527c99c63beca1735ed785e3907aa7c88a467453a4a55f808400e8e402e6cbe3

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 510KB
Sample260507-vjvb2abx3k
SHA256 527c99c63beca1735ed785e3907aa7c88a467453a4a55f808400e8e402e6cbe3
MD5 ca856cc447d9176973ed01fb3cd8bbe9
SHA1 107d0b261a92d98dc75d0b6bdd2a58293936ab1f
SHA512 76398d49a7ea70dfb5780fad3f53733a7f9194560a839a996c378ccecded8423fc6a69bd9a129fa3b9ab53d1091411f276e1de08d4ca535dc2bde2cc9f67f67d
SSDEEP 12288:bwz+uAESTF8gxXO5DxpY3OZ14GnUF0DWAoe1jXyfPsZ:bwCuAEmxe5Dw3M4GnsVeJCQ
TLSH
T115B4233B8C3276ADDEE58170450FF5AE64A422AE0B81723ACCD5CB71607C9E5E1F7612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer upx

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 2732 created 5984	2732	file.exe	79
PID 2732 created 5984	2732	file.exe	79
PID 2732 created 5984	2732	file.exe	79
PID 2732 created 3140	2732	file.exe	89
PID 2732 created 3140	2732	file.exe	89
PID 2732 created 3140	2732	file.exe	89

