91cdaf150a2602b1db4bd00fcabcb557964cf90feadb75540741ec713f10bcb4

Analysis

user interaction
yes
max time kernel
328s
max time network
328s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/05/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mpclient.dll
Size 2.7MB
Sample260511-mvcmcsa12p
SHA256 91cdaf150a2602b1db4bd00fcabcb557964cf90feadb75540741ec713f10bcb4
MD5 b253bea931c5050b59296d824b5f4e73
SHA1 2b1926bf3a0357f1454346b6828386eeb12b8487
SHA512 2c0d6493391ae4104eb28ebb524454fba4e20a3b692b45c3d238dacf2bfe1463949d95fae4e6d65aaa53871bf55a36d05ffc92172c778b4471a99147188fba53
SSDEEP 49152:srTuDkbWAHaluLPJsI3d7MgvbF+vP3Epnsm:snyKmuLPJsk7XF+X2sm
TLSH
T1EFD58C47BC9188BED09A733288F222957739B8480B3277D33E6169763E77BD05939718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 5064 created 440	5064	rundll32.exe	91
PID 5064 created 440	5064	rundll32.exe	91
PID 5064 created 440	5064	rundll32.exe	91
PID 5064 created 2060	5064	rundll32.exe	100
PID 5064 created 2060	5064	rundll32.exe	100
PID 5064 created 2060	5064	rundll32.exe	100

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	5064	rundll32.exe
13	5064	rundll32.exe
28	5064	rundll32.exe
38	5064	rundll32.exe
49	5064	rundll32.exe
53	5064	rundll32.exe
91	5064	rundll32.exe
92	5064	rundll32.exe
93	5064	rundll32.exe
94	5064	rundll32.exe
101	5064	rundll32.exe
114	5064	rundll32.exe
115	5064	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5064	rundll32.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1768	chrome.exe
2996	chrome.exe
4804	msedge.exe
5392	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229701249565053"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-262299150-3324607021-1566776428-1000\{F8A3D089-B3E2-4F25-9CCA-E1D1940DA803}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
5064	rundll32.exe
440	chrome.exe
440	chrome.exe
5064	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
440	chrome.exe
440	chrome.exe
440	chrome.exe
2060	msedge.exe
2060	msedge.exe
3892	msedge.exe
3892	msedge.exe
4520	chrome.exe
4520	chrome.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
3892	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	rundll32.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	440	chrome.exe
Token: SeCreatePagefilePrivilege	440	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
440	chrome.exe
2060	msedge.exe
3892	msedge.exe
4520	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 440	5064	rundll32.exe	91
PID 440 wrote to memory of 1224	440	chrome.exe	92
PID 440 wrote to memory of 2996	440	chrome.exe	93
PID 440 wrote to memory of 784	440	chrome.exe	94
PID 440 wrote to memory of 784	440	chrome.exe	94
PID 440 wrote to memory of 5644	440	chrome.exe	95
PID 440 wrote to memory of 5644	440	chrome.exe	95
PID 440 wrote to memory of 376	440	chrome.exe	96
PID 440 wrote to memory of 2916	440	chrome.exe	97
PID 440 wrote to memory of 376	440	chrome.exe	96
