fcc64b5263eb56df719d9ac9d73d6e7c07f23c5c81de0bcee3ed55d364520bd7

Analysis

max time kernel
124s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2025, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AnyDesk_vip.exe
Size 4.0MB
Sample250901-le8jestmt4
SHA256 fcc64b5263eb56df719d9ac9d73d6e7c07f23c5c81de0bcee3ed55d364520bd7
MD5 9dfc250298f5779436e17748250d3a60
SHA1 2f9128796f577b212cdcd581ea57b4fa559ddbd9
SHA512 35c60a6d7987647cfc2f74f680677cd0d37d0fdfbd8929f5daab9eb470e46f492c6d19f580c2a0fd13a6a2146c9bf786d86b2073d41aa318dcf7faeb051712d1
SSDEEP 49152:cOUVOBgM75MukiXEevkDmvuMyatahJsU7y8PSv0/k0k7Pc1xP5YXlRBgdx0QjC:HJVm0rmsV0/k/cfP5+lRBgD
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134011924792711157"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2238466657-712128251-1221219315-1000\{AA443FDB-B93D-42D1-A4A1-83572A2B04FE}	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2238466657-712128251-1221219315-1000\{22E3135F-D1C0-48CC-BC88-A9DF283719B7}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2238466657-712128251-1221219315-1000\{3752487C-82CE-4B74-AD11-A02FF1E9CD8E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5964	AnyDesk_vip.exe
5964	AnyDesk_vip.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5964	AnyDesk_vip.exe
5964	AnyDesk_vip.exe
1980	msedge.exe
1980	msedge.exe
5964	AnyDesk_vip.exe
5964	AnyDesk_vip.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5984	chrome.exe
Token: SeCreatePagefilePrivilege	5984	chrome.exe
Token: SeShutdownPrivilege	5984	chrome.exe
Token: SeCreatePagefilePrivilege	5984	chrome.exe
Token: SeShutdownPrivilege	5984	chrome.exe
Token: SeCreatePagefilePrivilege	5984	chrome.exe
Token: SeShutdownPrivilege	5984	chrome.exe
Token: SeCreatePagefilePrivilege	5984	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5984	chrome.exe
1980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5964 wrote to memory of 5984	5964	AnyDesk_vip.exe	78
PID 5964 wrote to memory of 5984	5964	AnyDesk_vip.exe	78
PID 5984 wrote to memory of 3712	5984	chrome.exe	79
PID 5984 wrote to memory of 3712	5984	chrome.exe	79
PID 5984 wrote to memory of 3000	5984	chrome.exe	80
PID 5984 wrote to memory of 3000	5984	chrome.exe	80
PID 5984 wrote to memory of 5640	5984	chrome.exe	81
PID 5984 wrote to memory of 5640	5984	chrome.exe	81
PID 5984 wrote to memory of 5892	5984	chrome.exe	82
PID 5984 wrote to memory of 5892	5984	chrome.exe	82
PID 5984 wrote to memory of 3724	5984	chrome.exe	84
PID 5984 wrote to memory of 3724	5984	chrome.exe	84
PID 5984 wrote to memory of 5084	5984	chrome.exe	85
PID 5984 wrote to memory of 5084	5984	chrome.exe	85
PID 5984 wrote to memory of 5328	5984	chrome.exe	86
PID 5984 wrote to memory of 5328	5984	chrome.exe	86
PID 5984 wrote to memory of 2128	5984	chrome.exe	87
PID 5984 wrote to memory of 2128	5984	chrome.exe	87
PID 5984 wrote to memory of 2864	5984	chrome.exe	88
PID 5984 wrote to memory of 2864	5984	chrome.exe	88
PID 5984 wrote to memory of 4864	5984	chrome.exe	89
PID 5984 wrote to memory of 4864	5984	chrome.exe	89
PID 5984 wrote to memory of 5184	5984	chrome.exe	90
PID 5984 wrote to memory of 5184	5984	chrome.exe	90
PID 5984 wrote to memory of 1860	5984	chrome.exe	91
PID 5984 wrote to memory of 1860	5984	chrome.exe	91
PID 5984 wrote to memory of 4136	5984	chrome.exe	93
PID 5984 wrote to memory of 4136	5984	chrome.exe	93
PID 5984 wrote to memory of 2908	5984	chrome.exe	94
PID 5984 wrote to memory of 2908	5984	chrome.exe	94
PID 5984 wrote to memory of 232	5984	chrome.exe	95
PID 5984 wrote to memory of 232	5984	chrome.exe	95
PID 5964 wrote to memory of 5984	5964	AnyDesk_vip.exe	78
PID 5964 wrote to memory of 5984	5964	AnyDesk_vip.exe	78
PID 5984 wrote to memory of 2144	5984	chrome.exe	97
PID 5984 wrote to memory of 2144	5984	chrome.exe	97
PID 5984 wrote to memory of 2212	5984	chrome.exe	98
PID 5984 wrote to memory of 2212	5984	chrome.exe	98
PID 5984 wrote to memory of 3736	5984	chrome.exe	99
PID 5984 wrote to memory of 3736	5984	chrome.exe	99
PID 5984 wrote to memory of 3680	5984	chrome.exe	100
PID 5984 wrote to memory of 3680	5984	chrome.exe	100
PID 5984 wrote to memory of 2012	5984	chrome.exe	101
PID 5984 wrote to memory of 2012	5984	chrome.exe	101
PID 5984 wrote to memory of 2164	5984	chrome.exe	102
PID 5984 wrote to memory of 2164	5984	chrome.exe	102
PID 5984 wrote to memory of 4840	5984	chrome.exe	103
PID 5984 wrote to memory of 4840	5984	chrome.exe	103
PID 5984 wrote to memory of 4448	5984	chrome.exe	104
PID 5984 wrote to memory of 4448	5984	chrome.exe	104
PID 5984 wrote to memory of 2216	5984	chrome.exe	105
PID 5984 wrote to memory of 2216	5984	chrome.exe	105
PID 5964 wrote to memory of 1980	5964	AnyDesk_vip.exe	107
PID 5964 wrote to memory of 1980	5964	AnyDesk_vip.exe	107
PID 1980 wrote to memory of 3900	1980	msedge.exe	108
PID 1980 wrote to memory of 3900	1980	msedge.exe	108
PID 1980 wrote to memory of 5344	1980	msedge.exe	109
PID 1980 wrote to memory of 5344	1980	msedge.exe	109
PID 1980 wrote to memory of 3488	1980	msedge.exe	110
PID 1980 wrote to memory of 3488	1980	msedge.exe	110
PID 1980 wrote to memory of 1564	1980	msedge.exe	111
PID 1980 wrote to memory of 1564	1980	msedge.exe	111
PID 1980 wrote to memory of 4676	1980	msedge.exe	112
PID 1980 wrote to memory of 4676	1980	msedge.exe	112

