hijackloader | df605aa20e6a2d09ceefd7db62e7ff24c6495007f5dc2a453e66a6dc8090b1d7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2025, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
installer.msi
Size 2.6MB
Sample251025-sfclpsew7c
SHA256 df605aa20e6a2d09ceefd7db62e7ff24c6495007f5dc2a453e66a6dc8090b1d7
MD5 1e6c20b81eec31ef9abf8838b6c055a4
SHA1 44be6cac388692cc057bf3ae9c3ed5512b002595
SHA512 e1f60b9788cb7e3565c02ee5c7b594cb4bee72bdf0c99a531f5b923df29cd2ffbe383da399a535c3878483cbfc2a943bc5584a16fe89d2a565e62befdd01aed0
SSDEEP 49152:zpPqHgHhehWast/vY32cUiMTajH7RP3brTuZ1Dl+lRvxKm:zq2hJ+32UMOXR/b3urh+lZxf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

credential_access discovery hijackloader loader persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\portprotocol
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024163-29.dat	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Hijackloader family
hijackloader
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 2868	1108	Vector-Sys.exe	105
PID 1108 set thread context of 5564	1108	Vector-Sys.exe	107
PID 2868 set thread context of 4660	2868	GRouter64.exe	116
PID 2868 set thread context of 5068	2868	GRouter64.exe	134

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e57c39e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0EED176E-172B-4FF4-B7B3-F5986C81BC50}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC469.tmp	msiexec.exe
File created	C:\Windows\Installer\e57c3a0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57c39e.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
384	Vector-Sys.exe
1108	Vector-Sys.exe

