.exe	103
PID 6024 wrote to memory of 1472	6024	NULLSUB.exe	104
PID 1472 wrote to memory of 236	1472	msedge.exe	105
PID 1472 wrote to memory of 4532	1472	msedge.exe	106
PID 1472 wrote to memory of 3900	1472	msedge.exe	107
PID 1472 wrote to memory of 4532	1472	msedge.exe	106
PID 1472 wrote to memory of 2764	1472	msedge.exe	108
PID 1472 wrote to memory of 4532	1472	msedge.exe	106
PID 1472 wrote to memory of 2764	1472	msedge.exe	108
PID 1472 wrote to memory of 3012	1472	msedge.exe	109
PID 1472 wrote to memory of 3752	1472	msedge.exe	110
PID 1472 wrote to memory of 3012	1472	msedge.exe	109
PID 1472 wrote to memory of 3012	1472	msedge.exe	109
PID 1472 wrote to memory of 3752	1472	msedge.exe	110
PID 1472 wrote to memory of 3752	1472	msedge.exe	110
PID 1472 wrote to memory of 700	1472	msedge.exe	111
PID 1472 wrote to memory of 4380	1472	msedge.exe	112
PID 1472 wrote to memory of 4456	1472	msedge.exe	113
PID 1472 wrote to memory of 5048	1472	msedge.exe	114
PID 1472 wrote to memory of 1808	1472	msedge.exe	115
PID 1472 wrote to memory of 3000	1472	msedge.exe	116
PID 1472 wrote to memory of 4784	1472	msedge.exe	117
PID 1472 wrote to memory of 2444	1472	msedge.exe	118
PID 1472 wrote to memory of 5664	1472	msedge.exe	119
PID 1472 wrote to memory of 2624	1472	msedge.exe	120
PID 1472 wrote to memory of 2252	1472	msedge.exe	121
PID 1472 wrote to memory of 1676	1472	msedge.exe	122
PID 1472 wrote to memory of 4328	1472	msedge.exe	123
PID 1472 wrote to memory of 5048	1472	msedge.exe	114
PID 1472 wrote to memory of 5048	1472	msedge.exe	114
PID 1472 wrote to memory of 1808	1472	msedge.exe	115
PID 1472 wrote to memory of 1808	1472	msedge.exe	115
PID 1472 wrote to memory of 3000	1472	msedge.exe	116
PID 1472 wrote to memory of 3000	1472	msedge.exe	116
PID 1472 wrote to memory of 4784	1472	msedge.exe	117
PID 1472 wrote to memory of 4784	1472	msedge.exe	117
PID 1472 wrote to memory of 2444	1472	msedge.exe	118
PID 1472 wrote to memory of 2444	1472	msedge.exe	118
PID 1472 wrote to memory of 5664	1472	msedge.exe	119
PID 1472 wrote to memory of 5664	1472	msedge.exe	119
PID 6024 wrote to memory of 4572	6024	NULLSUB.exe	124