C:\Users\Admin\AppData\Local\Temp\AnyDesk_vip.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk_vip.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu --disable-software-rasterizer --no-sandbox
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffe87a3dcf8,0x7ffe87a3dd04,0x7ffe87a3dd10
    3⤵
    PID:3712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=1872,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
    3⤵
    - Modifies registry class
    PID:3000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --field-trial-handle=1976,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:11
    3⤵
    PID:5640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --field-trial-handle=2144,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:13
    3⤵
    PID:5892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2812,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:1
    3⤵
    PID:3724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2840,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:1
    3⤵
    PID:5084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3064,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
    3⤵
    PID:5328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3084,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:9
    3⤵
    PID:2128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3512,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:9
    3⤵
    PID:2864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=2820,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:9
    3⤵
    PID:4864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3560,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:5184
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --field-trial-handle=4124,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:14
    3⤵
    PID:1860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --field-trial-handle=4612,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
    3⤵
    PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4780,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:2908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4728,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
    3⤵
    PID:232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4840,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
    3⤵
    - Drops file in Program Files directory
    PID:2144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --field-trial-handle=4792,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
    3⤵
    - Drops file in Program Files directory
    PID:2212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=2952,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:2
    3⤵
    - Drops file in Program Files directory
    PID:3736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --field-trial-handle=3056,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:11
    3⤵
    - Drops file in Program Files directory
    PID:3680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --field-trial-handle=5028,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:13
    3⤵
    - Drops file in Program Files directory
    PID:2012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --field-trial-handle=4604,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
    3⤵
    - Drops file in Program Files directory
    PID:2164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --field-trial-handle=3556,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
    3⤵
    - Drops file in Program Files directory
    PID:4840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --field-trial-handle=2904,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:14
    3⤵
    - Drops file in Program Files directory
    PID:4448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4644,i,11911249200407605657,13325075742249684824,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
    3⤵
    - Drops file in Program Files directory
    PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu --disable-software-rasterizer --no-sandbox
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffe651ef208,0x7ffe651ef214,0x7ffe651ef220
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --always-read-main-dll --field-trial-handle=1932,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
    3⤵
    - Modifies registry class
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=1960,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:11
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2352,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:13
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --instant-process --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3084,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3788,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:9
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3812,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:9
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3864,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:9
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3916,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:1
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=3928,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:9
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=3984,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:9
    3⤵
    PID:3724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=4024,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:9
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=3340,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:9
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=4108,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:9
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=4160,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:9
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=4244,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=4256,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=4284,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=4316,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=4340,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --no-sandbox --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --field-trial-handle=4328,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=4360,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=3908,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=3872,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5188,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:3896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5248,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
    3⤵
    PID:2364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --always-read-main-dll --field-trial-handle=4468,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:2
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=3924,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:11
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=3156,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4664,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4664,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
    3⤵
    PID:3916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5228,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4156,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4436,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:14
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5136,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:14
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5212,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=3860,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4080,i,15085986127213669459,11680382512169004626,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
    3⤵
    PID:5304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4476

