d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e

Analysis

user interaction
yes
max time kernel
41s
max time network
43s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/05/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
Size 1.9MB
Sample260505-2bdsmsb14n
SHA256 d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e
MD5 eae7d33886411325202cfbf73e0d9902
SHA1 070bf29474faee54226ef602a1fb817b14b16f65
SHA512 94cc9349a29f7d9b21aa579fdd71df566d7e18ca1d3855dd24c822579dd72908f42ca739b01ed2e05d42cf9b40b3ff65e80945ffffb242b6266164e54cd74d38
SSDEEP 24576:nh/Ur6Dg6J2BrEXTBQl57Gqdr/bMWSRviJc36Fhele5n92jUaHaorY:nhsGDgPBrEtQl57GqN/XSAnO7f8
TLSH
T1DF955B0B7CD109EDC496AB3298F662817775B8080B3633E36EA06E753E72BD01DB9715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 17 IoCs

description	pid	Process	procid_target
PID 3500 created 4116	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	88
PID 3500 created 996	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	89
PID 3500 created 2364	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	90
PID 3500 created 1920	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	91
PID 3500 created 3868	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	92
PID 3500 created 5052	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	93
PID 3500 created 960	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	94
PID 3500 created 1920	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	91
PID 3500 created 5980	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	98
PID 3500 created 1252	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	101
PID 3500 created 5556	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	106
PID 3500 created 5364	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	107
PID 3500 created 5584	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	108
PID 3500 created 5420	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	110
PID 3500 created 5388	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	111
PID 3500 created 5444	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	112
PID 3500 created 5980	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	98

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5716	chrome.exe
7152	chrome.exe
6668	msedge.exe
1920	chrome.exe
5556	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "52"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134224934789124575"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1653660789-1211287304-2482568781-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
4116	chrome.exe
4116	chrome.exe
3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
4116	chrome.exe
4116	chrome.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe
5812	msedge.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
5980	msedge.exe
5980	msedge.exe
3116	chrome.exe
5812	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5364	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 4116	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	88
PID 4116 wrote to memory of 996	4116	chrome.exe	89
PID 4116 wrote to memory of 2364	4116	chrome.exe	90
PID 4116 wrote to memory of 1920	4116	chrome.exe	91
PID 4116 wrote to memory of 2364	4116	chrome.exe	90
PID 4116 wrote to memory of 3868	4116	chrome.exe	92
PID 4116 wrote to memory of 3868	4116	chrome.exe	92
PID 4116 wrote to memory of 960	4116	chrome.exe	94
PID 4116 wrote to memory of 960	4116	chrome.exe	94
PID 4116 wrote to memory of 5052	4116	chrome.exe	93
PID 4116 wrote to memory of 5052	4116	chrome.exe	93
PID 3500 wrote to memory of 5980	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	98
PID 4116 wrote to memory of 6112	4116	chrome.exe	99
PID 5980 wrote to memory of 1252	5980	msedge.exe	101
PID 5980 wrote to memory of 5364	5980	msedge.exe	107
PID 5980 wrote to memory of 5556	5980	msedge.exe	106
PID 5980 wrote to memory of 5584	5980	msedge.exe	108
PID 5980 wrote to memory of 5432	5980	msedge.exe	109