C:\Users\Admin\AppData\Local\Temp\NULLSUB.exe
"C:\Users\Admin\AppData\Local\Temp\NULLSUB.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy" --app=http://127.0.0.1:49875
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x104,0x138,0x7ffdc8e3c728,0x7ffdc8e3c734,0x7ffdc8e3c740
    3⤵
    PID:5812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1852,i,1319398207486842690,8106351172043959347,524288 --field-trial-handle=1980,i,14443418547694865146,7565484917697970399,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,2790133244991188765,15721596696515319901,262144 --field-trial-handle=1980,i,14443418547694865146,7565484917697970399,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
    3⤵
    PID:2780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy" --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,18177855804267976147,3679758085511538635,524288 --field-trial-handle=1980,i,14443418547694865146,7565484917697970399,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
    3⤵
    PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,12441654936589727487,10838988097394065655,2097152 --field-trial-handle=1980,i,14443418547694865146,7565484917697970399,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:5992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,17369203341059655099,3337515238462141772,2097152 --field-trial-handle=1980,i,14443418547694865146,7565484917697970399,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3820,i,16345329809150085243,4704034969871220414,2097152 --field-trial-handle=1980,i,14443418547694865146,7565484917697970399,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3832,i,15863407504944056990,10496406757044798769,2097152 --field-trial-handle=1980,i,14443418547694865146,7565484917697970399,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:9
    3⤵
    PID:2568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4564,i,18018488035008030804,1519742544611130449,2097152 --field-trial-handle=1980,i,14443418547694865146,7565484917697970399,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:9
    3⤵
    PID:4372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy" --force-high-res-timeticks=disabled --metrics-shmem-handle=4920,i,5394960894676000797,13327096410085357359,524288 --field-trial-handle=1980,i,14443418547694865146,7565484917697970399,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
    3⤵
    PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --app=http://127.0.0.1:50076
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffdc49fc188,0x7ffdc49fc194,0x7ffdc49fc1a0
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,10503686950402219025,9531501672910106108,262144 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,491309999672172081,16528578554113341799,524288 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,15155295519426715813,547208468665681581,524288 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:13
    3⤵
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,13961265193553928998,12496838335353334653,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,12006311737294754003,6577305970523059398,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,16388338424514627867,6747768864785240555,524288 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:14
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4112,i,8819432916373795855,10594264187409245708,524288 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:14
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,18425120043811429037,7644948512893809038,524288 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4156,i,16872625921215830986,7447251520046302469,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4168,i,7789893360336413547,17390356440921425747,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4248,i,1649932865278215583,18135448379691277934,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4304,i,12973716457256803879,10140671427885460532,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4212,i,2820277278077214890,8714871507425637994,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4336,i,14285731597504030753,11737795998930969806,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4356,i,1896053036473261580,9483778774703253580,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4384,i,1039935256973471645,16743349098947608620,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:9