Loads dropped DLL 6 IoCs

pid	Process
384	Vector-Sys.exe
384	Vector-Sys.exe
1108	Vector-Sys.exe
1108	Vector-Sys.exe
2868	GRouter64.exe
5564	Chime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4512	msiexec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GRouter64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chime.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d847e455a22d09180000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d847e4550000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d847e455000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd847e455000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d847e45500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2868	GRouter64.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
5084	msiexec.exe
5084	msiexec.exe
384	Vector-Sys.exe
1108	Vector-Sys.exe
1108	Vector-Sys.exe
1108	Vector-Sys.exe
1108	Vector-Sys.exe
1108	Vector-Sys.exe
1108	Vector-Sys.exe
2868	GRouter64.exe
2868	GRouter64.exe
5564	Chime.exe
5564	Chime.exe
5564	Chime.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe
2868	GRouter64.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1108	Vector-Sys.exe
1108	Vector-Sys.exe
2868	GRouter64.exe
2868	GRouter64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
4660	chrome.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4512	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4512	msiexec.exe
Token: SeSecurityPrivilege	5084	msiexec.exe
Token: SeCreateTokenPrivilege	4512	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4512	msiexec.exe
Token: SeLockMemoryPrivilege	4512	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4512	msiexec.exe
Token: SeMachineAccountPrivilege	4512	msiexec.exe
Token: SeTcbPrivilege	4512	msiexec.exe
Token: SeSecurityPrivilege	4512	msiexec.exe
Token: SeTakeOwnershipPrivilege	4512	msiexec.exe
Token: SeLoadDriverPrivilege	4512	msiexec.exe
Token: SeSystemProfilePrivilege	4512	msiexec.exe
Token: SeSystemtimePrivilege	4512	msiexec.exe
Token: SeProfSingleProcessPrivilege	4512	msiexec.exe
Token: SeIncBasePriorityPrivilege	4512	msiexec.exe
Token: SeCreatePagefilePrivilege	4512	msiexec.exe
Token: SeCreatePermanentPrivilege	4512	msiexec.exe
Token: SeBackupPrivilege	4512	msiexec.exe
Token: SeRestorePrivilege	4512	msiexec.exe
Token: SeShutdownPrivilege	4512	msiexec.exe
Token: SeDebugPrivilege	4512	msiexec.exe
Token: SeAuditPrivilege	4512	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4512	msiexec.exe
Token: SeChangeNotifyPrivilege	4512	msiexec.exe
Token: SeRemoteShutdownPrivilege	4512	msiexec.exe
Token: SeUndockPrivilege	4512	msiexec.exe
Token: SeSyncAgentPrivilege	4512	msiexec.exe
Token: SeEnableDelegationPrivilege	4512	msiexec.exe
Token: SeManageVolumePrivilege	4512	msiexec.exe
Token: SeImpersonatePrivilege	4512	msiexec.exe
Token: SeCreateGlobalPrivilege	4512	msiexec.exe
Token: SeBackupPrivilege	4848	vssvc.exe
Token: SeRestorePrivilege	4848	vssvc.exe
Token: SeAuditPrivilege	4848	vssvc.exe
Token: SeBackupPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe
Token: SeTakeOwnershipPrivilege	5084	msiexec.exe
Token: SeRestorePrivilege	5084	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4512	msiexec.exe
4512	msiexec.exe
4660	chrome.exe
5068	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2868	GRouter64.exe
2868	GRouter64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 1028	5084	msiexec.exe	100
PID 5084 wrote to memory of 1028	5084	msiexec.exe	100
PID 5084 wrote to memory of 384	5084	msiexec.exe	102
PID 5084 wrote to memory of 384	5084	msiexec.exe	102
PID 384 wrote to memory of 1108	384	Vector-Sys.exe	104
PID 384 wrote to memory of 1108	384	Vector-Sys.exe	104
PID 1108 wrote to memory of 2868	1108	Vector-Sys.exe	105
PID 1108 wrote to memory of 2868	1108	Vector-Sys.exe	105
PID 1108 wrote to memory of 2868	1108	Vector-Sys.exe	105
PID 1108 wrote to memory of 2868	1108	Vector-Sys.exe	105
PID 1108 wrote to memory of 2868	1108	Vector-Sys.exe	105
PID 1108 wrote to memory of 5564	1108	Vector-Sys.exe	107
PID 1108 wrote to memory of 5564	1108	Vector-Sys.exe	107
PID 1108 wrote to memory of 5564	1108	Vector-Sys.exe	107
PID 1108 wrote to memory of 5564	1108	Vector-Sys.exe	107
PID 2868 wrote to memory of 4660	2868	GRouter64.exe	116
PID 2868 wrote to memory of 4660	2868	GRouter64.exe	116
PID 4660 wrote to memory of 4664	4660	chrome.exe	117
PID 4660 wrote to memory of 4664	4660	chrome.exe	117
PID 2868 wrote to memory of 4660	2868	GRouter64.exe	116
PID 2868 wrote to memory of 4660	2868	GRouter64.exe	116
PID 2868 wrote to memory of 4660	2868	GRouter64.exe	116
PID 2868 wrote to memory of 4660	2868	GRouter64.exe	116
PID 4660 wrote to memory of 2468	4660	chrome.exe	118
PID 4660 wrote to memory of 2468	4660	chrome.exe	118
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4188	4660	chrome.exe	119
PID 4660 wrote to memory of 4604	4660	chrome.exe	120
PID 4660 wrote to memory of 4604	4660	chrome.exe	120
PID 4660 wrote to memory of 4604	4660	chrome.exe	120
PID 4660 wrote to memory of 4604	4660	chrome.exe	120
PID 4660 wrote to memory of 4604	4660	chrome.exe	120
PID 4660 wrote to memory of 4604	4660	chrome.exe	120
PID 4660 wrote to memory of 4604	4660	chrome.exe	120
PID 4660 wrote to memory of 4604	4660	chrome.exe	120
PID 4660 wrote to memory of 4604	4660	chrome.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\installer.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4512

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1028
- C:\Users\Admin\AppData\Local\Temp\Dishonour\Vector-Sys.exe
  "C:\Users\Admin\AppData\Local\Temp\Dishonour\Vector-Sys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\ProgramData\portprotocol\Vector-Sys.exe
    C:\ProgramData\portprotocol\Vector-Sys.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Users\Admin\AppData\Local\GRouter64.exe
      C:\Users\Admin\AppData\Local\GRouter64.exe
      4⤵
      Suspicious use of SetThreadContext
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2868
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless https://google.com
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4660
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff84df0dcf8,0x7ff84df0dd04,0x7ff84df0dd10
        6⤵
        
        PID:4664
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --field-trial-handle=2004,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:3
        6⤵
        