PID 440 wrote to memory of 2916	440	chrome.exe	97
PID 440 wrote to memory of 5788	440	chrome.exe	99
PID 440 wrote to memory of 5788	440	chrome.exe	99
PID 5064 wrote to memory of 2060	5064	rundll32.exe	100
PID 2060 wrote to memory of 2852	2060	msedge.exe	101
PID 2060 wrote to memory of 6052	2060	msedge.exe	103
PID 2060 wrote to memory of 4804	2060	msedge.exe	104
PID 2060 wrote to memory of 6052	2060	msedge.exe	103
PID 2060 wrote to memory of 6052	2060	msedge.exe	103
PID 2060 wrote to memory of 4620	2060	msedge.exe	105
PID 2060 wrote to memory of 4620	2060	msedge.exe	105
PID 2060 wrote to memory of 4300	2060	msedge.exe	106
PID 2060 wrote to memory of 4300	2060	msedge.exe	106
PID 2060 wrote to memory of 4300	2060	msedge.exe	106
PID 2060 wrote to memory of 2552	2060	msedge.exe	107
PID 2060 wrote to memory of 2552	2060	msedge.exe	107
PID 2060 wrote to memory of 2552	2060	msedge.exe	107
PID 2060 wrote to memory of 3924	2060	msedge.exe	110
PID 2060 wrote to memory of 4020	2060	msedge.exe	111
PID 2060 wrote to memory of 3924	2060	msedge.exe	110
PID 2060 wrote to memory of 4020	2060	msedge.exe	111
PID 2060 wrote to memory of 3764	2060	msedge.exe	113
PID 5064 wrote to memory of 4520	5064	rundll32.exe	117
PID 5064 wrote to memory of 3892	5064	rundll32.exe	118
PID 5064 wrote to memory of 2908	5064	rundll32.exe	119
PID 2908 wrote to memory of 5740	2908	firefox.exe	120
PID 2908 wrote to memory of 5740	2908	firefox.exe	120
PID 4520 wrote to memory of 1408	4520	chrome.exe	121
PID 3892 wrote to memory of 4460	3892	msedge.exe	122
PID 3892 wrote to memory of 5392	3892	msedge.exe	123
PID 3892 wrote to memory of 4340	3892	msedge.exe	124
PID 3892 wrote to memory of 4340	3892	msedge.exe	124
PID 3892 wrote to memory of 4340	3892	msedge.exe	124
PID 3892 wrote to memory of 5340	3892	msedge.exe	125
PID 3892 wrote to memory of 5340	3892	msedge.exe	125
PID 4520 wrote to memory of 1768	4520	chrome.exe	126
PID 4520 wrote to memory of 1896	4520	chrome.exe	127
PID 4520 wrote to memory of 1896	4520	chrome.exe	127
PID 3892 wrote to memory of 5432	3892	msedge.exe	128
PID 3892 wrote to memory of 3460	3892	msedge.exe	129
PID 3892 wrote to memory of 5432	3892	msedge.exe	128
PID 3892 wrote to memory of 5432	3892	msedge.exe	128
PID 3892 wrote to memory of 3460	3892	msedge.exe	129
PID 3892 wrote to memory of 3460	3892	msedge.exe	129
PID 4520 wrote to memory of 6132	4520	chrome.exe	130
PID 4520 wrote to memory of 5212	4520	chrome.exe	131
PID 4520 wrote to memory of 6132	4520	chrome.exe	130
PID 4520 wrote to memory of 5212	4520	chrome.exe	131
PID 4520 wrote to memory of 5436	4520	chrome.exe	132
PID 4520 wrote to memory of 5436	4520	chrome.exe	132
PID 3892 wrote to memory of 1540	3892	msedge.exe	133
PID 3892 wrote to memory of 4148	3892	msedge.exe	134
PID 3892 wrote to memory of 3080	3892	msedge.exe	135
PID 3892 wrote to memory of 1540	3892	msedge.exe	133