PID 5980 wrote to memory of 5364	5980	msedge.exe	107
PID 5980 wrote to memory of 5420	5980	msedge.exe	110
PID 5980 wrote to memory of 5364	5980	msedge.exe	107
PID 5980 wrote to memory of 5388	5980	msedge.exe	111
PID 5980 wrote to memory of 5584	5980	msedge.exe	108
PID 5980 wrote to memory of 5444	5980	msedge.exe	112
PID 5980 wrote to memory of 5432	5980	msedge.exe	109
PID 5980 wrote to memory of 5432	5980	msedge.exe	109
PID 5980 wrote to memory of 5420	5980	msedge.exe	110
PID 5980 wrote to memory of 5420	5980	msedge.exe	110
PID 5980 wrote to memory of 5388	5980	msedge.exe	111
PID 5980 wrote to memory of 5388	5980	msedge.exe	111
PID 5980 wrote to memory of 5444	5980	msedge.exe	112
PID 5980 wrote to memory of 5444	5980	msedge.exe	112
PID 4116 wrote to memory of 5716	4116	chrome.exe	114
PID 5980 wrote to memory of 7076	5980	msedge.exe	152
PID 5980 wrote to memory of 7064	5980	msedge.exe	115
PID 5980 wrote to memory of 7076	5980	msedge.exe	152
PID 5980 wrote to memory of 7064	5980	msedge.exe	115
PID 5980 wrote to memory of 6652	5980	msedge.exe	118
PID 3500 wrote to memory of 3116	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	120
PID 3500 wrote to memory of 5812	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	121
PID 3500 wrote to memory of 4268	3500	d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe	122
PID 3116 wrote to memory of 3100	3116	chrome.exe	123
PID 4268 wrote to memory of 1752	4268	firefox.exe	124
PID 4268 wrote to memory of 1752	4268	firefox.exe	124
PID 5812 wrote to memory of 6352	5812	msedge.exe	125
PID 3116 wrote to memory of 6912	3116	chrome.exe	126
PID 3116 wrote to memory of 6912	3116	chrome.exe	126
PID 3116 wrote to memory of 7152	3116	chrome.exe	127
PID 3116 wrote to memory of 5764	3116	chrome.exe	128
PID 3116 wrote to memory of 5764	3116	chrome.exe	128
PID 3116 wrote to memory of 7008	3116	chrome.exe	129
PID 3116 wrote to memory of 7032	3116	chrome.exe	130
PID 3116 wrote to memory of 7008	3116	chrome.exe	129
PID 3116 wrote to memory of 7032	3116	chrome.exe	130
PID 5812 wrote to memory of 6668	5812	msedge.exe	131
PID 5812 wrote to memory of 5320	5812	msedge.exe	132
PID 5812 wrote to memory of 760	5812	msedge.exe	133
PID 5812 wrote to memory of 5320	5812	msedge.exe	132
PID 5812 wrote to memory of 5320	5812	msedge.exe	132
PID 5812 wrote to memory of 760	5812	msedge.exe	133
PID 3116 wrote to memory of 5840	3116	chrome.exe	135
PID 3116 wrote to memory of 748	3116	chrome.exe	134
PID 3116 wrote to memory of 5840	3116	chrome.exe	135
PID 3116 wrote to memory of 748	3116	chrome.exe	134

C:\Users\Admin\AppData\Local\Temp\d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe
"C:\Users\Admin\AppData\Local\Temp\d43734a27fa2e8e2b925042ab93343f12674edd273bad703a01dd8bc4423276e.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --disable-background-networking --disable-sync --disable-logging --log-level=3 --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffecc37c728,0x7ffecc37c734,0x7ffecc37c740
    3⤵
    PID:996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1720,i,6439996942698790343,12135383587047080643,262144 --field-trial-handle=1896,i,13407256275203912456,4425448359061598663,262144 --variations-seed-version=20260129-090048.396000 --disable-logging --log-level=3 --mojo-platform-channel-handle=1892 /prefetch:2
    3⤵
    PID:2364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,14163644060539082306,14323332111909367400,524288 --field-trial-handle=1896,i,13407256275203912456,4425448359061598663,262144 --variations-seed-version=20260129-090048.396000 --disable-logging --log-level=3 --mojo-platform-channel-handle=2052 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,13590933163015048387,12859507129895463447,524288 --field-trial-handle=1896,i,13407256275203912456,4425448359061598663,262144 --variations-seed-version=20260129-090048.396000 --disable-logging --log-level=3 --mojo-platform-channel-handle=2440 /prefetch:8