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4408,i,497039108906524221,11457027754422783666,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4484,i,14927849621786730261,16293407317613107612,2097152 --field-trial-handle=2328,i,3521642691088578304,14610782661525793701,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:9
    3⤵
    PID:4328
- C:\Users\Admin\AppData\Local\Temp\btxk5d5g.mtb.exe
  "C:\Users\Admin\AppData\Local\Temp\btxk5d5g.mtb.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Crashpad\settings.dat
Size 40B
SHA256 e60a4fbcb4db2b643577e85504e302e1144216cb32e3885e24d19dbdd6370273
MD5 a6e01dd2e784a327e86d1d56226b7ecc
SHA1 59488cd67896d181ba86cd927cc7ad9f65a138ba
SHA512 77c8db11b72b6aa78f96074c78dbe338ec2c14ce98a88c581208a10a207782207dac5f1e58c41d61636f4bc5a9dea500ce364d509e3bfa333b3a2b6de68280be
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 54b90d37fc52c0c9014043c0afdb14a2d566a6bf91276b240bb98e2d60f50f2d
MD5 5d5c09513fa7cfe5d9e9662167eac155
SHA1 e924ccd725e7cde491c7e95a2bdf9330c7f556a2
SHA512 d3263d6c62030f6cce218a534773d1766ad5dd160cc961958dcc0fc0a75a5e86ff6deeccb23c6556e4158efb7274e743eb851cf3a45a30fdd407012337392561
SSDEEP 3:MsFl9tlGallzUNl4HF+flR+2nXl1VT1DfS/976N3l/:/F3XGuOmsNY2XffSFWN3
TLSH
T11813926F69DE0DC2E8482E3C088F433C3BB5CC21CD1A27A321782A39AC98749584B10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 c6545cd3c3a1da2d9775c1a9e1e2f2bd91837c88b4cc510f331a0df2e11c6ce7
MD5 872c1a2a3e367f8dfff24996519003e3
SHA1 929daa05421d36c14ce1470d7f2a3574984a2850
SHA512 8e4619bf88e84e1a9c923c50ae8bbe9fb9778ad1cf401acc22a3df4b0e2380b19eb9ec41fb1c39699f603ed4d6907c94cf33931c42bbb70d5bb076fcc9f120c3
SSDEEP 12:U/gEq/qq4pqp9iknakFkFhZ2c90IR2jBE+sFkn0y+hYc9rTy/8WZ15j4RtmQVDdg:3LqqVdk2a1R4BJOkV+t9rKZ1EtmeS
TLSH
T14A442DEA2948D586F32A9AF929AB333CE43AE1C17C8E9B47E0200D650C24B1828192D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 2074960325c320d13754d907ff6f80a058b13f53e41afcd336c00c6c958e654e
MD5 c876bac2b28e6c8e9773ddcacfe9fe4e
SHA1 94f80ea139e39f90afa53a453c3c484a278080a4
SHA512 66af54fb726b9680afbb26d39885e12dcb5488d3497f55c2cbde55d300687d6194d6165e04c0d952de5c0f5683b08d56da2e3a557b20b1d2477d093eb2477e49
SSDEEP 96:d9GYUfDPLGRgcRUv+Zts+AbGuEWiH4Sflfd:aYUfDPLGRgcRUv+ZOb9E94q
TLSH
T11C25E7EA0B087DCBD392D970AAC0CD183DB8229DADA74C86F05196B556C6FC60FD130D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Cache\Cache_Data\index
Size 256KB
SHA256 2fb48fd5005cdf01e2982068d327e4ee6bad5b61cc997dacb848309201f354d8
MD5 00d387d844f1f3bed4e8ab2617a40bf4
SHA1 edfbe6ccd2ea79dce7d01b2c2ca76e31bd0e3c8d
SHA512 b40a6683180c80caa39a21f1d4bb6b4660d29e9b8049d3b5c6390502700532ab1f74233b0d2e5ddd9ed45507c271d7e0c2b0c13fdbfd9c2033e5ceee40265d30
SSDEEP 3:LsOlNllklkXlwC10mltflXlWNtlGlXl:LsK3lPw6vMN2
TLSH
T17744022B13C52C45CDC011BD8403A3784324C000DD1FC743530681604CD77D90F4D480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 7dc90ccbfd10e901ba96ae3051109e1acac57c3cdb96890d6f85e37c656a3891
MD5 980ab75af79c52b9315cf63e04b1d125
SHA1 4ced60cab21d43d1e1dbd963bc5f9999bdef6ab1
SHA512 0828525ef015b9c7486581302d462b0a251dd0ba956f17253205f8fa40d503408acd38e1ef3f71eb4c38ee36986e50b1949884a53d17b5d031f2ef53cf377ce1
TLSH
T108E02B81864C0F0DD32EA6F7CDEA03058A0A42C42DBE3A03A981C6C133538241288222
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 43f330c47513b735aa95546417a7b3ce2048cd94b0d8350198d5588af1ef7f11
MD5 44a66be6c2b259e211cdb65613fec131
SHA1 b93aa4f9ced1e15c2fbe03f0a9fba1935966983c
SHA512 725c793caa68fe86c33bd318349c148cd15269fc5d4d92b3eb03d3a46097ea8e0b873b9729bfb3f5e3e479f126c375cf0edd41b889b8a9f7462ae972f141adcb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 247180567cb805d1cfd2ccf23b5f262b55b87d203cb80d2b92504f4715ecf234