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mpclient.dll,#1
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Badlisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7fff8fd2c728,0x7fff8fd2c734,0x7fff8fd2c740
    3⤵
    PID:1224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1672,i,4784725514017505891,18232932484246939662,524288 --field-trial-handle=2076,i,17719941381224162844,656004579961337568,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1776,i,12950633713317542461,7910414984997524286,262144 --field-trial-handle=2076,i,17719941381224162844,656004579961337568,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2072 /prefetch:2
    3⤵
    PID:784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,15798948533092235706,8888890317996496447,524288 --field-trial-handle=2076,i,17719941381224162844,656004579961337568,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2504 /prefetch:8
    3⤵
    PID:5644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3096,i,5552202353819591476,13807029681862710951,2097152 --field-trial-handle=2076,i,17719941381224162844,656004579961337568,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3108,i,3309355957115717192,12771851572820652915,2097152 --field-trial-handle=2076,i,17719941381224162844,656004579961337568,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:2916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4180,i,5047097248324771484,15335163960165846275,2097152 --field-trial-handle=2076,i,17719941381224162844,656004579961337568,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4192 /prefetch:2
    3⤵
    PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a4,0x7fff8c5ec188,0x7fff8c5ec194,0x7fff8c5ec1a0
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1768,i,6293154384850100968,7084399711055008900,262144 --field-trial-handle=2376,i,18219220600846143922,14400181296930754624,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,12529835509389536481,8617094350098929871,524288 --field-trial-handle=2376,i,18219220600846143922,14400181296930754624,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,15363316512141272808,1403698962065806675,524288 --field-trial-handle=2376,i,18219220600846143922,14400181296930754624,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3348,i,8813174221978652348,1879756884295311868,2097152 --field-trial-handle=2376,i,18219220600846143922,14400181296930754624,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,15020205200174869385,3969432920926013078,2097152 --field-trial-handle=2376,i,18219220600846143922,14400181296930754624,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,6163006790703395507,11855655075212484533,524288 --field-trial-handle=2376,i,18219220600846143922,14400181296930754624,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
    3⤵
    PID:3924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,5016638302283709213,7395023191004649854,524288 --field-trial-handle=2376,i,18219220600846143922,14400181296930754624,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,7530479054457566311,2043000287015929908,524288 --field-trial-handle=2376,i,18219220600846143922,14400181296930754624,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,7530479054457566311,2043000287015929908,524288 --field-trial-handle=2376,i,18219220600846143922,14400181296930754624,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x224,0x228,0x22c,0x21c,0x230,0x7fff9106c728,0x7fff9106c734,0x7fff9106c740
    3⤵
    PID:1408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2052,i,8269249617710142397,12100952983641268996,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2092 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2052,i,8269249617710142397,12100952983641268996,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2028 /prefetch:2
    3⤵
    PID:1896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156" --force-high-res-timeticks=disabled --field-trial-handle=2052,i,8269249617710142397,12100952983641268996,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:6132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2052,i,8269249617710142397,12100952983641268996,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2932 /prefetch:1
    3⤵
    PID:5212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2052,i,8269249617710142397,12100952983641268996,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2952 /prefetch:1
    3⤵
    PID:5436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2052,i,8269249617710142397,12100952983641268996,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:1076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2052,i,8269249617710142397,12100952983641268996,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3508 /prefetch:2
    3⤵
    PID:2944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2052,i,8269249617710142397,12100952983641268996,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3532 /prefetch:2
    3⤵
    PID:5408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2052,i,8269249617710142397,12100952983641268996,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4276 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=2052,i,8269249617710142397,12100952983641268996,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=2052,i,8269249617710142397,12100952983641268996,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4388 /prefetch:2
    3⤵
    PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3892240778218 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3892240778218\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x260,0x264,0x238,0x304,0x7fff901ac188,0x7fff901ac194,0x7fff901ac1a0
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2432 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2400 /prefetch:2