        PID:2468
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1968,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
        6⤵
        
        PID:4188
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --field-trial-handle=2460,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
        6⤵
        
        PID:4604
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
        6⤵
        
        PID:2496
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
        6⤵
        
        PID:4104
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3524,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
        6⤵
        
        PID:1704
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --extension-process --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3584,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:2
        6⤵
        
        PID:752
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4196,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
        6⤵
        
        PID:4540
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4360,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
        6⤵
        
        PID:6056
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4560,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
        6⤵
        
        PID:1988
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4568,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:1
        6⤵
        
        PID:2716
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4600,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
        6⤵
        
        PID:1148
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3628,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
        6⤵
        
        PID:2252
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --field-trial-handle=4704,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
        6⤵
        
        PID:4984
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984" --enable-dinosaur-easter-egg-alt-images --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5068,i,1948632836271787138,6515210280477692820,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
        6⤵
        
        PID:2904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless https://google.com
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5068240668734 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5068240668734\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff84b9ff208,0x7ff84b9ff214,0x7ff84b9ff220
        6⤵
        
        PID:2108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2148,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
        6⤵
        
        PID:4560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2204,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
        6⤵
        
        PID:4296
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2676,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
        6⤵
        
        PID:1628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3464,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
        6⤵
        
        PID:2756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3476,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
        6⤵
        
        PID:1748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3908,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:1
        6⤵
        
        PID:5004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3964,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:2
        6⤵
        
        PID:1760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3980,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
        6⤵
        
        PID:3200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=4032,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:2
        6⤵
        
        PID:3692
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3892,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
        6⤵
        
        PID:948
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=4060,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:2
        6⤵
        
        PID:6116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4300,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
        6⤵
        
        PID:1148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4788,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:2
        6⤵
        
        PID:4140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=4840,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:2
        6⤵
        
        PID:4460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=5592,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:2
        6⤵
        
        PID:3924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=5764,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:2
        6⤵
        
        PID:2656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=5932,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:2
        6⤵
        
        PID:4656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=6080,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:2
        6⤵
        
        PID:3448
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6372,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
        6⤵
        
        PID:5936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=6132,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
        6⤵
        
        PID:3956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4696,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
        6⤵
        
        PID:4632
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=7064,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
        6⤵
        
        PID:3936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=3916,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
        6⤵
        
        PID:4984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=3520,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
        6⤵
        
        PID:1900
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=3676,i,7841048944552644151,7723609504302431416,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
        6⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Roaming\portprotocol\Chime.exe
      C:\Users\Admin\AppData\Roaming\portprotocol\Chime.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e57c39f.rbs

Path C:\Config.Msi\e57c39f.rbs
Size 8KB
SHA256 d357564df08d6a99f947f1fe80f6b8983f6ced10671d2e7f953883a9ff85c5c4
MD5 9777a77a2a57768abac7820c3cce3af0
SHA1 993c192c0302f8aafa000cbaf4cf2434280e7c4e
SHA512 2bec297af0b5d227de4c0ff0a5a2d56c017b77f4085c1158c36d26757d3717ff1cca7c7aa5eebf8b705f6587e1af481080ee6ddd23f9fd2e69ff720b1a0ca81b
SSDEEP 96:FEJw97WLpWcyqeyD+DZQ3DcQDmUQIGFCsThqKUQIGFC6jFXQ5QaCThqsH5kWqgQe:Fen2qeyD+D6DpZ/G4Ii/G4yfMBKdpf
MD5 SHA1 SHA512 SSDEEP

Submit Download

GRouter64.exe

Path C:\Users\Admin\AppData\Local\GRouter64.exe
Size 173KB
SHA256 de9d09f0e26cb4541f5d6788aee22183c6a380a1460f0955171316bbcac5dcb7
MD5 5e6c05d3f8a06f263e1d53fc5c2c53b2
SHA1 d957050dfc3aed8f22d9ace3a5d22192f8527513
SHA512 f3d7f18695dfc24c554443970dedd6ae366dee901241a3ec17fa85f1d00e4459a11802e40e263a4a078974b92652ef2897d2ad2b7edd9c3a08e9954ad24f597b
SSDEEP 3072:1H50cLgcmLDaSaCBLBB5OsA3ivrQgpEsMAl+5xuKjZo2bIlN5+FzE:1Z0cLgcmLuS9FwplLAX2cp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