    3⤵
    PID:3868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3036,i,4241487340816778159,8412023358572174497,2097152 --field-trial-handle=1896,i,13407256275203912456,4425448359061598663,262144 --variations-seed-version=20260129-090048.396000 --disable-logging --log-level=3 --mojo-platform-channel-handle=3048 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3056,i,11609280344210098722,15130018842278201803,2097152 --field-trial-handle=1896,i,13407256275203912456,4425448359061598663,262144 --variations-seed-version=20260129-090048.396000 --disable-logging --log-level=3 --mojo-platform-channel-handle=3084 /prefetch:1
    3⤵
    PID:960
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,4807423203165680174,13396226620361866921,524288 --field-trial-handle=1896,i,13407256275203912456,4425448359061598663,262144 --variations-seed-version=20260129-090048.396000 --disable-logging --log-level=3 --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:6112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,5081949570914965550,16225154318710848683,524288 --field-trial-handle=1896,i,13407256275203912456,4425448359061598663,262144 --variations-seed-version=20260129-090048.396000 --disable-logging --log-level=3 --mojo-platform-channel-handle=2044 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --disable-background-networking --disable-sync --disable-logging --log-level=3 --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffec7b6c188,0x7ffec7b6c194,0x7ffec7b6c1a0
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,5837531836061135076,5326946618856408530,524288 --field-trial-handle=3672,i,14074910570481201462,13023452005746327854,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3984 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1636,i,2067455127846801143,16476635759746317193,262144 --field-trial-handle=3672,i,14074910570481201462,13023452005746327854,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3680 /prefetch:2
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,3885746989151427173,3864974398914988139,524288 --field-trial-handle=3672,i,14074910570481201462,13023452005746327854,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4024 /prefetch:8
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3040,i,1692631412827987831,6839105191902591546,2097152 --field-trial-handle=3672,i,14074910570481201462,13023452005746327854,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4088 /prefetch:1
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3044,i,17764809420222141374,4606036892740242445,2097152 --field-trial-handle=3672,i,14074910570481201462,13023452005746327854,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4104 /prefetch:1
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3172,i,10117650022775643003,5016936928716030234,2097152 --field-trial-handle=3672,i,14074910570481201462,13023452005746327854,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4124 /prefetch:1
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3232,i,10470833218829348291,8476593898797152052,2097152 --field-trial-handle=3672,i,14074910570481201462,13023452005746327854,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4136 /prefetch:2
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,9110550160138529160,2312211473023490666,524288 --field-trial-handle=3672,i,14074910570481201462,13023452005746327854,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5016 /prefetch:8
    3⤵
    PID:7064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,3869166107533840632,1650083586764016684,524288 --field-trial-handle=3672,i,14074910570481201462,13023452005746327854,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5060 /prefetch:8
    3⤵
    PID:7076
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,7498967314878639329,54238274786396192,524288 --field-trial-handle=3672,i,14074910570481201462,13023452005746327854,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5732 /prefetch:8