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5136

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

debug.log

Path C:\Program Files\Google\Chrome\Application\debug.log
Size 476B
SHA256 369874beb54c5245a70b2bb76c44a1e0e8741ade7fa0407efc0d6ca64cd3e78e
MD5 a328cce09fbe5b6901698b4fe1c196c3
SHA1 9864f42560a8bde5b684555b9fd9ce327d89b6b8
SHA512 a27dbca04bc23b5b391f42c267371f7b9fa68184b95c1cf794c326a2973db5ed84c47d654f6009c49edac07c0e01bc19b2aa94b583aa826242de993099c781ed
MD5 SHA1 SHA512

Submit Download

debug.log

Path C:\Program Files\Google\Chrome\Application\debug.log
Size 595B
SHA256 d93e0208c9d315209f80a246b464e0ba1743131f8d3bc2483abe24f2a9652416
MD5 a5bbc0db1131403c79d0cade64a274bb
SHA1 c808f4944ae95ac262ee6f58765a3041483a0f0d
SHA512 ac6f03bcba8d66ea2e557f45116638969f71fbb196cffc675fcbfb4c0a1ba43dc176c10828ff7be85f789ebc98539cdafb26a0ae411016a80812007190fe5bbe
MD5 SHA1 SHA512

Submit Download

debug.log

Path C:\Program Files\Google\Chrome\Application\debug.log
Size 714B
SHA256 c354af756ca28845d7f7db394db0bc1f6b75aa8352727a99d64caca83e22312e
MD5 d2925514a56eec04c2ce9e6731cf9254
SHA1 4ab8f15e7236dc119ecfce044e2402a7b602e924
SHA512 61c2b5f5341604148f31c1239bbf6d501a3fab3c61cb8a692d0743a1ae72c0965528e5da786579f0a08496d37a7944b82c0196eb8a0491a70152c5badc5f1ab8
MD5 SHA1 SHA512

Submit Download

debug.log

Path C:\Program Files\Google\Chrome\Application\debug.log
Size 833B
SHA256 c5aee91129817b404de9cccae76321e4105f41a9fd9b85a6689fc3da3bfb0b27
MD5 f0494ed1edad3b148a44dd87c9e4378b
SHA1 de4b4a04276b99bd9399410718d53071d42d3417
SHA512 fd7ee32082082dfc65c29d4835643f59e1bf1421cf8c6ad4ffdfef3f8fdbd0fb64da3e95bef8ea04d5fe5109e43822de429c421898b26b9e4daea7bc3a0991dd
MD5 SHA1 SHA512

Submit Download

debug.log

Path C:\Program Files\Google\Chrome\Application\debug.log
Size 952B
SHA256 36238cca1e1a940c70b50fa31470695b3ad04a86b99512c0cb02450c035ccc9a
MD5 82b8922e584b49658fcbd2e56c6dfcf7
SHA1 f4cad7cfd35079621db7a391eac02b45d1f9c4a8
SHA512 a2e12b9d10ba9b89843aca91fc6babec2d4eacf855203875e82e88cff04446a0522b3afcde5e3ed1e5af87e4728b2adc9cfdea6938fec149e03764d7883f4429
MD5 SHA1 SHA512