MD5 6ee8532c88b80b6f0a0d3f7bc4760e2d
SHA1 02f61aef14ec883add649ad977646d4084c41b97
SHA512 52063d46f0ac1f49214ee17c4db15e9a8e11a4f7c4620297f6f5d28195b79a107c242a43f270b547b4e62482408c260d63b755cd622a467e1d316aa25efe9fcd
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\DawnGraphiteCache\index
Size 256KB
SHA256 4568fa3287a50acc17527df92029d39b213ec7dd822b2f1373ee20d2b9ea0720
MD5 6acd7336de527cd182b90ecf2936aee6
SHA1 cb6809ecb55a1990c7a1d132755174d87f30e811
SHA512 535d22174d8561a02047c440d1c867fd3f1d3b54f97652981c0f909a16b76b5d17da89c044ba4e5f7ef2ac8abf89da5a27907d6a40353c51344787b6fc08caaa
SSDEEP 3:LstlNllklkXl6Bullt:LsX3lP6oX
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\DawnWebGPUCache\index
Size 256KB
SHA256 dc4b80fbfa85b849ecdf95a083d3db8536d9e6aaa5960c2a109836b86b6ac407
MD5 5bf5f8c1eb1070731b85c71951a1574a
SHA1 66a339a0797ced4f7c8a4f010ff6ac09eeafc3fe
SHA512 66c1cdb4efcdef425014baf9daef4331514d2ca531bf705f655c6d86c8405f422b39ddc9df1ce79b735bd844903d66258b19cfa217b2e952178eadfa05492b21
SSDEEP 3:LstlNllklkXlqsdt:LsX3lPqs/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\GPUCache\index
Size 256KB
SHA256 b18c3f8c5f0ca95808edb141accec907bae0d32f4d3efa8e5c3307ff2a871286
MD5 04ba4716f9f8ca53ae034cb7787e7234
SHA1 04dc200aa48b01f2d75f801b527a37af703063a5
SHA512 29d5c1ec2452362821adbb652e920c2e286b4bbcca5620075e8b1386d44be9d6e306c5778ff45d65a2bb23602ea33d94ca9a29932ea53f5396c8b1a244fe6bce
SSDEEP 3:LstlNllklkXlJtat:LsX3lPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Preferences
Size 3KB
SHA256 77b79c27612f4d707578ef1c8665e0958a06659a4fc139cc1054825cb3707196
MD5 5d80d621f4b8bdf49db1b64dcad184bf
SHA1 4bd6bd68a1a28a764e32302aa77b5f03552ab631
SHA512 fde1c7ecfbe9ab26e17c9c6aa82c0890df01a4dbea856ae661c5e9126c5353887038e7f13d1328e4ba385d7a81fbcd8ae6640e5fa45e57899c81ec1c78f0b996
TLSH
T1B561316EC1604CA70EB6BB7AB83E1781FE50477F1241184A7E7E498C4FB292B8441F6C
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 25780da9839f2f2213f41607ba7004a2ddb7bf0d5b90098acaa32251d2477b23
MD5 6726ace40da33b375e08c6ff001c8f4a
SHA1 1d3e18202899d7ea1c5fdc40233cda1bcf476ed4
SHA512 292ca1c38567c43191788ea2bf66ccdb4df6c043f68507640f55934f629ea83ecfc154757aa763c79055cbe0a4e3d20d62656cfac96c2fb81131ea99c7187cac
TLSH
T156A0021202888160C58006B12901878C1201B96584100713F6D00386AC604D44919184
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 a36b4966ec13a87978a2ebd994764715a47a7d6200661ce322d395db66c269e6
MD5 249a02c51b104fcad09167eb8d9a8cf8
SHA1 ed2545b62b792b8017c45602688fea7b7fdd77f8
SHA512 5f2ad9cef69841cb829a1a098a1b76bc48ee577ad2657ddd4ec5a4f648ebe5f705519e0851ce6198a1292949e61143e76730837b306a05346ddfdc374944b9ef
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\GrShaderCache\index
Size 256KB
SHA256 a428952f589300c5bb500fcb452e2913ba9266581684602ed21ef6abbcbbc744
MD5 388e8d690f8f8296343752a967b052e0
SHA1 699ba2a3ed9fb937ca39f9b02176503b42e95729
SHA512 7534948a6c0c08a4f5302a69a92d10877d51b69b3659744177eaf689945de7eeaa8d9556c5acd920d5235f3b1abb2520705f08eea6bdd1250a2069f3ee060d07
SSDEEP 3:LstlNllklkXlgCF/:LsX3lPgCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\GraphiteDawnCache\index
Size 256KB
SHA256 7bf54849229903d16316dbdcb75f23d3e8130f4a6e56228ff531deffc8e58502
MD5 c312a63bbe429acbe955a9c7b3350513
SHA1 62b1c5f77f01e471592439d20fbed9c4e33582a8
SHA512 6bcf9a0d989a40a9c349516afc818e0877aec651e371bfe03394df41e9a8cdd725c837423a0cd4f2fb0128bc987cac9cfc2a9f07b22ae140f7db993af24f151a
SSDEEP 3:LstlNllklkXla/:LsX3lPW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\0lqmepn2.gvy\Local State
Size 1KB
SHA256 0825d0bc1dad511a45331d9fdccb6774aef9f48974fd9f2249d2f12a946aa4f2
MD5 12694e3a3ac2a64996a41766b35cc145
SHA1 b0012a3813f231ade21ed8c59dda8525f2601503
SHA512 919c9631f70cab24ec92d987cd55ab1f0d9e5b4e9c9eb813ffdf9c1d6b2f5af1a4965e46d31ecb440778bda266c5080b63befc7143e8260de6197983e46d1f55
TLSH
T11B11B5B7B0B875A99DD8C69111409BBB4F38812FE0418D89BEDF181516B2A981A03C3D
MD5 SHA1 SHA512 TLSH