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,7498967314878639329,54238274786396192,524288 --field-trial-handle=3672,i,14074910570481201462,13023452005746327854,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5732 /prefetch:8
    3⤵
    PID:6652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x21c,0x22c,0x7ffecc37c728,0x7ffecc37c734,0x7ffecc37c740
    3⤵
    PID:3100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:6912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - System Time Discovery
    PID:7152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2296 /prefetch:8
    3⤵
    PID:5764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:7008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:7032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3672 /prefetch:2
    3⤵
    PID:5840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3792 /prefetch:2
    3⤵
    PID:5864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4088 /prefetch:1
    3⤵
    PID:6252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4264 /prefetch:1
    3⤵
    PID:6268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:6284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1936,i,4395219612220398674,943467253134572440,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4852 /prefetch:2
    3⤵
    PID:6768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5812240665625 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5812240665625\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x304,0x7ffec7b6c188,0x7ffec7b6c194,0x7ffec7b6c1a0
    3⤵
    PID:6352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2548 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2516 /prefetch:2
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2556 /prefetch:8
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:6560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3976 /prefetch:1
    3⤵
    PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3980 /prefetch:2
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4080 /prefetch:1
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4084 /prefetch:2
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4124 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4128 /prefetch:2
    3⤵
    PID:6160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4132 /prefetch:1
    3⤵
    PID:6588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4144 /prefetch:2
    3⤵
    PID:6296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5228 /prefetch:2
    3⤵
    PID:6624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5232 /prefetch:2
    3⤵
    PID:7076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5252 /prefetch:2
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5668 /prefetch:2
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2520,i,2736969424594475274,4804471265092211374,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3776 /prefetch:2
    3⤵
    PID:5452
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    PID:1752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5292

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d8055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b9096d274f5e4db10809b88cac76756464441b47609c9c61577e4360246315b4
MD5 d573f2c67077124bc00b46fc9cfbe0e2
SHA1 1c80ea7007f162e03c2ac52bdffecf06c90a811a
SHA512 e2187a63c43725b531fe206555ec22977e01284f83d56f486abc60cb71aef52bfe73c9526ef4ba8c7e3b7c1edd65cd9e50d00489aaabea5d26bc62733196b128
TLSH
T1C5E068EAD821EC370AFD072D70644756EB20232B3B424D0F3A3D82088FF1637928296C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b441c2c8d23ea2cee306df92898667bee42940f1f71b55792a99f9df7317d299
MD5 dac9afdc46c203bb47bc69b5233e189d
SHA1 13db41a6609d92a6e87448d54ce66912580e149d
SHA512 f281a09ac7f4313e3fdd399a2c3840fa84634847c7929201eaa0a0edc9837e378488b3aad6dd9bd78711fba352371a4d3b990ad618767657f03b47c001806d06