Submit Download

debug.log

Path C:\Program Files\Google\Chrome\Application\debug.log
Size 1KB
SHA256 6c384c3bce68438d4fd26db81db0a3604367ca97e8a87c0e0bd7293b1752449f
MD5 c9059a26a190f47717666e4d142831a1
SHA1 d3b668bf191ffa056325445df08006587e402705
SHA512 11392ecf11fe684ac3446eb15df1a3a87ceed42de8e3e1b9b9a85680e619ff63ab9b0af582135feab3133f88f59d5fafa34fab02b204e7db7941a3da28586694
MD5 SHA1 SHA512

Submit Download

passwords.txt

Path C:\Users\Admin\AppData\Local\RavenStealer\Edge\Default\passwords.txt
Size 8B
SHA256 285386bcbda5b2338822b19266a2b90c6d87e9da18401f9148c69e469c11bcb7
MD5 cdc6bc1cb4ec05d3e1952695ca640971
SHA1 e1c92176fac5ddd9ea6c2cb2e01d03514bc3c84f
SHA512 b8025aa7007a269a132403b2917710e023753980d078a72ae83cd01e40a71239344244c949662b26ff04f761b5859b49b1105b53506b9ff1ad65d9fb18e7c6bf
MD5 SHA1 SHA512

Submit Download

1b6a5c29-6d2a-4e66-bcc8-03c13b3ae92c.tmp

Path C:\Users\Admin\AppData\Local\Temp\1b6a5c29-6d2a-4e66-bcc8-03c13b3ae92c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Cache\Cache_Data\index
Size 256KB
SHA256 d2221f5a2e4af1bc96f8b1cb4ad499e7a314f0ee1334b108c0272789a2654f50
MD5 742cce765b6331b6ec27506394a22a34
SHA1 f28ec67a403da00c7c87b23afdebba25dc4d0062
SHA512 fb15c13bc74160ba6e888d94b1a50af310bb5634bba9a72ac0d768ccfd7367e4f38c0d7e98fea8fd1359af82100d7ead9482918ed5cb606dbe6260e15f65d63f
SSDEEP 3:LstlNllklkXlb:LsX3lPb
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.95.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Network\Cookies
Size 20KB
SHA256 72d049174f8bb874a5db67735ce76cab400f25a72391ec557ef2720785b4c4ac
MD5 febe8b30c72b9ed5786ae265ebaf844a
SHA1 010452344e00fcf8609b9df083803311efe683e9
SHA512 01863fd726d2bb344f368673a31df809a58c810940200a8cf02d1be09ce92f1d097419fffabbada9651d2977948111e0916e2012d92974f96ce7c942ef01732e
SSDEEP 24:TLP91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:Tr9aw/aHLopFMavU1iB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Network\Reporting and NEL
Size 36KB
SHA256 951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804
MD5 fa739570350b78ef09e5d8ca61d0d71f
SHA1 d4e932ca96e76aeb84d3a151d847658df6a5555e
SHA512 8dc44c2f20c0a051568e7479e4553dbbf8ad4ee6b4d5474d8493c4b957f563f858918d862621ff7ccb190be693877dfb0a1245998925f47f9976d431a007ac86
SSDEEP 48:TqIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:+IEumQv8m1ccnvS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 a834bde0259c16a607fd8f17794a00500823e551b4b8bfcbd3c1c7c1626a0c6e
MD5 81744f60797a969407c891910259ca1d
SHA1 973061905bcdb71780eb117d369c6307c4d6b21f
SHA512 4ca46d4dd64acd58729acd3587d4d8f5e948e34ee28532f38fc28d7f88b56ab6799fb58d26c1ad63b5ddbb971db29b12d2c4f57c868ec09e384aca64ad3608ae
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5984240608984\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Crashpad\settings.dat
Size 280B
SHA256 323c0cf7cf48661a27b71ea1b7af1cc8ab080c9e8ed3c153f54242c87b5d2b6d
MD5 2ce8b28a83d6431a1aa9838198d22ecd
SHA1 bd8020871b71635f1eac86e7fbea21013e1dc6da
SHA512 65a632d4321d1c7d6d56ce00b321f35c3c94a1cb6e2f65d04b567de2d747be6d57c4913d8dcf06354dafa031f3762ab8c78a46e8c087d3212692c1bd47a5eb28
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Crashpad\settings.dat
Size 280B
SHA256 2e209459b5a34bc214a8cb349f97cc95c46fd5496aa03ca8ea3640b1da454406
MD5 e8956984abad8b38204d7e00f7efec48
SHA1 e99245f041a7e9a2c55bc9b94d48d960199dc91c
SHA512 79df9d8963aad7ac186547abb8748c49895b6df2af0c5bc6a27b24ec201c7c9602ce5f1d68adc06ace72b7c3065a97c0bcf63a1cd62737003b85af3685987ef7
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

