0fdf28371735a3dce97a8c7d401dd316ec803efd173e3b79100bd7472efadb78

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 752.3MB
Sample260509-d4d24sat3v
SHA256 0fdf28371735a3dce97a8c7d401dd316ec803efd173e3b79100bd7472efadb78
MD5 60b52504739e9958d4a0f487195ae254
SHA1 f3b9ec56792c3b84eb9ec829cd42cdb711acd2a6
SHA512 6dcc141fd7f17ac6a983a6ee3c2bef6c162233e3f7c949cd8f88d8865b4c3c00757d4919b148f0c9554b2f6653abb5ee52f08ddf1d0c06aa5bd2746fafb63169
SSDEEP 49152:5GdkAGe3/mYh759Zm5oy3duuhxQzmN/fKgWXSxH0APnTcwZS:5iWm/Lhitxx8mN/igWXy/7U
TLSH
T166897C13793940E4D5E1D139CA337263AE26B889973837D31AE19D602F363C05E79B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 4008 created 2852	4008	Setup.exe	78
PID 4008 created 2852	4008	Setup.exe	78
PID 4008 created 2852	4008	Setup.exe	78
PID 4008 created 5896	4008	Setup.exe	88
PID 4008 created 5896	4008	Setup.exe	88
PID 4008 created 5896	4008	Setup.exe	88