SSDEEP 6:/FCOeEMNfj/353GzhWN1mld3tXNyPlEMkPWPNan/l:dFGNbv53ChWNAXN8EMkPINE
TLSH
T1AD13C7BC7F8C4F33D994187C19AE8B380F70880ADCE30A6BCCA5B02624283253D0A089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 280508381a2047360dfff2666d656e8210c0045db6f646f44ff1d71552337210
MD5 5286432989f4bff9f7fbaf36e1daee92
SHA1 5c3fcad8871558be082146daea6e7f024f5a491f
SHA512 c57866d0894cd01e7e3835f0817cf9e74c8834155e28aa875c20aceea34870472b801e448ce7796b56c128fb5447821828ed845a89c7cc8529b99027dd1f443d
SSDEEP 48:eEbdJtMY9NuPMCXglo5MiXWolaB8W0ARGxoyCqS8aBCy7:eAx9NuP/glo5DW0aBF0sPDqSCy
TLSH
T12F44A7E73814E5C7EA38CBF12C905238CD33911A1CD4AD77F52404725689AF332A8AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 d572196ee6443dba1776956ad7d0749ce3a7945a8551eb8bf9ebbed1c9f53e29
MD5 27cbb3343b103cb19e225982ae7f8919
SHA1 fc8ca2d4e888d9c473fa7537825f24a7678e2c11
SHA512 4a1565dcad8facb011407873b29fb63f6a0103357af8c0a0dded8998581a16fd5c6fc274dc4f7cb87ab0b71d632f571f098af63bdeaa9c196882f677a991680a
SSDEEP 768:4UfDPLSgcRUv+BZ4kxW42fDPLSgcRUv+tZ4Lr4G4m4y4xUfDPLSgcRUv+cZ4:UZS4ZaPrDdZ
TLSH
T1AC163BE70F64A543EA86EBB0BBCCDD1C3C702296EC9798C2E122527949F1FC41B8519D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0a1e3cab43af7f116e81999dd3989c4e0b9ffd4f0360a5cf3781137ba12a55eb
MD5 38412bc08dfa283b22aa3274ea7964f3
SHA1 a308290de0f4bdc841af8eb62b118c1e0e6d8a84
SHA512 31940d47c74f56efacc9fa13dfbe35f1e5e019701fc28890ccb01d5d70c7289d406fa58bcce5d90a8869ea922fdff32c5cbb9b8d382786e880e93ebc232ddae0
SSDEEP 192:fROwlwsv71wpAPRp2B9oHsb+WNnhNPZPykw2J1wVyIsnAUge:fROwW4aUXSuwbP5yWUe
TLSH
T11542C52EBE14753B5CCBC219FA227B67E7F5142161942E84E6FC8A2C14E79CD211341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 b535713c133075a2d61900dbbcf6ca86c029d584ef00e14e4339dcb72bdf2b07
MD5 4fc146bbc10c25d3247a514bb83c6c1d
SHA1 cb49ebbc22aa682e89ebd8a34227cc3a62eab5f1
SHA512 dd6e24098610b8259fdfb509d1d85f1db89d4c33035d9baf30a45d05aa7f95a26ce65250277c60ce069fd143145c593e925ded27c5156c56d0dfe6def2491230
SSDEEP 384:ZzjNQ7KxkXqKf/pUZNCgVLH2HfgslI1yp7pLuLcifXSXODNQ+ErU30pez:Z/NQ7KxkXqKf/pUZNCgVLH2HfgsAY7pk
TLSH
T196620A27AC4D9D3B4F98C589DC177E4FADB5024B61ED886483FA982503D5BCA110A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 7d512d46ba8eee1e4049d5156fb2ff910f8f65ff216cf32c9421cbbff78331ef
MD5 acb23c8428ba34eca3c17e93c808a022
SHA1 7687ea04c61d888744e0d5210033245023eaf4c6
SHA512 79230eace2948171f932cdc9b1d221faf7a824c5751dc327fdf7488fd77d227634c69f9a432c7150489ec7e1aeeb41a1d1a3d1f8c4d6efb7bc325a474171eaf3
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OJpX6zqqIVumdwkmL:jeuvBnhJsueMEGvIW1DcP2OHfVumdnmL
TLSH
T1F1D3884B3A747002EDE59A722CE054BB5E7C716D8F51A5D428B620588EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 7c3152bb0f416c4baf71334e9a52bc8b7e43d995864ba6f6835e3d06f0b35be0
MD5 3436421c3e65f8ae4b21ef088382cda8
SHA1 7d556ec2a5d760eb38fcf2a311c8bab4f41d248c
SHA512 d80beeaa26ffb37687679c6caa2d481ac90f32f37cc2196dc7d8cce5577847168268285e29dc5d52b5964bd74c3462b1ebd8d82b1a294ec8dd4d2eb3c022ec55
SSDEEP 1536:wJTNeUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19frX:ETNNL3dkAdfifD0jj+sxdhdenFnHYZxF
TLSH
T10A93127C626404BB4215C2C6726F6A5BCB7C69AE86606FB436E44EB28AD074C1FC740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 4bde8a5d8d716679a61aa5ba4bc3cef04dcb0e1ab6488710786c658f5754a347
MD5 32a39b3e65f7ee029c51901942ebfe0c
SHA1 ba3befd38d6ea43ec9d23e177ff99e1cf7f1bbae
SHA512 6fdfc0f4f13bbbdd1e5031c401a82c172c553f461fc6b7f0ccf02d06bd5cc7f21804a847b5a6e47c6d3f99ed705cbeb7c7d05e179bf7090d6cd7d615a92df2d0
SSDEEP 1536:pJTxeUL3dM3oP7D9jfHCfDqONrCjjIpsmodhdeAHmA5EFDptwKpyTtcHkxd19frX:7TxNL3dkAdfifD0jj+sxdhdenFnHYZxF
TLSH
T16D931278626405BB4218C3C6726E6A5AC77C6D9EC6706F7836E44D729AE0B4C0FC780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c356d773d3464e78316eaa186caa1aafaa87c93e1653383673b0355156440fa0
MD5 2af5888e7b4620aca24a6a23d00033cd
SHA1 a5f2e46a235e132b4f8553458519bf41becceb5c