407dfb9d-1a07-47a4-89d6-00ec5644955d.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Default\407dfb9d-1a07-47a4-89d6-00ec5644955d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 5632be969309ff508c9d96aa477aac391690c9af5cc6481d19a893e512e750d8
MD5 b6612f166cb121bf8e0003dd846ec782
SHA1 be7688cbe6ed88fd7ba68c8959a61b822623c72b
SHA512 7a0e14c70590ace7d00ccafd68809f03ecb5e8b499fa7be1d45991319fa2657397e30d243036f2def1dadbe7cf4f1c192db533f39116b28aff4ada0c9a855ddf
SSDEEP 6:/FiIa9vgnNs5mm//Xxek/mgvHtaQxEPiA+d:dZalgNs5vX51la/if
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 f21a6b017ac758856cd1f8d0ca6bcd2a61f9fc0a44fada621026aa36d9aadc03
MD5 6dd541a1ce1cd46a91c5a837b638c32b
SHA1 658b712e724921a672392c3a230d0b6782e23fa6
SHA512 aaf62124ef89e77dc543eb631385f87b9c009ef3dccbac543db82f4df22b1abae14faf00cea6d457534e41971ad081b14d37a23b2d0f97226c59bfedd4c778db
SSDEEP 24:G96KVWWlPQV4XqeaPVHColV4PSeaPVHaUAPnQ5sIv7YmtQ5mtVIyUmO:HKVLZQV46esVV4PSesRz77SQUmO
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 12f6bf9b0717eba9c637f05b1df6dd91af108fcbcc223c56b3a06d3155eeda30
MD5 d5ae2cb803ae90348702e96896946302
SHA1 3cfb23bbb6bc210736f6ef1779f24f5dc0a4a111
SHA512 0799210c8cffdead7ddf0c1e2c4cfb3bff6811ec6afe98500a646e30c3a20158ceb3e422ec4d412b04d6de14b7d5db41238a37120d6e6097b11619699067e9f4
SSDEEP 96:cDXBDF11M0fODZWukmRpyJ03qAESDXmEyEXkAsVdyjJ:iu01uOdEyC4Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 304846ae048f1610a26490fb44d58dddb449fb86653363dbdb233b7280445f04
MD5 d86c65d0541ae9fb855fbcdd26399ade
SHA1 391a264068bc48c0b3c7b1ccf18b6764e3414f1a
SHA512 6080977c7d4a8d4f9ddc1c697d71aee8bdaeba10ad500b84c301a85752ed9396e06230a73bc4f73e50e4b68f1ea8c3674327a6d77487164c0eebad624376b4f7
SSDEEP 192:/FV0JMnBrcIlXs3dBBYhV0JMnBrcIlXs3dBBY:30JMnaEudPYj0JMnaEudPY
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Default\Cache\Cache_Data\index
Size 256KB
SHA256 1db29f86467046e1e26909ea869cc3a1de2109ded2055f0440aae3dd3ead1827
MD5 47e8d6847534d01e7b54be0fc8f3b9a3
SHA1 e6787ff9f8af8c895fa5dd900299cf82e9a65ea7
SHA512 89e4906e651d19e22f2f4803c8cc1a7e0c555cc6762b34e02399e48fb3b4a1df64e6c3cad25951b5867dc44490435605f522ca73e4bb8588207e0dc1b99f88a7
SSDEEP 3:LsBltOlNllklkXl25+3qlta1t/ncNtlME/Xll//d/Jllll/:LsY3lPeLw+NcE9l/VDlll
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 1bdda0ad3f9395935b349ce2ce4f5ea387bfc4475c6ce342b85fb0ab64c02eed
MD5 21f62ddab28a8ff8e850ac5325af51f6
SHA1 9715e53541db081e632b52e6489e5ab66c6c469e
SHA512 27b5f89325d4f47523959dbca7b3af4c01e55d933f007b30cacc6941ef490d5c7644760dabe0e8cecd1bafbf106c4bb6c87a9a8db58437cf12f32a962125529a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Local State
Size 3KB
SHA256 47e18fca14c42aa9dde34e629306b3a829b3e4fb52eb21419bc90357fe41e894
MD5 b593c3941f0620689ee2cec2d42f6899
SHA1 aa63e124e5c68c03ee1df5b0c00805e97e0c8046
SHA512 03b815acb8ba646b09eeac63f6bb5550835c4642bf7d146f79c285acb17e26e1be25244265c16eff4c832fe6d3b3dae7d43f9eaabefdebf292cf5875054d5a82
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Local State
Size 4KB
SHA256 6f1a16b6b00727d08caa7a1a8aaffe8e1b7eba2f18ad07d348db34c86ed784f4
MD5 f79c5af9bdd055b688e7f4bd5a48534d
SHA1 492b5b2668a58cc8e7271b8d4278c83030dcb3c0
SHA512 86f4db06e55a084971d1f99be65d3c11ed3a87ff59d36fa09b392765244ba099b5ce1ce3cf0a2d5cb6a67ced4cd36b5b6c7d2d90c8056a61456e35e44258e188
SSDEEP 96:hqGNkCufTQw4Q8Cl58Frh/cInURoDotov1dDpBmP5vWPb1CJjOmDc/ZBBa:IGNboQwYooDUwTvAAb1OSmDL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe577c73.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1980240614171\Local State~RFe577c73.TMP
Size 1KB
SHA256 6c6a6ac3f0c12ad6e0f593ffb14bfed344c5791fedfde7054b0ef0e13030a83e
MD5 d515357fdb3ba5a628ab819e9447d6e9
SHA1 ef2e32ac1336be1722f50693f49db66de2c366d8
SHA512 f4d9707f86e5921a77341add621b6af8d01d0457b5c2684820918dd646c0e6f0b24b378503b3b3125c82537ff8d2fc9280eecdfe991bf3198163df15698978e2
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1980_1893768432\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1980_1893768432\CRX_INSTALL\manifest.json
Size 1KB
SHA256 dc78cae7f88ceb3e47bbc80218cf28c50a9e9f3c09ab6a71b57de2f6fe248444
MD5 0b98942464745d538fcb89f987306eff
SHA1 2abc433ea172c3e6bd4cc3804a133c6606f0e629
SHA512 99922829717bcd984f486462799c6319a58ddd8c8df56688318ed6857dacf1668f120d394ed5591a080c60a0fae92a4cd15ed5929b54f30ca7e43218d19b7956
MD5 SHA1 SHA512