1YI4.7z

Path C:\Users\Admin\AppData\Local\Temp\1YI4.7z
Size 7KB
SHA256 a9f0266342e06381ba3c80947d2a3ff038053a7252b40b36b0312dfee96727ac
MD5 20fec2ea72fc28ec726a80c87241bc73
SHA1 a51fc3e49dd4b15b3b8e815a0e8410d74b50e8fb
SHA512 43d5b653706c2b4697db4aa119f17a415d9fcb8452b711a7f21ab9ebeeded40612914fda190d4e166123a2d3ad261301ab5c8a046cf978da07f74450d2b070c8
SSDEEP 192:7sXybUqYAXjTXuwIG+WpK0KOcXEcXYojYJCxBT9kyskR:7vY8+wIGtYp5XYolxBqyskR
MD5 SHA1 SHA512 SSDEEP

Submit Download

3651-2eac-d94e-4577.tmp

Path C:\Users\Admin\AppData\Local\Temp\3651-2eac-d94e-4577.tmp
Size 40KB
SHA256 c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
MD5 dfd4f60adc85fc874327517efed62ff7
SHA1 f97489afb75bfd5ee52892f37383fbc85aa14a69
SHA512 d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4
SSDEEP 96:iLSQCn8MouB6w9f/8iZqmvJKLPeymwil:iLSQG7Iw9fEiSi
MD5 SHA1 SHA512 SSDEEP

Submit Download

621C96A.tmp

Path C:\Users\Admin\AppData\Local\Temp\621C96A.tmp
Size 2.3MB
SHA256 d0b16e3c592daa0a39b6a087a67b50bbd36202cac5d49040a5a7abf72faf6859
MD5 00ae75438c6cc186a58a656ad7001653
SHA1 0eb376fc3bb82894d429f37e26b648f5ca8164a4
SHA512 9b645911aac103c6fe6dccd228a30e746216c9213d69c92d0d9307b003a9fd0616d0fab94fb710a132e4ce5cfabe1facefa00b3bc37f2769e4f5faad6494ace6
SSDEEP 49152:QHHMkkLy1bWgxUBYNaw0120eokWcyuLggDaN4cN5eU2ysvyA8WvRjs:QHF1rx1bMcokWVuRDaHwUftcvO
MD5 SHA1 SHA512 SSDEEP

Submit Download

621C96A.tmp

Path C:\Users\Admin\AppData\Local\Temp\621C96A.tmp
Size 2.3MB
SHA256 6c1a338b3a5dad4ed07539ecb2c7c1e497e89daac65b67f1858f3efbdf842f10
MD5 3b142c218acdde58f11e8ac12a3c8b16
SHA1 782f7a697424b7dff459d26a0518509a2d5dcbb9
SHA512 5ed26d66c489fbaefbb7f3ee5c7bf6ae23b51e0cb344c89c5ca410b789d2f831134fac706dbc7e0ea82bbe0ce52ec1aaa91daf1f664189c6ec70b4eff7a776e9
SSDEEP 49152:kHHMkkLQ1bWgxUBYNaw0120eokWcyuLggDaN4cN5eU2ysvyA8WvRjs:kHT1rx1bMcokWVuRDaHwUftcvO
MD5 SHA1 SHA512 SSDEEP

Submit Download

902E793.tmp

Path C:\Users\Admin\AppData\Local\Temp\902E793.tmp
Size 40B
SHA256 29e46c8c21498ac8b5f0bdfa1a2dc88b22387e706dc13561f41fa3b839c501b2
MD5 e9623a5cf0c58cb6edbd88fb11157e6f
SHA1 59575f73b57649ef533ccf4afd855d5b1d9e9577
SHA512 f6f1d20cc627669002862520110f6387488e2ca3cd049b37b5ba9996d90391a206801e334fef2aa577545ac359419ed41d31b7af59f057a6aacc7cddc6ac1dd0
MD5 SHA1 SHA512