SHA512 6aba03f73a43a7ee06df6c9f8364158ba1a7d26322813270ddc4477244061cacd0323b9123f2f49c0d518dcd219d6b47292a79ed8e80d5aa54b97bf143398a22
TLSH
T191D0125079F02D41D442BDB12824B7D05559959389869A660811E6BA0C231D44890DD7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68691b469b8cfab2e9457cd239c72560b35d42545d1ff342f6cf8924e5f386eb
MD5 4700e1e05ce5416771df4715ad0256f3
SHA1 5b5896a43e5349fce8db5a1e205373a14c95c271
SHA512 0c012aff078946960bc487d6c51098fee6541ce9aad7e8f05df959e9c4c24eb310bc9258313d6eb0426f426ecc7feed5fbc763746e5d57adbb0b9fd6e8526a4e
TLSH
T1C1D08050BDF02D41D042BDB12834B7D0555DD5D3C9865E650C11E7FB1C231D448D0DD7
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 9f8c4abd548182ac8fdd08b102049e7ecadab95f2c22dc6ba8bcfa550f578dcd
MD5 608a4fe3d4b156a56ecaa03dbdc55732
SHA1 3d2e48f69949eea4bc3c001ccfc02f75e97b19c2
SHA512 cb5a34eb72d4a5cdee6ab9cfef5a857b4ef4c8e52863ade29ae4460807f0ca3203eb6d96f98588cdc6dad5010b1c49ccb5b568f78702523923640aedbb4504d5
TLSH
T11F117DF3C3D585AF895156F06A24AE2BCE1D0905431C7C1989D4EF1793E3475E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b36e43232843fb1ca0a21c3344b07b38856ebf257f21ab46a9d549b0c3ebb3d
MD5 17f746a1e16b815f29f47fbfe1bd0e04
SHA1 70444643c16c033c890d0cf51b379e21ca230a63
SHA512 00c05a2bc0221ca19f81599bf311a4bab64f83d9dff7e36467b2313307a50a35175b7c5808b3b4c775c9c7c4ab148ded42c222ccd602d3db07d8cbc621cff13c
SSDEEP 192:P+x3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ec149701d3be8a6e3fb8bff226b3e3a9eaccb59f85608aacfcd70fd1428aae2
MD5 9bb134f204f1c136ed5497ae5ae98294
SHA1 1629a4a2dd7237a207e381b9dca352fbf5ab5227
SHA512 4c3b2d98027b292138ba722b8682f1c0d6e397ee9dfc401760b89464e45885cbbbc563bc5725b673e49ebefe6d73d0d9a222aa93cacf97a47afdb7f67ce174e3
SSDEEP 192:/eONU6WlRCaQmiUyy+IF/CJDEuy23OCbCYKZYNxXU6:WONU6QNj6tYkOC7VN9U6
TLSH
T18E02D8356C787CBB8EF2AE48F5873A175FA4103FE9562B44D6D85E1C00D768C2347926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 278a9750109c394cb86cf1442f7e66da5e21d43cabd63b73b83853cca77fd1cf
MD5 3498ceb63f4c34afe9745215f81a77a3
SHA1 51c67bef8a242f81deabdfb8574e0d523d82aba9
SHA512 b07d1b157263ba3f874e36b31c0aaa1ba7458714b24cbb23276304db4c2af54ff5ce36cd840ca548fed563fe6f117908ae3ae8ab3597069844fb97e11ec4857d
SSDEEP 192:UONA6WlRCIQmiUyl+IF9JDEuy23OCbCYHOFkSJr8dlLNCoqZDU6:UONA6Q/A9tYkOC7HSDJrGNYDU6
TLSH
T14E120A3668686C7B5DE2A484F58736179EA8413BDE4B3F81D2DC2E0C01EF59C134B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 25621de70900c578f3b5d6319e35deb2994aa01da51bb2ca78b7c2744dfbff05
MD5 c3e97a25d6068bf519687a1d6e997c6d
SHA1 15a75115709270d14465cdec8fcd0ba0ee2640e7
SHA512 25c74e0758b080c2dd9677f63ed9f0c1b736171684b195cff894cd5efcd0826f35dbac59382aff69c21971cadb5fcadcdbfdeef623eb1ae81dfa42f1ee733823
TLSH
T10941F658BAFA1108B7B77E5A6BF6A96C447EB8772F46D05D00110D4E0A63F40C9B2737
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3116240665562\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5812240665625\Crashpad\settings.dat
Size 280B
SHA256 b0a4eac62b1c77bc57d6b51934be59a82b4c8391f9369b5662b25cc9fd798a57
MD5 a53f288db06cacf8261bf824f13827fd
SHA1 fee64a07f4b40462ebcc2f56308dedb93334f016
SHA512 5d4b8870aa0ed22efbaada9bda6487c713120a58311c7135683392196e660f236734640d3a190fa0eaee275851e3c43837b802087180a94d028d944bab29d027
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5812240665625\Crashpad\settings.dat
Size 280B
SHA256 4c1aa84122024a6d1734a74bd29fb0756cad00a7b365bb3bee78e91d467bd93b
MD5 8b79508b76f01a73d502b4c50e623ac6
SHA1 0f1ee6cba33a67ce571f7b18b1a0291f93eab724
SHA512 b052dcdf75f5c233845023a95377c862bbf6fd2b9ba36bb4584b47f340fc2c1517ed3c72fc1baeb7b6899232081496f07f2876ffaf70957ff8881e1afc3d01ce
TLSH
T10AD02202EBB0220CCA0F3E3E30F0C3080FCBE2022232022E00C0AEFA0CC08000202338
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5812240665625\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5812240665625\Local State
Size 3KB
SHA256 831d62e6f41cab78826284eb2fe1a813f5fb5dc248853d093479a0afe07c373a