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2448 /prefetch:8
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3692 /prefetch:1
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3696 /prefetch:2
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3788 /prefetch:1
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4156 /prefetch:2
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4224 /prefetch:2
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4272 /prefetch:1
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4492 /prefetch:2
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5116 /prefetch:2
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5048 /prefetch:2
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5056 /prefetch:2
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5596 /prefetch:2
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5752 /prefetch:2
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2404,i,3908574681052563926,16400077693451545751,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:4500
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
    3⤵
    - Checks processor information in registry
    PID:5740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 44f0f487e7f5f360c5e1407ef23034699a5ad42bdfda3749da6e883a6883922a
MD5 bbfcb063291ee8015083aa63d72edaaf
SHA1 b4f58b3c683cde8d3ff23f8b3dc3cac8dddc2e5c
SHA512 99b0afa7fa67d7072eb57ad230d6cb1e09a9557f4f6648ef858b148470c5612615ad3c94e6be3df320bc70f4a254ebd0c860c467ad91171ba50b5f3e6e670f08
SSDEEP 1536:P0KWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPx:8DlBshIZZwINsIrS2uJBLpAkLQqx
TLSH
T1939302B73AA6EC37C49C4202B93C2A4D7EC8B5E9C829B57658CA677F41F2BF55103502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ce3de864fc029de1185f15a333c36ccc857bab064d704c1c9cb74f2d49559c6
MD5 95e4fa06728773c204126766fa6a3f91
SHA1 b2b2ff6dd17d9d1fca4c1aa1d226d00b195749be
SHA512 11564019829fb23fd1b38faa2fb3c3298ba02394920b54be1169d3ca923ae73304fcdfa9ca88adaeddf4fa314022ecd93085a2ea4ef7973e86e12e5d7e562c19
TLSH
T10ED0806C17B17C31E099967015C57B05656DD46B5D474B15A4F2383C2C530409E560C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f560f5bb752ddd763833155d1ff6605d312db8ccde2a6ab240a3b101d9d8b90d
MD5 12d5b2e4cc6efa0abac0ff459762128d
SHA1 8782282210a28adc108c70d0c52834927c2ec6b6
SHA512 167df96788106eedbcdbcbe9d902f16bf44205caacf46adb23644daf93de912e609a0513be2b7d40a7c84e2ed7e15d9e403712cce5256edeedf75c34ade5c6f5
SSDEEP 96:KY5OKiwSKWkYKR2yCyMKLC4NiKWU6ezWKYMboAKt+6Ob2KwMnZWKSQiOzqKUEzz+:0BKLfyFpHbxpBJhZf4f7Kn3uJHs
TLSH
T173B20610313A42813A7EB9CA82D5B41E52C334B77059E92B7BB944A64F67E21CDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b36e43232843fb1ca0a21c3344b07b38856ebf257f21ab46a9d549b0c3ebb3d
MD5 17f746a1e16b815f29f47fbfe1bd0e04
SHA1 70444643c16c033c890d0cf51b379e21ca230a63
SHA512 00c05a2bc0221ca19f81599bf311a4bab64f83d9dff7e36467b2313307a50a35175b7c5808b3b4c775c9c7c4ab148ded42c222ccd602d3db07d8cbc621cff13c
SSDEEP 192:P+x3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c6e8d0cf9c50af5191014f044253d32c7547da2db1d677a7f0e5532c552843c6
MD5 119e8154f74cbda6816131b9dc11109e
SHA1 23c08a5aea4934dbc4819e696d011170cf9f798c
SHA512 48d260bb09c5b86b814427e5571631a1feb816ee2bb48953eb9e84bc154a203e6214e16159c58845e6320871f405956c04d06d329a39a3997d18041df5577511
SSDEEP 384:npSiFavqMg3sNs8TUNTUlImkrbPNm2cl4fFYMPQ7pGqPT/RYV/Vw1mRKrN1k+5vR:pZFayv3bwg7vYKQ7pNPT/RYk1mgh
TLSH
T141C25C36EC94DD6BEDE68FD9EB0A3603DEE04567DA8C8AC4D6D81E0D009719E530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7716999d2cd44bfb286e7539913479867e4d90748b88a9eb7c7a884b6bb5ad39
MD5 4472ea3591cfaf96adcb5fb87dbabb27
SHA1 be3fd682feef0f6d70cac7278a7de14122660b3e
SHA512 6c793fc31a074616b235d28d1d0e313b8cd165dd436efb0f4ce8e9d780860b0fa67bf8dd4a2a8790af2f6a115e66ad5f098369b4899810175709bd7d05f454a0
SSDEEP 384:ncSiFavqMg3sNB8TUNTUlImkrbPNSCel4fFYMPQ7pGqTbTXRYV/Vw1mRKrN1k+5p:cZFayv3Swg5lYKQ7pNTbTXRYk1mgh
TLSH
T17CC26C76E864CDABEDEB8FD5EB0A3603DEE04167CA8C8AD4D5D81E0D009719E530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1c3c102381b9d1014591290acdb5cfe80085b6507f5d0b6867f483ac55168a88
MD5 c6818b53f4c6c527f5151f97e14d4e85
SHA1 90dd66d1e831782cea5ca884323c6847d17723b0
SHA512 1cd012b43959bb717feae32aa98fa31c40054bb52c22406c03f355165c03adf32ad0774a48280b35912b1556c76064427ccc3d84300d93a752a8f70f275d7887
TLSH
T14D410C58B6EA1148B3776E56BFF7A46E487AB8731E0AD55D00110E0F0623B00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 40903e9a949974445d9f65396c1f4aab1ca95968c2df5fb6a10841f22aef58d2
MD5 01e99d343b6e01a94d4a90e897b8704a
SHA1 cbe8af65584858cda471014a9c0d3d3bb27004bb
SHA512 7abf5e18049ecfdada975d9dda6fc2b6b6557872537e7ff5c542c2071d49a2ce102b74bac01544de2cf48c5e385f5df2d330e19c4718b0f07978a58fa5953efd
TLSH
T161513C586AEE1158B3777F565BF2752E447F7D232E47949D00110E4F4A62B40C8A1B3B
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4520240778156\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3892240778218\Crashpad\settings.dat
Size 280B
SHA256 82674ba1c66e7b334beebad1392666486438fd2bd92a1d00da41af9536824447
MD5 f6b047768f198c2d2353bbcbac1d8e79
SHA1 fba4d394c20431dd699513199e88b73fbc490714
SHA512 c10cf0a64b6088686348416ecdc58f465736090a7f120a3670f183176a345d85667e69c29346cdb35a58d307c41325da09fde0e675e351ef0b81111399a376e4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3892240778218\Crashpad\settings.dat
Size 280B
SHA256 f954477140be81d1716dc60d1a5a3e919da51ae05ca6873ee23308437de60c7d
MD5 d01306d1a790a3f2ba3a1124830ccda4
SHA1 95a5bc062c5ddff3dfccdeef14916d99d9a40081
SHA512 b80bc6ea82500578385e3a2d49ca67f96b6ccf4c95ec98c509333c5dc7b53efd3347213f16561c20081338626e44bd03f6f53f29c4995385e53b272126a3988f
TLSH