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2732	file.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2732-0-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp	upx
behavioral2/memory/2732-15-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp	upx
behavioral2/memory/2732-33-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp	upx
behavioral2/memory/2732-88-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp	upx
behavioral2/memory/2732-431-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp	upx
behavioral2/memory/2732-432-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp	upx
behavioral2/memory/2732-440-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp	upx
behavioral2/memory/2732-442-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5956	msedge.exe
3388	msedge.exe
5816	chrome.exe
5096	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
2732	file.exe
5984	chrome.exe
5984	chrome.exe
2732	file.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
3140	msedge.exe
3140	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	file.exe
Token: SeShutdownPrivilege	5984	chrome.exe
Token: SeCreatePagefilePrivilege	5984	chrome.exe
Token: SeShutdownPrivilege	5984	chrome.exe
Token: SeCreatePagefilePrivilege	5984	chrome.exe
Token: SeShutdownPrivilege	5984	chrome.exe
Token: SeCreatePagefilePrivilege	5984	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
5984	chrome.exe
3140	msedge.exe
1352	msedge.exe
3688	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 5984	2732	file.exe	79
PID 5984 wrote to memory of 5036	5984	chrome.exe	80
PID 5984 wrote to memory of 3400	5984	chrome.exe	81
PID 5984 wrote to memory of 3400	5984	chrome.exe	81
PID 5984 wrote to memory of 5096	5984	chrome.exe	82
PID 5984 wrote to memory of 1908	5984	chrome.exe	83
PID 5984 wrote to memory of 1908	5984	chrome.exe	83
PID 5984 wrote to memory of 5180	5984	chrome.exe	85
PID 5984 wrote to memory of 5180	5984	chrome.exe	85
PID 5984 wrote to memory of 1608	5984	chrome.exe	86
PID 5984 wrote to memory of 1608	5984	chrome.exe	86
PID 5984 wrote to memory of 4604	5984	chrome.exe	87
PID 5984 wrote to memory of 4604	5984	chrome.exe	87
PID 2732 wrote to memory of 3140	2732	file.exe	89
PID 3140 wrote to memory of 2156	3140	msedge.exe	90
PID 3140 wrote to memory of 5968	3140	msedge.exe	91
PID 3140 wrote to memory of 5956	3140	msedge.exe	92
PID 3140 wrote to memory of 5968	3140	msedge.exe	91
PID 3140 wrote to memory of 5968	3140	msedge.exe	91
PID 3140 wrote to memory of 3964	3140	msedge.exe	93
PID 3140 wrote to memory of 3964	3140	msedge.exe	93
PID 3140 wrote to memory of 3356	3140	msedge.exe	94
PID 3140 wrote to memory of 4900	3140	msedge.exe	95
PID 3140 wrote to memory of 3356	3140	msedge.exe	94
PID 3140 wrote to memory of 3356	3140	msedge.exe	94
PID 3140 wrote to memory of 4900	3140	msedge.exe	95
PID 3140 wrote to memory of 4900	3140	msedge.exe	95
PID 2732 wrote to memory of 1352	2732	file.exe	97
PID 2732 wrote to memory of 1544	2732	file.exe	98
PID 2732 wrote to memory of 3688	2732	file.exe	99
PID 1544 wrote to memory of 1108	1544	firefox.exe	100
PID 1544 wrote to memory of 1108	1544	firefox.exe	100
PID 3688 wrote to memory of 2844	3688	chrome.exe	101
PID 1352 wrote to memory of 1004	1352	msedge.exe	102
PID 1352 wrote to memory of 3388	1352	msedge.exe	103
PID 1352 wrote to memory of 1500	1352	msedge.exe	104
PID 1352 wrote to memory of 1500	1352	msedge.exe	104
PID 1352 wrote to memory of 1500	1352	msedge.exe	104
PID 1352 wrote to memory of 3000	1352	msedge.exe	105
PID 1352 wrote to memory of 3000	1352	msedge.exe	105
PID 3688 wrote to memory of 5816	3688	chrome.exe	106
PID 3688 wrote to memory of 4880	3688	chrome.exe	107
PID 3688 wrote to memory of 4880	3688	chrome.exe	107
PID 3688 wrote to memory of 5696	3688	chrome.exe	108
PID 3688 wrote to memory of 5696	3688	chrome.exe	108
PID 1352 wrote to memory of 1964	1352	msedge.exe	109
PID 1352 wrote to memory of 1964	1352	msedge.exe	109
PID 1352 wrote to memory of 1964	1352	msedge.exe	109
PID 1352 wrote to memory of 1440	1352	msedge.exe	110
PID 1352 wrote to memory of 1440	1352	msedge.exe	110
PID 1352 wrote to memory of 1440	1352	msedge.exe	110
PID 1352 wrote to memory of 3716	1352	msedge.exe	111
PID 1352 wrote to memory of 3716	1352	msedge.exe	111
PID 1352 wrote to memory of 3716	1352	msedge.exe	111
PID 1352 wrote to memory of 5536	1352	msedge.exe	112
PID 1352 wrote to memory of 5536	1352	msedge.exe	112
PID 1352 wrote to memory of 5536	1352	msedge.exe	112
PID 1352 wrote to memory of 5380	1352	msedge.exe	113
PID 1352 wrote to memory of 5380	1352	msedge.exe	113
PID 1352 wrote to memory of 5380	1352	msedge.exe	113
PID 1352 wrote to memory of 5360	1352	msedge.exe	114
PID 1352 wrote to memory of 5360	1352	msedge.exe	114
PID 1352 wrote to memory of 5360	1352	msedge.exe	114
PID 1352 wrote to memory of 2940	1352	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff87ed1c728,0x7ff87ed1c734,0x7ff87ed1c740
    3⤵
    PID:5036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1652,i,16368656015894234246,14006100011376401733,262144 --field-trial-handle=1976,i,11272885290545696602,7140485542604632675,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:3400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,11648982333339758057,2414929387473885210,524288 --field-trial-handle=1976,i,11272885290545696602,7140485542604632675,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2168 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,1251251065991265907,4619987148927537919,524288 --field-trial-handle=1976,i,11272885290545696602,7140485542604632675,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2456 /prefetch:13
    3⤵
    PID:1908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3052,i,3270250169932449019,16402207557582436501,2097152 --field-trial-handle=1976,i,11272885290545696602,7140485542604632675,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3060,i,14321672457325109221,1277243898694544779,2097152 --field-trial-handle=1976,i,11272885290545696602,7140485542604632675,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:1608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4140,i,17042229578923609980,8313788472791948307,2097152 --field-trial-handle=1976,i,11272885290545696602,7140485542604632675,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4188 /prefetch:9
    3⤵
    PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff86cc1c188,0x7ff86cc1c194,0x7ff86cc1c1a0
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1668,i,3411540088017477378,18150967692053218712,262144 --field-trial-handle=2184,i,14627046178582032179,15079124614159865130,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,11960924183357348086,11181557544878777208,524288 --field-trial-handle=2184,i,14627046178582032179,15079124614159865130,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,554771441880063532,5887823476770400643,524288 --field-trial-handle=2184,i,14627046178582032179,15079124614159865130,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,200121055175541486,16163905552076674264,2097152 --field-trial-handle=2184,i,14627046178582032179,15079124614159865130,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,12086745669116218897,15755122714080885326,2097152 --field-trial-handle=2184,i,14627046178582032179,15079124614159865130,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1352240678281 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1352240678281\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ff87ecfc188,0x7ff87ecfc194,0x7ff87ecfc1a0
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2384 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2324 /prefetch:2
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2408 /prefetch:13
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3400 /prefetch:1
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3764 /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3816 /prefetch:9
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4032 /prefetch:1
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4088 /prefetch:9
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4232 /prefetch:1
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4364 /prefetch:9
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4512 /prefetch:1
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4608 /prefetch:9
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5064 /prefetch:9
    3⤵
    PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3772 /prefetch:9
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5632 /prefetch:9
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5576 /prefetch:9
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5636 /prefetch:9
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2340,i,17807319114031444055,18174542976465265732,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:4472
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
    3⤵
    - Checks processor information in registry
    PID:1108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2340 -prefsLen 27097 -prefMapHandle 2344 -prefMapSize 270315 -ipcHandle 2408 -initialChannelId {9480050b-cc1e-4b11-8065-ae307495de2b} -parentPid 1108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff87e95c728,0x7ff87e95c734,0x7ff87e95c740
    3⤵
    PID:2844
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1956,i,13455520091145286685,8727265989301804363,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1984 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,13455520091145286685,8727265989301804363,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1952 /prefetch:2
    3⤵
    PID:4880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,13455520091145286685,8727265989301804363,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2144 /prefetch:13
    3⤵
    PID:5696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1956,i,13455520091145286685,8727265989301804363,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3124 /prefetch:1
    3⤵
    PID:1200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1956,i,13455520091145286685,8727265989301804363,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3144 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1956,i,13455520091145286685,8727265989301804363,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1956,i,13455520091145286685,8727265989301804363,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3648 /prefetch:9
    3⤵
    PID:572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1956,i,13455520091145286685,8727265989301804363,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3656 /prefetch:9
    3⤵
    PID:5192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1956,i,13455520091145286685,8727265989301804363,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3900 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1956,i,13455520091145286685,8727265989301804363,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4272 /prefetch:1
    3⤵
    PID:2468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1956,i,13455520091145286685,8727265989301804363,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4296 /prefetch:1
    3⤵
    PID:3020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 bc9b944a47237686b20ee710be3896f02fdaae9583b56b5d81a240a26656d15f
MD5 b14098f6ac44c9510b7bbb3164da0dfc
SHA1 c6d5432b1f104bd1593dff3460bbcd07d578babb
SHA512 aceb7685421853ee92ce2574f5f7dde6b9901088aaac87f45fa521ef641328791455fa747a3eb8c79f68a9c79d6074fb1b6a18d9bb0cad416988d31a756c425c
SSDEEP 1536:eGalBP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:Qp++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T16D9302B9991E7D75636AC6D690079CAC8CE3DCCE1514117C30C7AB1E24BE393A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 9081c80e48d6086db9fb097aa85fa97e89c25321b1c77f8b5c10a9583c971d03
MD5 c306d4e70c1627eaceb86379d8d5c47a
SHA1 202e7f9fb094df23789ff03ea5cfde549a08919a
SHA512 c06aed3b37f7316f2b118e6b64bb16032f54be6097fba5d978e261fa2f1918c815fc53407e2129b4be2a233eb5b9a203394d42e8e3508d3f42e96b2cf1bdb059
SSDEEP 192:Fvo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1DC24530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3dd773ae63ebe8eb8141ac038d8d2c390fc2c30a0161b999afda54ad69a509cb
MD5 5ea0b3c57cb32d7c29de799c0d429e25
SHA1 7fb3cd6977b2e1d4c9a3062267c734f9b2ad0ace
SHA512 85a7a6f503aa906b90d3107a3c82a50689a56fdd5d6408ed2752991afa0ca8714cc35c3eeac981dc5e7f73b86eca70fb51945338d097d664c5517eeebd08bb2d
SSDEEP 384:n1iFavqMg38NZ8TUNTUlIxBvHTzYGPwffKvFueOkf9u7dnS4mtmnJrNlk+5vI+P:8Fayv3Kwg3YDK5Okf9u7dS4smnNr
TLSH
T1E5C24A75E898D9A7EDE68FC9E7457A17EEE001A7D58C4AC8CAD81D0E00971DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a4a888caccb5033c75522e38efbbeff573a15dae40a534a8e0786d5faaac85c6
MD5 6d7d5db37daa12a81333999f7889c63c
SHA1 65c6ac948960de67d1345d4dc394eca23c7c09fd
SHA512 ea8905c13e7d3f28025aa2ada22a873d21e8509fab07be57ef4a08647b73ab1a2b5f50a900a44c2ccba1df22a5441cd607cf63b812f169ec973e311be4b6d27c
SSDEEP 384:nUiFavqMg38NJ8TUNTUlIxBvHrQCPwffKvFueOkfE4XTrgsVdnS4mtmnJrNlk+5D:vFayv3GwgEfK5OkfE4PgsVdS4smnNr
TLSH
T1C6C24A72E8A8D9A7EDE78FCAE7457A17EEE001A7D58C4AD4CAD41D0E00971DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0806c410

Path C:\Users\Admin\AppData\Local\Temp\2727af53\0806c410
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a0803d2

Path C:\Users\Admin\AppData\Local\Temp\2727af53\0a0803d2
Size 5.0MB
SHA256 4f1960420223d74232c400aec69b597e72551117daf975cfec2c7dff0a7c6449
MD5 69093ecc3841f8d014b7905bb6a66bfd
SHA1 4d4318fec5115489e9664dd2516ee025f4c85e5a
SHA512 7f8bb846761dcb2f6258aa18bef42e5b571cc2701d589db5dfb28752be7ae296e47471f5dff5df63e4cbb48abe0b91fb8aa8986b8f311585eaa07bc57d5b4c43
SSDEEP 192:M8rJQaXoMXp0VW9FxWHBjs4hDqv+yhnB0DZE:M8r54w0VW3xWh
TLSH
T17536100F7A615150C4EAA132ACF36F25683F71168A3337933D94266D4DE0727B92DCBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3deb6711

Path C:\Users\Admin\AppData\Local\Temp\2727af53\3deb6711
Size 20KB
SHA256 651e4c4e4c03462dde86555a64e02044a775414ec7ba6e37fc6d85f5e219e70f
MD5 4d8ada63bdb5b8a6e0288a13a1fc6f6f
SHA1 d266f8b91aea99671f6bd083aac6e3893ea7685a
SHA512 b4b4b662ce2307765f0605d38dda2ac0517c37244ac5a5a68b2b241783340f4062fd6b9992f9bd1836e78e9455b52d1d2bca474fa3e429e2d1a14a3494cdd552
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBnwd5H7fqrmcKdVINuj:TeW9aw/aHLopFMavU1iBwHbfqrmcKcC
TLSH
T15A921F8F1F303614C0F49772E9C219961E7C252C93136A9AEE2444B39D865ABB6059E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bd24a51

Path C:\Users\Admin\AppData\Local\Temp\2727af53\4bd24a51
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58828731

Path C:\Users\Admin\AppData\Local\Temp\2727af53\58828731
Size 138KB
SHA256 06a51994d99bb1fab217c1445d1c67c3c1e351493aeb9ee5c85b73f421117a5c
MD5 039254d055c29cf77592c602edfd85ea
SHA1 ef8089a6d7405a9d91188755192bca1f1e96500a
SHA512 32c24f3400f73651d9ec79da711713b7b4a72002ea85fd89d7d47ec07b54477d880fb674d8d5002fde453e3e0de25643d9b953f34062f19454f17aaa5fb031fa
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2O5xdVumfnKa:FnbZeMrv/hGt5xhnKa
TLSH
T1B4D3774B3A743002EDE59A722CF055BB5D3C716D8F11A5D428B620688EF2963B63D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b1cc9db

Path C:\Users\Admin\AppData\Local\Temp\2727af53\5b1cc9db
Size 20KB
SHA256 f44471c099f1c629d102c32afabe630c68f6bf12a4f3c3dce77e8e63cc72ba83
MD5 7fafff5022f40a8d39f112e5fc91f6a4
SHA1 5fea9474548b3d55cc2037a20d06d23a595b0b71
SHA512 f0414071688d505af99f6aea144e9b62e3962b7bbdd38193e00c73fa1b278e1be7bfd31cad9b1f17cb51961dc68d593e433dbcd8a7ff4e0f6ec3d1755b33face
SSDEEP 24:TLJLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfByoHpwOEN8pjUR4mBw+AwH:TtLopFMatSaw/auUOt8ByoJwFejM5AwH
TLSH
T1CE92FB4E5F306221C0B58F72DDD584632F7C201DD767269A9E5420F2CE965AFF50A0BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61019921

Path C:\Users\Admin\AppData\Local\Temp\2727af53\61019921
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c9f439f

Path C:\Users\Admin\AppData\Local\Temp\2727af53\7c9f439f
Size 288KB
SHA256 707073c343561308b3810327dc0b9b0ab125560be0830bf74567dcaf9ab7d3b2
MD5 3fee4674f47ec49c13470692071a4d18
SHA1 5086ec6aa1f8e2d1c68c17e6b8bfc68d09ec239a
SHA512 39546ad5319a8d5cd324c8107b53602c5041914d099ded476be8a38eff299312419beb2dbe37844e26163114cee4eabf0245c298794ee15ce3df0dc7498dc2e2
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vHjW9+C7iX:f1zkVmvQhyn+Zoz67YjW9TmX
TLSH
T1C354BA47EEC4F50ADB0A6830C6454DF23A10AB0443815E7BDBBC1E7E1EB164DBAAD5C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb5d4518

Path C:\Users\Admin\AppData\Local\Temp\2727af53\bb5d4518
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c81003c9

Path C:\Users\Admin\AppData\Local\Temp\2727af53\c81003c9
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd22c716

Path C:\Users\Admin\AppData\Local\Temp\2727af53\fd22c716
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3688240678265\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1352240678281\Crashpad\settings.dat
Size 280B
SHA256 bc2a992a646b731c9cc7dc5185e923a4e648eef12ea6ef2bf0c73cdc60f12fca
MD5 5ee5db5089e3a3bc8c87080cf335b312
SHA1 4bcb7c5be0bb1accec06a544c35d4317117f3774
SHA512 2d9a2e8354880f59f064bc2831e3b2689dcc7f1d6e4b73cffeb8a726c498269dd119c43da0938c64d27a982b73eccdb19aa9ea0b7f85f61ff5639e25026bc630
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1352240678281\Crashpad\settings.dat
Size 280B
SHA256 721730b460e1f6ca430c7df2a7a09984b107b6d613a0b2caafebdf106bb82d9a
MD5 f1262514584f99b9e92c3b40c1da14fd
SHA1 8abb17172914b669fc4c74c444d9317730ae88eb
SHA512 96a93d6c7dda80035442cd27fb1b08c9e19617c07d2c96bbf69d37d5eb2977d98de8809abfd4d9337727b295fb0e91e3e9535e1211eaa10c27e5ae4f3eceaba2
TLSH
T154D0112A2B82A202F0A2A0BA323283A08EC2C883082E0020A80B20082888000008B228
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1352240678281\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1352240678281\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1352240678281\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1352240678281\Local State
Size 3KB
SHA256 7eb4b1cc70cd474e50cd07a22face6e0be93c6e7f5acb32677e12017761cba71
MD5 ae5d445a2a2c99d3b95cb67bdb46cdf7
SHA1 b2fb45755b10bea88a44bf1654fc149cadf9b247
SHA512 34e1b5066846c5da76c86d0a3842be86cf201e14e589cb0679634beef91619972574af1096ce356fb4bd70fc53d8f8ad66eb7dd559c0c64856868b3f7017d2f5
TLSH
T16681A5337818AD3799F15984B44636138E75E263EB59BF90A1CC230C01FF56CD30AC66
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1352240678281\Local State
Size 4KB
SHA256 2a602700671a1dbba31b5afae8f75d01579750b2f109a457fd75efeeffb0eae4
MD5 e2b3d0a50e5ddc019086d457ae789b9f
SHA1 0ee49de0aafa25a19b53605438f457a24a897cd4
SHA512 cedf0364c6242b4c3655c152bb5f983a1bb8183db018a9b513918161e1abadbb3cb932e28e742f04579173104834e16a1cd6fa436d0f2a0fd21243f8b5289d5b
SSDEEP 96:HqGNkXQsFfPuDE58Frh/cInURcDotovl6DwTBq0vhQNx0eUcxCSDS4SYSuSDSDS0:KGN/SmocDUw+wNMNx1N
TLSH
T109A1C6337868ED2B5DF29984F48632136EB59127EA987F94D5DC2B0C01FF6988346C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe587700.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1352240678281\Local State~RFe587700.TMP
Size 1KB
SHA256 9a4333a4fc255eea259b1450edef0f40a824fb01034a15e4260749118e8b9ff9
MD5 65716822e65bb9e851761f5c60fd1b4d
SHA1 aa3b94ab8cbca70d848fd13cc93405038830e41c
SHA512 3fecc2ddde9c00ee295764ec0191d10f0af23da564cf272384ced7680df0788ffb1150326d9c0b3a71e4fb213dbf7ad98c6359138ffd8517a6be0769f8f75c45
TLSH
T16531BA73795C3D77F8E05549B205B7A31F701176A1256F8051DD070D15EB98C5B16C36
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2732-88-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp

Download

memory/2732-1-0x00007FF6DA371000-0x00007FF6DA372000-memory.dmp

Download

memory/2732-33-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp

Download

memory/2732-0-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp

Download

memory/2732-15-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp

Download

memory/2732-431-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp

Download

memory/2732-432-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp

Download

memory/2732-440-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp

Download

memory/2732-442-0x00007FF6DA370000-0x00007FF6DA8A7000-memory.dmp

Download