Submit Download

BugSplat64.dll

Path C:\Users\Admin\AppData\Local\Temp\Dishonour\BugSplat64.dll
Size 377KB
SHA256 a9541c91a5f37c3ba4aaf64524ed3858d7d2c77a6cfd5e9ac7ea7945a785ca22
MD5 2774d76b94c6c3f6c7107f2db93cb83d
SHA1 c20e2925f84f89e8a6df611a7179d3dae9e45ee5
SHA512 acf9d1615f81373c6ef86d4b4d2bb52baeefae7ecc7be8189a561c78526418308e2264b970336adcfc714f999c0f49b51594c9a1bbe922d1e9f43891d07ccb15
SSDEEP 6144:MpPHwDQxTcl7DyzWPZVEsTRGRXvRyZK4rtx9TYo6JqXJrhCs7tz:MQQw7xPZ9zr5Ynkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Shug.qk

Path C:\Users\Admin\AppData\Local\Temp\Dishonour\Shug.qk
Size 17KB
SHA256 1adae441501d2e64255e280adcbf389794c9742a3a74a612318ba9a201fa43d4
MD5 cebea88c45ed4ec1654c4f7d293ef00d
SHA1 da910f6003e6793084da8a85f5db7f40f8277b4a
SHA512 f16c021c2d04ede4dd94c16a9d999cad4dd14ec4db109eab0ba0b79b7ba988fcd2e34b21d7a9e16cae5f9f355cba42cd47906097977917fa4039c217525307f2
SSDEEP 384:l8+z36yxguQ1Us4iw0w1ZqfboFzeM8rVbjyU5/qJ9TbhHG:++r6yi1f4i4ZqfboFznIb2UFqbbhHG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vaekveedplees.odj

Path C:\Users\Admin\AppData\Local\Temp\Dishonour\Vaekveedplees.odj
Size 2.1MB
SHA256 9b16b0f2bc74baab67d5322a3f0d619c4c62248b14400ef0878b2743661bcef1
MD5 143f7fc5ed6da262b7fe0ce2ee15b900
SHA1 724cbc3fc6096bed4b521c442105ab07b93c485f
SHA512 32c807973734a614025942c538e2218a66fb2ea5dc5d03d4dea7204ffabce77b612c5a05993e590200eabcc8286d9f8981b879d39ae8eef5f9775750ba2e2389
SSDEEP 49152:0C6qeHn3/tKg1CFltYVyb79JKGqiXTRjH0qPhb9WjZno:0qk3/tgYe9JKcXFIq5bcj5o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vector-Sys.exe

Path C:\Users\Admin\AppData\Local\Temp\Dishonour\Vector-Sys.exe
Size 270KB
SHA256 fdbe7dbe0228baad747bf7e8d830cbfbed7d2bd3013b8080dc50e726b21ddac6
MD5 6a06b58d738d47e93f08ff39112fba2c
SHA1 3d4cbc2bf0362c3a7af191b69e310589d86bc1fb
SHA512 e021f725e01cb5018ec05c06f54d95b24758d137b80cbde52217bb85e2d809204f5afb90e9d57117b48135003cb7d7ba3773eb6b23dcde2bae246bd208e4f7ea
SSDEEP 6144:VIaCAK/UGjgTPD/CRe4GvTS8w9hzc9ap+zGd:qz7KmH9tpT
MD5 SHA1 SHA512 SSDEEP

Submit Download

libomp.dll

Path C:\Users\Admin\AppData\Local\Temp\Dishonour\libomp.dll
Size 757KB
SHA256 b20a82c7506960d32afb4f0f8cc76e0b027f26e8b34f1f2c0c971a7abf5cf243
MD5 e7fb320a54896c842ee35677bff5f195
SHA1 730fef95be4a43f28956d226cdab432a573496e0
SHA512 949944a103fe3f93d4aea73a503b74ddae4603ece3a591c736ed1b9ff0d366049e76fc16af6dbfd6255c05fe8fbc4f4ad2a8af9242a36992d750da842662a4ee
SSDEEP 12288:hnMmgfyiIhp1icC6WHeyXwvJCaehMt0E7mHAW8Wkk617cq/y:cKPFC7PMJ56HAWrkkQ7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