T1D8D024137374C704CC154DF10011031C037CD50103C3D301101D4403374F4700113440
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3892240778218\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3892240778218\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3892240778218\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3892240778218\Local State
Size 3KB
SHA256 008dd8d6d2667ed46d1684597b076999ef5eb107ec04026c6b4c885e24d1cc7b
MD5 4aa0236bcb87b1fef94888152765baf5
SHA1 9713cba319e8c1f777430b2660bd16b688868d5e
SHA512 8614c1de959b9b57d3577eb65616f2a8372107ac1c3656f2ed95f057039b7683aab2928f68cc9364a77313e9324f542486b6ec1eb411685c18b80e316b3c32b2
TLSH
T11481A5737824EC774DE29A85B54A36134E74E227EB65BB9462DC230C12FF56C830AC23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3892240778218\Local State
Size 4KB
SHA256 d7e741ff7e027325c5c0ac0aad18ac9f176d91c10ff2493bf674efc64b64e621
MD5 97bd6ba5e6cf57cae16229dc340a7b03
SHA1 ab3cdc77014b7c96050bab0acf64231a93b5a3d7
SHA512 0b8c94f765402e44716327686452bf80e01aa0d7fcc1c03667c421275bb498931b3b830deba16c80d207707c112ae5611aa29cc952e2234cc5e1815f29104308
SSDEEP 96:EoqGNk6QsFfaGsHrxZ58Frh/cInURcDotovOAmDKBeIAtvQDgBfJ0eUccSDS4SYH:4GNyLrKocDUwkaiqUBfJ1XH
TLSH
T143A1A7737874EC7B4DE29945B48A36026EB4A237E695BFD8D6DC1B0C12EF6984306C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59fdde.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge3892240778218\Local State~RFe59fdde.TMP
Size 1KB
SHA256 d43ab7aae6e70b9aa736aed608038a917ec7595308e6d348e673430168c19ed3
MD5 9efd4b2b650027662472b8e87bab4a7c
SHA1 3e192b0665ec86ef73f50cc97b6297f04b855dc4
SHA512 9b9728fcce55e19e38e9089b5c8afcbb113a9db1fd4709a23f6bce179deae1fc13072553385bba65c0f9e602aa502598046a3037ba1c3ad66518fdd3f982d117
TLSH
T1423197B174786CB7A8A24A46B28F7B931E7420359262AA8C52DD060E32E758C1316C37
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\luq7t40t.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3764-450-0x000001F55A3E0000-0x000001F55A435000-memory.dmp

Download

memory/4696-41-0x000001E0D2B20000-0x000001E0D2B75000-memory.dmp

Download

memory/5064-754-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-772-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-331-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-59-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-0-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-26-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-25-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-445-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-444-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-448-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-449-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-24-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-451-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-454-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-456-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-455-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-23-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-22-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-21-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-20-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-19-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-18-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-17-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-16-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-15-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-14-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-6-0x00007FFF9CA20000-0x00007FFF9CD02000-memory.dmp

Download

memory/5064-5-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-4-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-3-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-236-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-2-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-796-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-1-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-788-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-789-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-787-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-794-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-799-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-797-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-116-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-800-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-805-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-803-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-806-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-809-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-808-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-810-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-802-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-811-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-812-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-813-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-814-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-815-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-816-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-817-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-818-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-819-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-820-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-821-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-822-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-823-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-824-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/5064-827-0x0000000570000000-0x0000000570532000-memory.dmp

Download