Submit Download

btxk5d5g.mtb.exe

Path C:\Users\Admin\AppData\Local\Temp\btxk5d5g.mtb.exe
Size 139KB
SHA256 a8f05cc72ee6258a432c0b90f2c4810ebed22a26d862f572441cfcbcacdd53b7
MD5 cb1ff5c7d1f84e6ea06d63f139561ffa
SHA1 7da9655c4f8ee2cd4bcc84f51012ebe5fb5f4326
SHA512 1abcf1baf36f8aa079a6264f4286e1af468219e47d4c4cb9c0b2a59821ccbe01d74aa30dfc56a0e590df687f8cd3d201766e39e9e9664eff4be99620ae0c54ee
SSDEEP 3072:TGbZd0QN14PlA8yEC6SXoV7h6KIs9w+XEFN:TGj0QNePlZUYVN6KN9U
TLSH
T1BFD37D8237F90526E1BE97F5A8B542414F76B9A36833D78D1DD210EE09F6BD48C20B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

242b71a2-e062-460a-b32e-567a987a8b99.tmp

Path C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo\242b71a2-e062-460a-b32e-567a987a8b99.tmp
Size 4KB
SHA256 7da72aaa08a1593c03f09dfcd436ff2e4ca9b60aefb04ff70557a542fecccbfe
MD5 9e1951c7078f0e12bf23f5aa4ec72ae3
SHA1 0e7a3edeac0aca46bfe9405935d12634fdc87af0
SHA512 1e937605a886b5aab8a0736fd5a1db1f33587247b49e4bd2faaeaf89848d5fd557a53cd4330e9b6986c780decd38077f0f9f2f73dc2d2a61780fa9311fcb3928
SSDEEP 96:RqGNkbQsFfHE958Frh/cInURoDotov1ncDMFBV1v6wlo1o0eUnXCgEq4a:YGNnGZooDUwVKM7xo1oqygx
TLSH
T1D8A195716434AC679BF29E45B98A3607AFA96137E0913F48D6D81A1C08DBA581382C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo\Crashpad\settings.dat
Size 280B
SHA256 41c8ab2a79d68f2444c717cb1996a1f9e6de7120ea56cc5a5fc1a6f8ab0b3ec8
MD5 7f6642a509a55e8ae49af0c995baadb3
SHA1 d207626daf3424d6946c2030f676d6ddce872a1a
SHA512 f3fb1f9861cc8b51b28d32606d79528a528205c73b0ee9e57e8b5fee214dde67e967e09fb79992192c068223f0d42b841516e13bff36d0f0b7748a219b18a158
TLSH
T186D022F2FBFC8A08E008083F8A828B080300C30000C20380B0302FC0ACC083CE00BEA8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 f4d5778a43ad39d270ff65f85e9d5f7e6d130150eb419c04dbd0749c5e7d6eed
MD5 54ec3c74dc725ee61b22b0811febcf5f
SHA1 c3b6778db4fdb8ba28b868ae9556a0ef843d2a9c
SHA512 476a0311ee3c35a4741242653a230128d67912483d3b48cd7183ec23c3b6d6addcd562966e9ccea95032630c9693c198db86086bcc9571b4ba73800aeec3f0dd
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo\Local State
Size 1KB
SHA256 82d7aebf15102c470d8734b04ba472a267f3b16e9005a7901cde1cc8e9d8a005
MD5 9165dc871398ea3134f7e4a6a76cf3ca
SHA1 fee1bd8caf534a6defad31e637c53ffee1ad3bbc
SHA512 25e8914ef972a8dd819f6eb65fb630beb92e3c41f5597eb82a9d417b593a72d7a27863bbd226c4a910a8d4c0e560d52362e7d1659238f7bea9c50b2ab6e93498
TLSH
T18B3197F0F8BC1D37F8D11986625ABB575F75A072A0415D0851DC160C19FBA9C5296C3B
MD5 SHA1 SHA512 TLSH