FhVlAHw

Path C:\Users\Admin\AppData\Local\Temp\FhVlAHw
Size 32B
SHA256 060908e208545cd39eae425f123c669efd1a41f7902cfa196f2e9d0259fd5c7d
MD5 7701eac00ddfdfb8f12cb9a19cf60acf
SHA1 a2cb63db0786b9c9f2e0389f7df5603f17b6d506
SHA512 c10b46d57279c4ad7828cc8d91ec42ec1cd32da62af0ab8368d9b81cc98cec360b99ab84ceac5675e85406e384bef5b92883e4844568a5b9756676f5c733c96c
MD5 SHA1 SHA512

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4660240665984\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5068240668734\Crashpad\settings.dat
Size 280B
SHA256 93ab16054e559dae5a825bccbeb474a870f6b5db707e17b4fe8065d34ec8557a
MD5 b8a9b045c032f86569d39c077bb7050c
SHA1 9c03cb825ddbee4820067b3cb5436f6fb1b992c4
SHA512 1e4f393035d3191ddc134ce1e5485437cca3fd3b46d3cfddeeca1a35139b70bc2bf09d55d94f70350a9e89a47f89e99fcca0503f4f3042133072c2cc845263c8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5068240668734\Crashpad\settings.dat
Size 280B
SHA256 863c4e39c1a94d302d819429a7d99ab1ba004d5622921906bd1a35c7224739e5
MD5 6d08870209b62aaf2800f7451d64d278
SHA1 42731376156229a0799951e234134131a4664706
SHA512 532ed525b4ce0e27ed7a965cad81a4340f8bc095e72677ce7c2c1aafcb972edb6c2aa9dedadcbf3c67a07ae308614f08fd47839b0c6f3a1a07c56cb5eb86d58b
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5068240668734\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5068240668734\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5068240668734\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5068240668734\Local State
Size 4KB
SHA256 3e89d75e7d5a170e6503f02cba661ab17eec46a371d42c1c4c1df93b262a26d7
MD5 a0485106e849bf6039b3f41b712d18dc
SHA1 c6825b79f816ab3c2f32edf6aa0d2c2c535c270b
SHA512 51c8e227348a491a23670c51b4e820c4805a34aac6387f23318001615a7e7b0ebc038aa6b7a1a4ada25aa84974d92946905e973bef6c6c53b9a677afa382e13b
SSDEEP 96:4qGNkCKUfTCY217HNDNBqPusvH9o9mJcR+YQQBea:jGNbK6CbxTMu4o9ScP3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5068240668734\Local State
Size 5KB
SHA256 c0398640d491cbf115aa3a7d904bbc745c209d6afb028b6f6636d882141911ff
MD5 502803877d3f41501799df56c10733cf
SHA1 ba251cef92cf3ea648cb7f1791818bb3c0f2f566
SHA512 98249406a4cc2aeae40699f86de89b8a30c9754498a4e9fe36781c1844e5e4d5832625cecf100f35d5c54995747f4533ff42da2b3b34174cb1d05b2a9d6c5475
SSDEEP 96:4qGNkCyUfTCY258Frh/cInURoDotovmYNDOBqPusvH9o9mJcR+YQQBea:jGNby6CoooDUwDuMu4o9ScP3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe585186.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5068240668734\Local State~RFe585186.TMP
Size 1KB
SHA256 1212b6c52ef3d108689ac9e2aecd4f5acc22ab05587d4e90f4234deb98e25881
MD5 91448dc21adbca43e4532d86dc215b09
SHA1 6f9d125fb8b33a86d2ec0099ac22d7ac4ce77a4e
SHA512 da307e9f1e77f2657313338f492a6895bb424d53261cb7cd9f54c457032b3222d18919f6c55b3902b844ea886ae089f750361d3168bdb2361a34ddaccc221b78
MD5 SHA1 SHA512

Submit Download

HsLz6

Path C:\Users\Admin\AppData\Local\Temp\HsLz6
Size 60B
SHA256 e6ea612e6977f5885faaba4178b6e7f136341c064df8e6998f31bd1417252b22
MD5 aafb6e9cfe66e05bfb6b8d50fe0543e7
SHA1 ada82ac81edee5d0fd5feb024720baa21f286ffa
SHA512 32a0a0deedfe80c1e4280c49345e7eafcad6ae7970f29a6ca2196aa03a37a942bfc75272f3e822d267958936d5d2bd40b0297fe7d2e47c2a0f2d286492456ee3
MD5 SHA1 SHA512