Submit Download

ceb8f356-7f7a-4603-98bb-b34b28ec2900.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5984_780277570\ceb8f356-7f7a-4603-98bb-b34b28ec2900.tmp
Size 160KB
SHA256 5800e15d720048213e6e810b961f25adddfcf04a13aba5b1451d079fd9743280
MD5 849498ca4afbb7302e6379ac5dca7e34
SHA1 53758ae337679fc97ff43deee85c2eda702afea5
SHA512 6710b4e3bf53675a96b39aacc67b0dce2642d6da70ea4a68a192b5b3bcf243c0b0b3dfb628155a67d458c94c22f3f01cd1712220fbc82b4e920c505caf27b36c
SSDEEP 3072:Dg5EiFMwdRVwVWMiPUxTcWzAnSUdJDeOkC/AIFrSC79wFMpKIGFf8Nxpl:U/37GriPEj2SUdJiVFIdKEpl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 3c5dd91a17f0ac025cdfe05a97bc64c0ab61d251004723b32d3f18dc73483a63
MD5 958f41e4a2cb854a937d0be383ace16b
SHA1 3b5abc40234fadd2ea73923b31b1d82d6b174f48
SHA512 1ccc811f72693749c66a7fd151f0ace9a5c65502ffa4bebb93bb92b40ea1f34e4fc520782b952f9cf438e47b57b1907d0e551fafd008f38262eab20840cf1416
MD5 SHA1 SHA512

Submit Download