MD5 eeee96220f1ffaff350789a8974b432d
SHA1 d1dfd3567444a3d4a735bab30cbccaa7e91850fe
SHA512 091c4ee7febaf115098ee0e01a71cfaec72d2ebc4ffdff31748055039b658b3f832399336bcc4ee42b97f10ce9ef9610aa764f5fa053b3160fadad963cd47f91
TLSH
T15A81B473A828AD374DE19A84B48A35038E75D223E7597F9565DC231C00EF16CD30AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5812240665625\Local State
Size 4KB
SHA256 42454a068a292ae4b465fce0a3478be5f502f7f46bb73b6268e590f2b2d88809
MD5 ac012ac8e4fd8b37f4c0020438ca7b95
SHA1 bd5641a3989b345185e2c2c15bba33a4500bb6c7
SHA512 1c941be26be69b605a0d50b2546e19eeffbc8d6c5b601d0006e87a1619d492a64aae0ee882e6aaf1f93d19ed1bb4bb4fb00e72a52788292ffe2f5390f0a5dc48
SSDEEP 96:TqGNkJQsFfd40ta58Frh/cInURcDotovUmDOBbnvZnNWzbZu0eUclSDS4SYSuSDO:2GNxQ40focDUwRuxNsZu1e
TLSH
T176A1C8736574EC374DF19A44B48A3603AEA5D237E6887F99D5DC2B0C01EF2988306C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe584958.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5812240665625\Local State~RFe584958.TMP
Size 1KB
SHA256 5cc2b9c959cfbb84514c29cbe5278235c1833e791668914b042473d436c7f0f0
MD5 efe19ba24ccfa7932daa07942721556c
SHA1 af57ac0d72b7e67ea0f524fe844e0eb80d1fccc2
SHA512 deb2fbdf3c1b2c5c6adead8ce491acdc9100f2e56da728edde391f1efecb3f42b2393bb40cbd714f39a7e2590d0d7f1a0f1226a137dc051d77968a0d71a2396c
TLSH
T1BC31B773A5987C33DCF1660AB68E7B971E342175D15A3A4951EC061C00E769C9206C3F
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yw68n7mk.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3500-449-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-19-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-10-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-8-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-551-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-602-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-601-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-7-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-6-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-4-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-5-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-3-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-2-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-559-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-571-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-971-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-12-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-974-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-978-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-981-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-980-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-0-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-979-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-998-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-286-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-1-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-218-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-157-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-116-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-71-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-86-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-64-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-61-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-14-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-16-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-17-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-18-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-22-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-1316-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3500-1244-0x0000000140000000-0x00000001404D7000-memory.dmp

Download

memory/3980-1231-0x000001FBAA8D0000-0x000001FBAA8ED000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads