2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
Size 827KB
Sample260508-wsbfysfs7p
SHA256 2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12
MD5 c852ac27e2eb3d6a009d703b4b079b97
SHA1 e44635af217ad743450928df8df91586d79aef12
SHA512 71f5ec10bf3d9ec2d6efe7b10c1d8b6d41b941f889503d44f6d7ad51c6ab3bd2e7088dbc4fdeea1c9aeaaf7149c61f70c29882ae1b31c606bcc4a1cd726543e3
SSDEEP 24576:CP134HzWJZncEGahYFQw6UOMc7YN2GAR:CEzgnceeOM8YYG
TLSH
T1DD059F119F9352EAEC334939D4EA131B78F47CD882A08E33C6670E993D43565B33B666
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 5072 created 2280	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe	78
PID 5072 created 2280	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe	78
PID 5072 created 2280	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe	78
PID 5072 created 5388	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe	88
PID 5072 created 5388	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe	88
PID 5072 created 5388	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe	88

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
356	chrome.exe
3800	chrome.exe
4696	msedge.exe
4384	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
2280	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
5388	msedge.exe
5388	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
1752	chrome.exe
1752	chrome.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	2280	chrome.exe
Token: SeCreatePagefilePrivilege	2280	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
2280	chrome.exe
5388	msedge.exe
2468	msedge.exe
1752	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2280	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe	78
PID 2280 wrote to memory of 2992	2280	chrome.exe	79
PID 2280 wrote to memory of 3800	2280	chrome.exe	80
PID 2280 wrote to memory of 4256	2280	chrome.exe	81
PID 2280 wrote to memory of 4256	2280	chrome.exe	81
PID 2280 wrote to memory of 2712	2280	chrome.exe	82
PID 2280 wrote to memory of 2712	2280	chrome.exe	82
PID 2280 wrote to memory of 2500	2280	chrome.exe	83
PID 2280 wrote to memory of 1596	2280	chrome.exe	84
PID 2280 wrote to memory of 2500	2280	chrome.exe	83
PID 2280 wrote to memory of 1596	2280	chrome.exe	84
PID 2280 wrote to memory of 1688	2280	chrome.exe	85
PID 2280 wrote to memory of 1688	2280	chrome.exe	85
PID 5072 wrote to memory of 5388	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe	88
PID 5388 wrote to memory of 5848	5388	msedge.exe	89
PID 5388 wrote to memory of 4696	5388	msedge.exe	90
PID 5388 wrote to memory of 4716	5388	msedge.exe	93
PID 5388 wrote to memory of 4716	5388	msedge.exe	93
PID 5388 wrote to memory of 4764	5388	msedge.exe	91
PID 5388 wrote to memory of 4764	5388	msedge.exe	91
PID 5388 wrote to memory of 4764	5388	msedge.exe	91
PID 5388 wrote to memory of 468	5388	msedge.exe	94
PID 5388 wrote to memory of 848	5388	msedge.exe	95
PID 5388 wrote to memory of 468	5388	msedge.exe	94
PID 5388 wrote to memory of 468	5388	msedge.exe	94
PID 5388 wrote to memory of 848	5388	msedge.exe	95
PID 5388 wrote to memory of 848	5388	msedge.exe	95
PID 5072 wrote to memory of 1752	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe	96
PID 5072 wrote to memory of 2468	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe	97
PID 5072 wrote to memory of 2180	5072	_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe	98
PID 1752 wrote to memory of 2916	1752	chrome.exe	99
PID 2180 wrote to memory of 4704	2180	firefox.exe	100
PID 2180 wrote to memory of 4704	2180	firefox.exe	100
PID 2468 wrote to memory of 5028	2468	msedge.exe	101
PID 2468 wrote to memory of 4384	2468	msedge.exe	102
PID 2468 wrote to memory of 3500	2468	msedge.exe	103
PID 2468 wrote to memory of 3500	2468	msedge.exe	103
PID 2468 wrote to memory of 3500	2468	msedge.exe	103
PID 2468 wrote to memory of 4032	2468	msedge.exe	104
PID 2468 wrote to memory of 4032	2468	msedge.exe	104
PID 1752 wrote to memory of 356	1752	chrome.exe	106
PID 1752 wrote to memory of 4580	1752	chrome.exe	107
PID 1752 wrote to memory of 4580	1752	chrome.exe	107
PID 1752 wrote to memory of 1996	1752	chrome.exe	105
PID 1752 wrote to memory of 1996	1752	chrome.exe	105
PID 2468 wrote to memory of 2908	2468	msedge.exe	108
PID 2468 wrote to memory of 2908	2468	msedge.exe	108
PID 2468 wrote to memory of 2908	2468	msedge.exe	108
PID 2468 wrote to memory of 1104	2468	msedge.exe	109
PID 2468 wrote to memory of 1104	2468	msedge.exe	109
PID 2468 wrote to memory of 1104	2468	msedge.exe	109
PID 2468 wrote to memory of 6028	2468	msedge.exe	110
PID 2468 wrote to memory of 5872	2468	msedge.exe	111
PID 2468 wrote to memory of 5736	2468	msedge.exe	112
PID 2468 wrote to memory of 1288	2468	msedge.exe	113
PID 2468 wrote to memory of 1188	2468	msedge.exe	114
PID 2468 wrote to memory of 5532	2468	msedge.exe	115
PID 2468 wrote to memory of 5636	2468	msedge.exe	116
PID 2468 wrote to memory of 1068	2468	msedge.exe	117
PID 2468 wrote to memory of 5308	2468	msedge.exe	118
PID 2468 wrote to memory of 6028	2468	msedge.exe	110
PID 2468 wrote to memory of 6028	2468	msedge.exe	110
PID 2468 wrote to memory of 5872	2468	msedge.exe	111
PID 2468 wrote to memory of 5872	2468	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe
"C:\Users\Admin\AppData\Local\Temp\_2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ff95e3cc728,0x7ff95e3cc734,0x7ff95e3cc740
    3⤵
    PID:2992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,9616323817373187867,16140931943999538870,524288 --field-trial-handle=1924,i,10664179886988631640,17403349696921623065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2072 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,16287716151906011866,11803857977817829554,262144 --field-trial-handle=1924,i,10664179886988631640,17403349696921623065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:4256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,17676033701128490983,16214411319806263144,524288 --field-trial-handle=1924,i,10664179886988631640,17403349696921623065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2404 /prefetch:13
    3⤵
    PID:2712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,14051943897032886053,6992446332444652012,2097152 --field-trial-handle=1924,i,10664179886988631640,17403349696921623065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,14840809062968589009,4522785651428267242,2097152 --field-trial-handle=1924,i,10664179886988631640,17403349696921623065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4144,i,5656274301971916748,12747451285448467416,2097152 --field-trial-handle=1924,i,10664179886988631640,17403349696921623065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4156 /prefetch:9
    3⤵
    PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff94c5cc188,0x7ff94c5cc194,0x7ff94c5cc1a0
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,6255395890103189451,8035864820683088290,524288 --field-trial-handle=2068,i,8999600127666176487,14019627928007952435,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1584,i,11503361466756304971,18438340364452296034,262144 --field-trial-handle=2068,i,8999600127666176487,14019627928007952435,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,13013459572726554522,13892716391044656260,524288 --field-trial-handle=2068,i,8999600127666176487,14019627928007952435,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:13
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3340,i,9356345799035914561,11529997385909392756,2097152 --field-trial-handle=2068,i,8999600127666176487,14019627928007952435,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3336,i,215438461304420065,2236073025184371472,2097152 --field-trial-handle=2068,i,8999600127666176487,14019627928007952435,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff95e3cc728,0x7ff95e3cc734,0x7ff95e3cc740
    3⤵
    PID:2916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    PID:1996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --force-high-res-timeticks=disabled --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1924 /prefetch:11
    3⤵
    - System Time Discovery
    PID:356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --force-high-res-timeticks=disabled --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2052 /prefetch:13
    3⤵
    PID:4580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:3076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3956 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3964 /prefetch:9
    3⤵
    PID:1688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3980 /prefetch:9
    3⤵
    PID:4808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4416 /prefetch:1
    3⤵
    PID:404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4436 /prefetch:1
    3⤵
    PID:5976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3224 /prefetch:9
    3⤵
    PID:2240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1752240739968" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1804,i,7404846862569927675,14474830485392456515,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4044 /prefetch:1
    3⤵
    PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2468240740031 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2468240740031\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ff95e1fc188,0x7ff95e1fc194,0x7ff95e1fc1a0
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2004 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2268 /prefetch:13
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4080 /prefetch:1
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4212 /prefetch:9
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4112 /prefetch:1
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4020 /prefetch:1
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4004 /prefetch:9
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4084 /prefetch:9
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4160 /prefetch:9
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4164 /prefetch:9
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5400 /prefetch:9
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5412 /prefetch:9
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5396 /prefetch:9
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3856 /prefetch:9
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=6040 /prefetch:1
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=1976,i,5169633848018352745,12252734979939361685,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=6044 /prefetch:1
    3⤵
    PID:1964
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
    3⤵
    - Checks processor information in registry
    PID:4704
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2280 -prefsLen 27097 -prefMapHandle 2292 -prefMapSize 270315 -ipcHandle 2388 -initialChannelId {b8717b14-1cd2-4eb6-98c4-7f57bcd5ad2f} -parentPid 4704 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4704" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:1376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 f87c6a634c4d2f423c74b3dae5fc24ac716eaf8b1a98c2d3fe9bfb41bde309d2
MD5 82f3b4854a390c41ecaa843e39676595
SHA1 5b591faaa3a4fbd4511141883986b2f3be48a1c4
SHA512 293d0ef81b07af78850f1d85b005b60b16eeabbed7843926241a47c80f3c3d723f666f5ae2fdbd3411d7fefa1f84a43b5fdf93a6685d7d699422b80be62ea4ab
SSDEEP 1536:ub+P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:Z++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T1279312B9991E7D79636BC296A0079CAC4CD3DCCE121055BC30C76F0E18BA392E31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4f20f916a46d879220b75412e974c6df37fba8f0e80e78f071a3124fdb665aee
MD5 aaac91ebbf67dbbc392d45b8ba21b7af
SHA1 c12b368a2d9e5d86e38c050c8c991930b00b017a
SHA512 d7492a4c51ec39a37fa7e0e893db326eb2afa4a19ccab42d34d8b2aa7279aedca2f5868970e4513c37d26caa55dce67a9dccd146446e47298a0c41e59869c2b9
TLSH
T145D08050DEF05960D8046571242CF7D45F59D9A1DD47DA2125E5EF799DC20C648C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
MD5 c5c86d9c5f7c32a8c4fd09d6ffda4aa8
SHA1 8d3978b900d523ba08075019d6235c1e176294cb
SHA512 e14f89cb3354fd6d7a68e1c291c8723a5bfd3d28140a150bf75ef42a2ef8212eddaed6f6db92cd69e603806f0897ef93b8761a51acd8b8db67878c4cf26ee23d
TLSH
T10AD0C040DAF02820D8046471242CF3C00E09CCA1CC43DA2124E0EF798D820C644C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 9081c80e48d6086db9fb097aa85fa97e89c25321b1c77f8b5c10a9583c971d03
MD5 c306d4e70c1627eaceb86379d8d5c47a
SHA1 202e7f9fb094df23789ff03ea5cfde549a08919a
SHA512 c06aed3b37f7316f2b118e6b64bb16032f54be6097fba5d978e261fa2f1918c815fc53407e2129b4be2a233eb5b9a203394d42e8e3508d3f42e96b2cf1bdb059
SSDEEP 192:Fvo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1DC24530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 080540c56f68e2059f452f8dbddf1a1dbf230ff9b3a15afb56b9ef99bf674798
MD5 422b1cd1c90937bafe20aad1fc00e9e3
SHA1 efc8366c6ae2fbff1e11510efe0f7c89db9151a5
SHA512 c62f31263c469966367430265772501214937213f24d03461d7f1841c1b6ba0234586a809ca1ca1ac8d075c9193d85793d6d6de588881c18470225e01bcb62f9
SSDEEP 384:nuiFavqMg38N48TUNTUlIxBO2+4Or4LJdBSOrfpYauhDq984ZNaCRYV/Vw1mR27y:FFayv3PwgO2ZdBHYTDq24T7RYk1mA7Ch
TLSH
T1D2C26B35E854CDBBEDEA4FD9AB497A07DEF001A7C59C4AD4D6D81E0E009719E230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1d62df0df11c44ca48df406129b079f42824401dbed96fff666ff9852f59ee43
MD5 eab477a0e735ee6c2ac2cb1f12f7a868
SHA1 5074f2fe37d472433ad93dab88e74122a5368a40
SHA512 17d712f96fcac4607490bab321b8dc74c0965213553d8d72d72ecf63f6fe77a519bc331a7fd60d10e2a2ddd5070da58d26b07f9372ce768cb64b664736e3bfc8
SSDEEP 768:dFayv3AwgO2ZHjYTDq24YHzMOuYRYk1mA7Ch:2yv3n2ZYq2fzHmkEA7y
TLSH
T1E4C26B35E854CDA7EDDA8FD9E70A7A17DEF0116BC58C4AE4D6D81E1E008719E230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12c9c91a

Path C:\Users\Admin\AppData\Local\Temp\96caf574\12c9c91a
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13b7374a

Path C:\Users\Admin\AppData\Local\Temp\96caf574\13b7374a
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3978a3c2

Path C:\Users\Admin\AppData\Local\Temp\96caf574\3978a3c2
Size 20KB
SHA256 fec96d88caeaa34dfb62b3fe6bd06838d5abd399303b23c84385b9b97f62caef
MD5 a38236bee795ba378a8f6db56f59b5d8
SHA1 33cb26b3cc126482e635e535832e5534bf0b9318
SHA512 7f60627c984102f1f9ae0fa6a4fd56daec049f40e28e8f72646d57d827e1b9e0871801482afd8d129d292e3015eedba44843cdfc4d8e9d5abcd89bee2c91328a
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBnwd5DL9Yg10AphgRjgMD8j:TeW9aw/aHLopFMavU1iBwHDyQv+C
TLSH
T1EC92EF8F1F303610C4B4873ADAC1485B2E7C112DD3676699FE5024B2CDD25ABF1064B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52629752

Path C:\Users\Admin\AppData\Local\Temp\96caf574\52629752
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ff3ed49

Path C:\Users\Admin\AppData\Local\Temp\96caf574\7ff3ed49
Size 288KB
SHA256 ca7b4aa9904d40ff9b31819a1600c9b9e706a4a540ea466cb57d8cafd7dfc261
MD5 9fc275b4f0fe8ed7d66afbad921fe15f
SHA1 caa66f4b21cb044940afeba283d56f97ea21f286
SHA512 b7483756e57c706b1bc3f3aa1bc309a67b4a3b3697c210858c25fd6ba95bf5842a8a6f94ac0e242a4ce4b62bfbec6f7973a3cde66c0b74f2c73a6dc9ccfdd535
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vi9+CI8Dq:f1zkVmvQhyn+Zoz67/9T9q
TLSH
T12454CA46ED85B40AE71E6830C9444DF27A41AB0447815E2FCFFC1E3E1E7164DBAAD5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8230947f

Path C:\Users\Admin\AppData\Local\Temp\96caf574\8230947f
Size 20KB
SHA256 2872a4786b262e82089f297fd69ebb794c3adf4aed348cea8dcc34fc52887bb8
MD5 2318b39545a3efb6c38861930e5e4251
SHA1 52bd5ef6d0ef4c0e9528869c7b68b0cf0ff1566f
SHA512 a72bf0ac1292cba4d5c8da69348dedbf208b0fd3990549e0993e93b257823e82ed2ca2906d538ffb3306b48c0ec52106888db8fb9f3c9bce1ce477c2680c59b1
SSDEEP 48:TtLopFMatSaw/auUOt8ByonwWgnhj/AwH:9eMatUaAKnhU/AA
TLSH
T10C92FB8E5F306221C1B05B72EDD1C8262F7C211CD367669EAA5460F38D93A9FF5060AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

978d95e0

Path C:\Users\Admin\AppData\Local\Temp\96caf574\978d95e0
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa3ed471

Path C:\Users\Admin\AppData\Local\Temp\96caf574\aa3ed471
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5f44a17

Path C:\Users\Admin\AppData\Local\Temp\96caf574\c5f44a17
Size 138KB
SHA256 12240c8078b5b2a3945512bbdc52478eb1d2d7599d93120a66c3547f3b7a5a3f
MD5 368551e4837e343c48c8e8ac918551b2
SHA1 10130d93e389e2250acf0144eec52bd1e3580bf9
SHA512 14df270d752b80b551470c606b17ea382463d815f9d86833372718770065422b1becaf1c98ab938b6669a0c9501f8cd085026bfe690f654ac1a7848cc974e2bb
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OrveVumw1nk:FnbZeMrv/hGtrHnk
TLSH
T11DD3974B3A743002EDE5DA722CE0557B5E3C716D4F11A5D428B620688EF2963B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3d32676

Path C:\Users\Admin\AppData\Local\Temp\96caf574\d3d32676
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3a71c5b

Path C:\Users\Admin\AppData\Local\Temp\96caf574\f3a71c5b
Size 5.0MB
SHA256 b08d90b660d317c6d9801b49119fb22b78cff5693c7bc749434265cc6790fbcf
MD5 8c72ccd31444235900a95aa81dbd129d
SHA1 ea633febed9d771857de982e0da960816c214f8e
SHA512 ded40fe8b64d6a4abd6e48590819c0287deb8f6d359876e9dacb1658dc27d3ea4a929af42939a3fb8b50bb09540370550b4621d621630d2d2864de235a6cce46
SSDEEP 96:D4k1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ8G:M8rJQaXoMXp0VW9FxWHrQsJfGvYZE
TLSH
T13136001F7A201150D4EAA232ADE36F16283F70168B3776933DA4656D4DD0723B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2468240740031\Crashpad\settings.dat
Size 280B
SHA256 1f47c309ace8ee97f433fec869a4bd1d9c33fc3c11935f5623f3fcec167c27ae
MD5 80993ecb7cf4bd652ded6bda1dcc52b9
SHA1 380f7e643e6cfaa1a90df23680c247e0fd58af23
SHA512 758c3c50e9bb2881c3dbc492e80befb6b787c29ebff167ef7f210accef556e057838a5026c9646b877e5049a28a5c1b4145a72f3cbc8aad4d1c5e313875365e9
TLSH
T1D6D022E0B3FAC80BEA020038B233EFC02B00C8038A0FB8C0008000080A8220C300A088
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2468240740031\Crashpad\settings.dat
Size 280B
SHA256 aab7fffbfe79de9a842564444dd63ad719e4aedbaf2dcc1a7b37c35eafab545d
MD5 ddc871d8163f2fbcb1e581c2de8a9426
SHA1 09e72d07323bcac5670ad7afe8b70926acd062b8
SHA512 e70d95a66f72637bc3463c9a8cb6ebfabff19de1173a6b6a250c14df5f66d3e75bbb930fe6d493202b078255827436c4e8ada3be68bb56d468a81992c3ffbe62
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2468240740031\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2468240740031\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2468240740031\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2468240740031\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2468240740031\Local State
Size 3KB
SHA256 24f956c89c49e0103cd75ca0d1c2b75d2e956ac421cd4a2d7d2f0e3bc5cab19a
MD5 aebd2ca676b8b0e72b3680c5baec2a4d
SHA1 d20be2a9a1439a7dda9fc8b9ff37f4d5b1ddbcfa
SHA512 5940b72849fd569337bf7df379ec5699a793fc0244c2c08adab77f60b4e4fa26c57fe5c5d828f1c4fabeb14bd237ea24cf952f32f431b1435a9dc186d870b245
TLSH
T14B81B43364A8EC775EE65A84B08A39238F74E623DB557B8454DC271C01FF6AC9309C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2468240740031\Local State
Size 4KB
SHA256 5518b0aa6c0fd799be2378fc4181728855c41c651307aed2d12487ef11d8025c
MD5 75b88b2138e435a71d9877247f7eb19c
SHA1 c797c2d6208ca70a07a9c0c346c0a1fb1271fb2c
SHA512 01f9cb4a1d1003ebcd8b4942c9b15c847b6c9c8f94bc7c8bec6b497e460252e2173739f730e5c82de3a99879b18a10a0b812dba7b721543800350384e4f534fd
SSDEEP 96:7qGNkqQsFfFMDx/x58Frh/cInURcDotov6TDhBqUvERYx7zx0eUc8SDS4SYSuSD/:eGNysM9wocDUwQXAYx7F1u
TLSH
T1B5A1B83364B8EC675EE65944B4C636236FB4A123E6987F99D5DC2F0C01EF2A85309C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe596894.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2468240740031\Local State~RFe596894.TMP
Size 1KB
SHA256 6dd01b36eef258f7f6edfc3d95e3b65bbcd7630288f75bd2141a57946a9a2f49
MD5 9e05268f5a636486ad047fdebc6474f2
SHA1 03a7d7b4dbc73d44be16a77f2d2cbdd6330ab286
SHA512 0d1a416c9f1923a3ad907a23a8fbb9307c1e24719cc8fdf983cd8b3ff72078d864faeb0d55f6bec23bd067d73583a29eb0c38e05928451e54c463e0f1ebf772d
TLSH
T16A31587174ECAC73F9565A5A724A7A732F34657391512A8804DD091D01EB6DC221DC3B
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5072-0-0x00007FF753540000-0x00007FF753A72000-memory.dmp

Download