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4008	Setup.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3532	chrome.exe
5244	msedge.exe
3276	chrome.exe
4292	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
4008	Setup.exe
2852	chrome.exe
2852	chrome.exe
4008	Setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
5896	msedge.exe
5896	msedge.exe
4864	msedge.exe
4864	msedge.exe
5500	chrome.exe
5500	chrome.exe
4864	msedge.exe
4864	msedge.exe
5500	chrome.exe
5500	chrome.exe
5500	chrome.exe
5500	chrome.exe
5500	chrome.exe
5500	chrome.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	Setup.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	2852	chrome.exe
Token: SeCreatePagefilePrivilege	2852	chrome.exe
Token: SeShutdownPrivilege	5500	chrome.exe
Token: SeCreatePagefilePrivilege	5500	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
2852	chrome.exe
5896	msedge.exe
4864	msedge.exe
5500	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 2852	4008	Setup.exe	78
PID 2852 wrote to memory of 3296	2852	chrome.exe	79
PID 2852 wrote to memory of 3532	2852	chrome.exe	80
PID 2852 wrote to memory of 3196	2852	chrome.exe	81
PID 2852 wrote to memory of 3196	2852	chrome.exe	81
PID 2852 wrote to memory of 2544	2852	chrome.exe	82
PID 2852 wrote to memory of 2544	2852	chrome.exe	82
PID 2852 wrote to memory of 3528	2852	chrome.exe	83
PID 2852 wrote to memory of 3528	2852	chrome.exe	83
PID 2852 wrote to memory of 1708	2852	chrome.exe	84
PID 2852 wrote to memory of 1708	2852	chrome.exe	84
PID 2852 wrote to memory of 3048	2852	chrome.exe	86
PID 2852 wrote to memory of 3048	2852	chrome.exe	86
PID 4008 wrote to memory of 5896	4008	Setup.exe	88
PID 5896 wrote to memory of 4636	5896	msedge.exe	89
PID 5896 wrote to memory of 5244	5896	msedge.exe	90
PID 5896 wrote to memory of 3180	5896	msedge.exe	91
PID 5896 wrote to memory of 3180	5896	msedge.exe	91
PID 5896 wrote to memory of 3180	5896	msedge.exe	91
PID 5896 wrote to memory of 236	5896	msedge.exe	92
PID 5896 wrote to memory of 236	5896	msedge.exe	92
PID 5896 wrote to memory of 1464	5896	msedge.exe	94
PID 5896 wrote to memory of 1464	5896	msedge.exe	94
PID 5896 wrote to memory of 4168	5896	msedge.exe	95
PID 5896 wrote to memory of 1464	5896	msedge.exe	94
PID 5896 wrote to memory of 4168	5896	msedge.exe	95
PID 5896 wrote to memory of 4168	5896	msedge.exe	95
PID 4008 wrote to memory of 5500	4008	Setup.exe	96
PID 4008 wrote to memory of 4864	4008	Setup.exe	97
PID 4008 wrote to memory of 1360	4008	Setup.exe	98
PID 5500 wrote to memory of 5452	5500	chrome.exe	99
PID 1360 wrote to memory of 2816	1360	firefox.exe	100
PID 1360 wrote to memory of 2816	1360	firefox.exe	100
PID 4864 wrote to memory of 6120	4864	msedge.exe	101
PID 5500 wrote to memory of 3276	5500	chrome.exe	102
PID 5500 wrote to memory of 2168	5500	chrome.exe	103
PID 5500 wrote to memory of 5768	5500	chrome.exe	104
PID 5500 wrote to memory of 5768	5500	chrome.exe	104
PID 5500 wrote to memory of 2168	5500	chrome.exe	103
PID 4864 wrote to memory of 4292	4864	msedge.exe	105
PID 4864 wrote to memory of 4288	4864	msedge.exe	106
PID 4864 wrote to memory of 4288	4864	msedge.exe	106
PID 4864 wrote to memory of 4288	4864	msedge.exe	106
PID 4864 wrote to memory of 4376	4864	msedge.exe	107
PID 4864 wrote to memory of 4376	4864	msedge.exe	107
PID 4864 wrote to memory of 4456	4864	msedge.exe	108
PID 4864 wrote to memory of 5292	4864	msedge.exe	109
PID 4864 wrote to memory of 4456	4864	msedge.exe	108
PID 4864 wrote to memory of 4456	4864	msedge.exe	108
PID 4864 wrote to memory of 5292	4864	msedge.exe	109
PID 4864 wrote to memory of 5292	4864	msedge.exe	109
PID 5500 wrote to memory of 5592	5500	chrome.exe	110
PID 5500 wrote to memory of 4724	5500	chrome.exe	111
PID 5500 wrote to memory of 5592	5500	chrome.exe	110
PID 5500 wrote to memory of 4724	5500	chrome.exe	111
PID 4864 wrote to memory of 4440	4864	msedge.exe	112
PID 4864 wrote to memory of 4668	4864	msedge.exe	113
PID 4864 wrote to memory of 4440	4864	msedge.exe	112
PID 4864 wrote to memory of 4440	4864	msedge.exe	112
PID 5500 wrote to memory of 3900	5500	chrome.exe	114
PID 5500 wrote to memory of 4412	5500	chrome.exe	115
PID 5500 wrote to memory of 5760	5500	chrome.exe	116
PID 5500 wrote to memory of 3900	5500	chrome.exe	114
PID 5500 wrote to memory of 4412	5500	chrome.exe	115

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7fff83edc728,0x7fff83edc734,0x7fff83edc740
    3⤵
    PID:3296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1460,i,9657358365406289380,10129390920905243245,524288 --field-trial-handle=1964,i,1645851622672158918,5303721060366917580,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2020 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,15322827272849965272,8653667536316290890,262144 --field-trial-handle=1964,i,1645851622672158918,5303721060366917580,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1960 /prefetch:2
    3⤵
    PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,617967145104454414,6482548301904937306,524288 --field-trial-handle=1964,i,1645851622672158918,5303721060366917580,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2300 /prefetch:13
    3⤵
    PID:2544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3052,i,13003478368056577576,9901356497678821832,2097152 --field-trial-handle=1964,i,1645851622672158918,5303721060366917580,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:3528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3064,i,9714285366589928219,3653522639089608973,2097152 --field-trial-handle=1964,i,1645851622672158918,5303721060366917580,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:1708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4160,i,3292518248945463750,8646803505703294296,2097152 --field-trial-handle=1964,i,1645851622672158918,5303721060366917580,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4200 /prefetch:9
    3⤵
    PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a4,0x7fff6141c188,0x7fff6141c194,0x7fff6141c1a0
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,14825083369580764482,11431212861235373015,524288 --field-trial-handle=2240,i,11751060596284533473,15816944340104191153,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1624,i,478872109197400022,3070660100832260002,262144 --field-trial-handle=2240,i,11751060596284533473,15816944340104191153,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,2284987356758534094,2921038865973572623,524288 --field-trial-handle=2240,i,11751060596284533473,15816944340104191153,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:13
    3⤵
    PID:236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,7092477830973900609,1696610887720121902,2097152 --field-trial-handle=2240,i,11751060596284533473,15816944340104191153,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,11551614272431342068,8892505760869131227,2097152 --field-trial-handle=2240,i,11751060596284533473,15816944340104191153,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
    3⤵
    PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7fff83edc728,0x7fff83edc734,0x7fff83edc740
    3⤵
    PID:5452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2164,i,16541248130722881344,12505295184595014428,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2192 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2164,i,16541248130722881344,12505295184595014428,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:2168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171" --force-high-res-timeticks=disabled --field-trial-handle=2164,i,16541248130722881344,12505295184595014428,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2200 /prefetch:13
    3⤵
    PID:5768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2164,i,16541248130722881344,12505295184595014428,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3136 /prefetch:1
    3⤵
    PID:5592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2164,i,16541248130722881344,12505295184595014428,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:4724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2164,i,16541248130722881344,12505295184595014428,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3720 /prefetch:9
    3⤵
    PID:3900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2164,i,16541248130722881344,12505295184595014428,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3728 /prefetch:9
    3⤵
    PID:4412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2164,i,16541248130722881344,12505295184595014428,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3700 /prefetch:1
    3⤵
    PID:5760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2164,i,16541248130722881344,12505295184595014428,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4312 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=2164,i,16541248130722881344,12505295184595014428,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4392 /prefetch:1
    3⤵
    PID:3684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=2164,i,16541248130722881344,12505295184595014428,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4412 /prefetch:1
    3⤵
    PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4864240667265 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4864240667265\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7fff7490c188,0x7fff7490c194,0x7fff7490c1a0
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1924 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1848 /prefetch:2
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2384 /prefetch:13
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3844 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3848 /prefetch:9
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4020 /prefetch:1
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4548 /prefetch:9
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4908 /prefetch:9
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4528 /prefetch:9
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5012 /prefetch:9
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4976 /prefetch:9
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5048 /prefetch:9
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5092 /prefetch:9
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5132 /prefetch:9
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=1852,i,17878396683295304450,12694418889084109163,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:872
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
    3⤵
    - Checks processor information in registry
    PID:2816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 ce459de86df880461924e1517f18f06ae9904002ba67160c0e0e5e5831e9bd4c
MD5 5fd93b078e324bc6b8fe122553d56020
SHA1 8af5a12f4db3a2f45e5620f5875a0453fcb41638
SHA512 b63e9f4a68520603e2b05475e15b0bfa0b61872701bddd60f05ad692fd77e1f6ca8c78abf2cf7bac3d2edb7f67a172e1e9515c334ec143862f2273be295559d1
SSDEEP 1536:ubpP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:E++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T13D9302B9991E7979636BC296A0079CAC8CD3CCCE111455BC30C76F0E18BE392E31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
MD5 c5c86d9c5f7c32a8c4fd09d6ffda4aa8
SHA1 8d3978b900d523ba08075019d6235c1e176294cb
SHA512 e14f89cb3354fd6d7a68e1c291c8723a5bfd3d28140a150bf75ef42a2ef8212eddaed6f6db92cd69e603806f0897ef93b8761a51acd8b8db67878c4cf26ee23d
TLSH
T10AD0C040DAF02820D8046471242CF3C00E09CCA1CC43DA2124E0EF798D820C644C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 9081c80e48d6086db9fb097aa85fa97e89c25321b1c77f8b5c10a9583c971d03
MD5 c306d4e70c1627eaceb86379d8d5c47a
SHA1 202e7f9fb094df23789ff03ea5cfde549a08919a
SHA512 c06aed3b37f7316f2b118e6b64bb16032f54be6097fba5d978e261fa2f1918c815fc53407e2129b4be2a233eb5b9a203394d42e8e3508d3f42e96b2cf1bdb059
SSDEEP 192:Fvo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1DC24530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ddc914143a728f55df361fe51c490e7406a654220ef47d1c810172e8deb4ac00
MD5 7df78498a2cfe1d3aa43dfa9294e353f
SHA1 0a64152eaf9dadf72da807d3f8d73443f10f96c5
SHA512 0a9caa559a2db2ed66752f922814e426326be28370ec5b43079cdd9a35feaa085c657c1ca45adcf072ac56ba8195ce28d0c58518ed6ae4a803034b049f698213
SSDEEP 384:naiFavqMg38Nm8TUNTUlIxBO2+4Or4LJJzSOrfpYQKcMLl5kNFxEIRYV/Vw1mR56:RFayv3dwgO2ZJzHYQ0M/jRYk1m37Fc
TLSH
T1B9C25C35E854C9B7EDEA8FD9E70A7A43EEE00167D98C4AD8D6D81D1E00D719E230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 717367e800d9022dd0371ca132355b1890fbdfd4f6d6974e7fd5bb0292e3b7de
MD5 0bd47863ec2d141bb0511e00b7a536fb
SHA1 9638c2e5b8ec3813bd3cee9f0255176596278ddf
SHA512 b851a5cd2b49e7bba169e5ee63a817018938c4b94b317e37d8ffaa19ca5894b352bac9197a354bc7f5ea2c4b6336fa5ec423a9aaafdf54c0ca8a38c3519e8aec
SSDEEP 384:n7iFavqMg38Ns8TUNTUlIxBO2+4Or4LWnlOrfpYQKcMLl5YXfiN8RYV/Vw1mR57m:WFayv3XwgO2Z08YQ0Y6uRYk1m37Fc
TLSH
T1A0C25D35F854C9A7EDEA8FD9E74A7A43DEE0026BC98C4AD4DAD41D1E008719E130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

129026f1

Path C:\Users\Admin\AppData\Local\Temp\558e275c\129026f1
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e412704

Path C:\Users\Admin\AppData\Local\Temp\558e275c\1e412704
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

217cc461

Path C:\Users\Admin\AppData\Local\Temp\558e275c\217cc461
Size 20KB
SHA256 2872a4786b262e82089f297fd69ebb794c3adf4aed348cea8dcc34fc52887bb8
MD5 2318b39545a3efb6c38861930e5e4251
SHA1 52bd5ef6d0ef4c0e9528869c7b68b0cf0ff1566f
SHA512 a72bf0ac1292cba4d5c8da69348dedbf208b0fd3990549e0993e93b257823e82ed2ca2906d538ffb3306b48c0ec52106888db8fb9f3c9bce1ce477c2680c59b1
SSDEEP 48:TtLopFMatSaw/auUOt8ByonwWgnhj/AwH:9eMatUaAKnhU/AA
TLSH
T10C92FB8E5F306221C1B05B72EDD1C8262F7C211CD367669EAA5460F38D93A9FF5060AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23c3bb31

Path C:\Users\Admin\AppData\Local\Temp\558e275c\23c3bb31
Size 5.0MB
SHA256 b08d90b660d317c6d9801b49119fb22b78cff5693c7bc749434265cc6790fbcf
MD5 8c72ccd31444235900a95aa81dbd129d
SHA1 ea633febed9d771857de982e0da960816c214f8e
SHA512 ded40fe8b64d6a4abd6e48590819c0287deb8f6d359876e9dacb1658dc27d3ea4a929af42939a3fb8b50bb09540370550b4621d621630d2d2864de235a6cce46
SSDEEP 96:D4k1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ8G:M8rJQaXoMXp0VW9FxWHrQsJfGvYZE
TLSH
T13136001F7A201150D4EAA232ADE36F16283F70168B3776933DA4656D4DD0723B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45c903a5

Path C:\Users\Admin\AppData\Local\Temp\558e275c\45c903a5
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5debb741

Path C:\Users\Admin\AppData\Local\Temp\558e275c\5debb741
Size 20KB
SHA256 fec96d88caeaa34dfb62b3fe6bd06838d5abd399303b23c84385b9b97f62caef
MD5 a38236bee795ba378a8f6db56f59b5d8
SHA1 33cb26b3cc126482e635e535832e5534bf0b9318
SHA512 7f60627c984102f1f9ae0fa6a4fd56daec049f40e28e8f72646d57d827e1b9e0871801482afd8d129d292e3015eedba44843cdfc4d8e9d5abcd89bee2c91328a
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBnwd5DL9Yg10AphgRjgMD8j:TeW9aw/aHLopFMavU1iBwHDyQv+C
TLSH
T1EC92EF8F1F303610C4B4873ADAC1485B2E7C112DD3676699FE5024B2CDD25ABF1064B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

939c877a

Path C:\Users\Admin\AppData\Local\Temp\558e275c\939c877a
Size 138KB
SHA256 12240c8078b5b2a3945512bbdc52478eb1d2d7599d93120a66c3547f3b7a5a3f
MD5 368551e4837e343c48c8e8ac918551b2
SHA1 10130d93e389e2250acf0144eec52bd1e3580bf9
SHA512 14df270d752b80b551470c606b17ea382463d815f9d86833372718770065422b1becaf1c98ab938b6669a0c9501f8cd085026bfe690f654ac1a7848cc974e2bb
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OrveVumw1nk:FnbZeMrv/hGtrHnk
TLSH
T11DD3974B3A743002EDE5DA722CE0557B5E3C716D4F11A5D428B620688EF2963B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ff9401a

Path C:\Users\Admin\AppData\Local\Temp\558e275c\9ff9401a
Size 288KB
SHA256 ca7b4aa9904d40ff9b31819a1600c9b9e706a4a540ea466cb57d8cafd7dfc261
MD5 9fc275b4f0fe8ed7d66afbad921fe15f
SHA1 caa66f4b21cb044940afeba283d56f97ea21f286
SHA512 b7483756e57c706b1bc3f3aa1bc309a67b4a3b3697c210858c25fd6ba95bf5842a8a6f94ac0e242a4ce4b62bfbec6f7973a3cde66c0b74f2c73a6dc9ccfdd535
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vi9+CI8Dq:f1zkVmvQhyn+Zoz67/9T9q
TLSH
T12454CA46ED85B40AE71E6830C9444DF27A41AB0447815E2FCFFC1E3E1E7164DBAAD5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adeb8d39

Path C:\Users\Admin\AppData\Local\Temp\558e275c\adeb8d39
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9f72330

Path C:\Users\Admin\AppData\Local\Temp\558e275c\d9f72330
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daacf5c2

Path C:\Users\Admin\AppData\Local\Temp\558e275c\daacf5c2
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5500240667171\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4864240667265\Crashpad\settings.dat
Size 280B
SHA256 d6cc7c4e64bda3f9bd1e4c937286c885b53709f90ab0b478bd080917779682c9
MD5 4e6f5c1d821526a48f4b137a90f66e6c
SHA1 f5b3168afe0b1900e442e347753760a1e7612d17
SHA512 31a987c5088b696430ed4fc20cb46a585c4345f050b7dfbee45d10f3afd74d9f7ff6d10d1a88ccbbe66e822cd8c3626b9a9c7685a7d5fa44d7d10a0d77025574
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4864240667265\Crashpad\settings.dat
Size 280B
SHA256 1825ccb6253df397a628a4c8ad0aade9d7cee27cfa67bac4913fab09f78ea4df
MD5 c7eb43bcdcefbff5a12f2cc1239dfa0c
SHA1 6c0ad4e7bb1440c1f826c74687f284fbe1937b12
SHA512 3ecfd0cfbd88c6596296642037029c3acded871f988407464a4fbf59d96dd49ea84838cc639613dbd6ae6522366982ac23541d2cdbbe91f38d2807b977fbb4a6
TLSH
T109D022F0B3000300C3A233B80FB0EB0020B0FE00C00082C0802CC83C2CA20C80220F8E
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4864240667265\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4864240667265\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4864240667265\Local State
Size 3KB
SHA256 d999004e86c6745ccce7bb2c8c3c20f6d5b9beab16313d42155ef869105b1f62
MD5 00e95d7b736f691584b60d123a3ab7a9
SHA1 78e2244a897640427cad4741909e6178990afe57
SHA512 d0deaee517568478cc1bc42c41d5afb40e3a92523b975be689b88933629843f197fc7e34348c6648bc172075585396be4d51b4824a0cbbc50335db63b5eaa7b4
TLSH
T17781C63334689D7B5FE15A84B44A35234FB4E623EB597F9461CC270C05EF5A88309C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4864240667265\Local State
Size 4KB
SHA256 b19423ef88d9ca44d50caf2221e404b714c8037aaec01e6106b13696c80a884f
MD5 b1f496237ba2c26ee66ef4149e3b409c
SHA1 0ed19da50772370d62e3749c652eff27b88e589c
SHA512 a0e8f8560a2fb7b69ac5651c1a5e7a09b5cce2ece401c6390b11610686340c66e7a5a7fa7862b83be072a7c7cb3cf0a0c418f881bbeb72d6e3ae25a9284f59ed
SSDEEP 96:jqGNkSQsFfJu0Ygs58Frh/cInURcDotovGh0wDxBD6vKbffp0eUcTTSDS4SYSuSN:mGNWKu0docDUwQhHBfp1Tb
TLSH
T192A1D73334B8DC7B1EE15A84B48636136FA4A633E6897F99D5DC2B0C05EF6984305C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe584dae.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4864240667265\Local State~RFe584dae.TMP
Size 1KB
SHA256 b2474470a8cef46ce4de098163b0b9b539adbbe8786dd3395ec141abf5ac1902
MD5 41e340761f175d9079f7002aabaede55
SHA1 5cc359b1ecf4b1eb68f657f677f7994b7d1b7806
SHA512 8a060ba1bc927ce3a1bc7964f27ddaecbb67b7fbb4ae9e521a48f7024a5f9e1331ff3f2123fc0f79f7d8b789a86f7138a3cfe820e240d2fd81b6cc9e7bd3c535
TLSH
T1523195B074AC1CFBBBE05985B64976232F386931D2926A8856DD0A1C25E7ADC030DC3B
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4008-121-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-572-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-352-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-356-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-357-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-358-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-359-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-360-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-361-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-304-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-223-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-222-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-169-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-0-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-97-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-51-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-20-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-19-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-17-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-18-0x000001E27DBB0000-0x000001E27DBE1000-memory.dmp

Download

memory/4008-16-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-15-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-14-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-12-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-11-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-520-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-10-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-9-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-8-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-567-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-566-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-571-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-565-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-578-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-577-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-353-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-576-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-574-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-581-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-583-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-585-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-588-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-587-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-586-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-580-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-589-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-573-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-7-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-6-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-590-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-5-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-4-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-3-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-2-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-1-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-546-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-592-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-593-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-594-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-595-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-597-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-596-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-598-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-599-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-600-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-601-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-602-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-603-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/4008-605-0x0000000570000000-0x0000000570532000-memory.dmp

Download