Submit Download

d2bcbff2-778c-4b81-aa5c-6a23e70552a2.tmp

Path C:\Users\Admin\AppData\Local\Temp\lu0tcyla.dfo\d2bcbff2-778c-4b81-aa5c-6a23e70552a2.tmp
Size 3KB
SHA256 244e2c27aa336253f593b6721a3d7147f8e920457b535988951f37fa078b7e55
MD5 549e45e0775b5eeac16dfa816c0e6c92
SHA1 d3456a48cb6e86c0f53db82a1ba6135cd06c0d3f
SHA512 a1ca56a671db7ef04b6685ef88f1858f51d904873e1bcb62116a15143c412f48930117379a2643aa521a262514d685cc53258e3ce52cb20b267d58b207d671bb
TLSH
T180819471B8386C77D7F25E85B94A7A038FB97177A4512E44DAD8232C08DFA1C1346837
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1960-37-0x000001EF3ED30000-0x000001EF3ED40000-memory.dmp

Download

memory/2412-38-0x0000028F84BD0000-0x0000028F84BE0000-memory.dmp

Download

memory/2412-40-0x0000028F84C60000-0x0000028F84C7E000-memory.dmp

Download

memory/4572-471-0x00000000007E0000-0x0000000000808000-memory.dmp

Download

memory/6024-23-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-239-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-46-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-43-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-42-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-41-0x0000025E4E3B0000-0x0000025E4E400000-memory.dmp

Download

memory/6024-39-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-36-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-35-0x0000025E350A0000-0x0000025E350B2000-memory.dmp

Download

memory/6024-33-0x0000025E4F4E0000-0x0000025E4F6D2000-memory.dmp

Download

memory/6024-32-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-31-0x0000025E4DFC0000-0x0000025E4E1B4000-memory.dmp

Download

memory/6024-30-0x00007FF6CCA80000-0x00007FF6CCC2C000-memory.dmp

Download

memory/6024-29-0x0000025E4E4F0000-0x0000025E4EA18000-memory.dmp

Download

memory/6024-28-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-27-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-26-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-25-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-24-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-44-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-0-0x0000000000400000-0x0000000000518000-memory.dmp

Download

memory/6024-19-0x0000025E4DDF0000-0x0000025E4DFB2000-memory.dmp

Download

memory/6024-22-0x0000025E351F0000-0x0000025E35266000-memory.dmp

Download

memory/6024-21-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-20-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-18-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-17-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-15-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-16-0x0000025E34C40000-0x0000025E34C41000-memory.dmp

Download

memory/6024-14-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-13-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-12-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-11-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-10-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-8-0x0000025E4DB10000-0x0000025E4DC22000-memory.dmp

Download

memory/6024-9-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-416-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/6024-7-0x00007FFDCD7AF000-0x00007FFDCD7B0000-memory.dmp

Download

memory/6024-6-0x0000025E34DA0000-0x0000025E34EB5000-memory.dmp

Download

memory/6024-4-0x0000025E34C80000-0x0000025E34D96000-memory.dmp

Download