Submit Download

LWioN

Path C:\Users\Admin\AppData\Local\Temp\LWioN
Size 32B
SHA256 02297525b345d554041b45de3c17a00db6b324df6ef14671541347500a274e6e
MD5 14fa5cf9250cbd86f43c462f4e50d0cd
SHA1 015c068e6128c04fefe9ebb5c716250483e3758e
SHA512 70fd7a0dbad09966754493bc27b1cfad19c5f458fb9c38f8bffe5f99d49d81f5ee278dddd83d25bbf9e72adc39eb60bed5146e798fcc2a0c169ecb3684c84e01
MD5 SHA1 SHA512

Submit Download

aacc-9cd6-3117-752a.tmp

Path C:\Users\Admin\AppData\Local\Temp\t3yZd\VsoFgURjat0\Default\csbcgNbBaGZ\aacc-9cd6-3117-752a.tmp
Size 56KB
SHA256 bb923abf471bb79086ff9ace293602e1ad882d9af7946dda17ff1c3a7e19f45b
MD5 1c832d859b03f2e59817374006fe1189
SHA1 a4994a54e9f46a6c86ff92280c6dabe2bcd4cc42
SHA512 c4d3be414fa5dd30151cde9f6d808d56c26b031ff3f6446d21a15d071053787b6ba337b12909a56af7bb420f858dba5213f08e64ca9f836f52c98a18762b4bef
SSDEEP 96:QkS/KLPeymOcVizhGNOnfXG38tyvFbn8MouB6w9f/nP:04cVizhGNOnu/7Iw9fP
MD5 SHA1 SHA512 SSDEEP

Submit Download

1b7c-97e2-5e9f-8539.tmp

Path C:\Users\Admin\AppData\Local\Temp\t3yZd\VsoFgURjat0\Default\xt2bU0e\1b7c-97e2-5e9f-8539.tmp
Size 20KB
SHA256 ab887cff6345e700c4c85f669732675b5e6bf0c90f8c54ee56080e623d839d76
MD5 8a43df1ecc7198e7f0488c1908a54772
SHA1 4166211e37bf1c3e2f999fdd29bd822b9ce9cc9c
SHA512 f0183eab293c2a1405f8db2cd0889397d1c9ad65b4814a28e3b68c12f49a73d93dd4eba01cfb7ef82d55c4e530556e5db2573595cc00676276b563e2dc6c4603
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfBLJmhOzGoUqjm/:T9LopFMatSaw/auUOt8BLJmhDpqjm/
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd0b-e03f-83e9-0fb7.tmp

Path C:\Users\Admin\AppData\Local\Temp\t3yZd\s46wr70\Default\xt2bU0e\dd0b-e03f-83e9-0fb7.tmp
Size 20KB
SHA256 f514a6d988a6993e1a2c15bf4d7e19deaa7123a64f166576e450e7d87649e3c0
MD5 71e9d8ccd9c06f450f20d16dd7cdea38
SHA1 212fe433ba4d6d5a63f37735b3c9c9303f07c447
SHA512 db0491f5d0ce8c971c7a39d521d922eebb7ed41a12237e0849c8016543cb164f25cf4b4b5e281366b65219bb898a501a043f59200f9a187d2afe207e4f03afe8
SSDEEP 24:TLym91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBeC1ONd5vKpjrAM30FDJ65Nd/ij:Tem9aw/aHLopFMavU1iBDwHyje65Nl0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chime.exe

Path C:\Users\Admin\AppData\Roaming\portprotocol\Chime.exe
Size 619KB
SHA256 adb8347dfa1b1df1ca2211fe4d7e82f27ced939f1bf3d52548e52bc9e23fc52c
MD5 dd65b976d1865ba6c2368fcf9c9eb223
SHA1 db933b1ff0dc73c2e4f230aa3bd47646632d5714
SHA512 5ff91cc29744416a32789f277f2494bbe60bd1f2eb53ea48e538075e8d735420c0256b7798e8f99b9286bf8c3b0dcf5f1a1539b8f2792991fb7d5754ec6fa0df
SSDEEP 6144:+Zzvhs2Z4n1E7g34XtVYAOfTdH8zjQSYoLdnU4q:+J+2Z4nShVY5CjQxoLdnU4q
MD5 SHA1 SHA512 SSDEEP

Submit Download

e57c39e.msi

Path C:\Windows\Installer\e57c39e.msi
Size 2.6MB
SHA256 df605aa20e6a2d09ceefd7db62e7ff24c6495007f5dc2a453e66a6dc8090b1d7
MD5 1e6c20b81eec31ef9abf8838b6c055a4
SHA1 44be6cac388692cc057bf3ae9c3ed5512b002595
SHA512 e1f60b9788cb7e3565c02ee5c7b594cb4bee72bdf0c99a531f5b923df29cd2ffbe383da399a535c3878483cbfc2a943bc5584a16fe89d2a565e62befdd01aed0
SSDEEP 49152:zpPqHgHhehWast/vY32cUiMTajH7RP3brTuZ1Dl+lRvxKm:zq2hJ+32UMOXR/b3urh+lZxf
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 412015db40036b96589aecd18d4e7212497b038f3bacbfbaa5777ec0b55dd2ed
MD5 a0975718c9b250cce4554dd3d41b057d
SHA1 562a738eb257c3a38b0223b4f16326c20c462faa
SHA512 67646794e31999d4456b9f5cc89d3cbbe884fcea28513c68fe8f936521229f9bced9285987c9f4f946c37ab73bd512f8fabc60c2b5b71ae04b05876ac8caa2a1
SSDEEP 24576:DZxm+1IzdoO/vvTLfWbe+mqvqik/j1LyX9GN50KVT0aaOcyJIP1ITzQxeR:+f
MD5 SHA1 SHA512 SSDEEP

Submit Download

{800feea3-13b3-44aa-bcad-d1f0db88c612}_OnDiskSnapshotProp

Path \??\Volume{55e447d8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{800feea3-13b3-44aa-bcad-d1f0db88c612}_OnDiskSnapshotProp
Size 6KB
SHA256 b63ee87b4f78bc58a658db78c2e1599b0f0eae8017d167aa04b1ff3b13f1df02
MD5 cbc7f3fe7e72aa6590a3cb0a960ee9b1
SHA1 b775f4fb18a1e213537c46db6ceb02644e84426c
SHA512 70581ba76383f4a57b1fe1e1facddd2e0e86ecd1187914edafb110aa3d8e0766d8b9b5fb85d827c714e96d49fb4ece372771e832d4980420d8523323cf7b42c8
SSDEEP 96:F74dMuNHCMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:ZM1b++ZVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-30-0x00007FF84EC80000-0x00007FF84ED82000-memory.dmp

Download

memory/1108-45-0x00007FF84EC80000-0x00007FF84ED82000-memory.dmp

Download

memory/1108-47-0x00007FF84EC80000-0x00007FF84ED82000-memory.dmp

Download

memory/1108-53-0x00007FF84EC80000-0x00007FF84ED82000-memory.dmp

Download

memory/2868-502-0x0000000000F00000-0x000000000127B000-memory.dmp

Download

memory/2868-60-0x00007FF86E950000-0x00007FF86EB45000-memory.dmp

Download

memory/2868-62-0x0000000000F00000-0x000000000127B000-memory.dmp

Download

memory/2868-67-0x0000000000F00000-0x000000000127B000-memory.dmp

Download

memory/2868-73-0x0000000000F00000-0x000000000127B000-memory.dmp

Download

memory/2868-498-0x0000000000F00000-0x000000000127B000-memory.dmp

Download

memory/2868-55-0x0000000000F00000-0x000000000127B000-memory.dmp

Download

memory/2868-503-0x0000000000F00000-0x000000000127B000-memory.dmp

Download

memory/2868-512-0x0000000000F00000-0x000000000127B000-memory.dmp

Download

memory/2868-515-0x0000000000F00000-0x000000000127B000-memory.dmp

Download

memory/5564-71-0x00007FF86E950000-0x00007FF86EB45000-memory.dmp

Download