5a1fbefb0d2763f48f64cb285c4e94aa8993edb63846018aefb9845b13758fd6

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe
Size 2.9MB
Sample260810-bapkmsdc75
SHA256 5a1fbefb0d2763f48f64cb285c4e94aa8993edb63846018aefb9845b13758fd6
MD5 5a2918593f175a4dcba3b497c8b33e5b
SHA1 88b62a40231c14859b2b4c2b1c6df2d5ca341e86
SHA512 41c2183bd1d65f993121caadf265cc5fbe4918ac612dda697b40f5174ad7e0a7a62a744919e33c75e80d9b3fb02ce62437d61bc53193bd1cecfcfeceb5d98147
SSDEEP 24576:mohghzZNlurHLQI910B+kDeldb/VNvvRDcuwW:mm2QUI91G+kGzLr
TLSH
T1DAE5D71AF6B650D5D1BAC038D553522EFC7134A5833C97EB92818E4A5B60BF8EE3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5176_180884080\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5176_1073494709\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5176_914759958\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5176_914759958\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5176_1651242105\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5176_1651242105\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5176_1073494709\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5176_1651242105\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5176_1651242105\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3520	chrome.exe
3940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307970124144519"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{CB41750A-4869-42FD-BCEF-13DE5CE4C071}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3260	2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe
3260	2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe
3196	chrome.exe
3196	chrome.exe
3260	2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe
3260	2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe
3260	2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe
3260	2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe
3196	chrome.exe
3196	chrome.exe
5176	msedge.exe
5176	msedge.exe
3196	chrome.exe
3196	chrome.exe
5176	msedge.exe
5176	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe
Token: SeShutdownPrivilege	3196	chrome.exe
Token: SeCreatePagefilePrivilege	3196	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3196	chrome.exe
5176	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 3196	3260	2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe	90
PID 3196 wrote to memory of 6044	3196	chrome.exe	91
PID 3196 wrote to memory of 1356	3196	chrome.exe	92
PID 3196 wrote to memory of 3520	3196	chrome.exe	93
PID 3196 wrote to memory of 5892	3196	chrome.exe	94
PID 3196 wrote to memory of 3012	3196	chrome.exe	95
PID 3196 wrote to memory of 5876	3196	chrome.exe	96
PID 3196 wrote to memory of 2148	3196	chrome.exe	97
PID 3196 wrote to memory of 4612	3196	chrome.exe	98
PID 3196 wrote to memory of 1112	3196	chrome.exe	99
PID 3196 wrote to memory of 5076	3196	chrome.exe	100
PID 3196 wrote to memory of 1856	3196	chrome.exe	101
PID 3196 wrote to memory of 5804	3196	chrome.exe	102
PID 3260 wrote to memory of 5176	3260	2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe	105
PID 5176 wrote to memory of 1652	5176	msedge.exe	106
PID 5176 wrote to memory of 4500	5176	msedge.exe	107
PID 5176 wrote to memory of 3940	5176	msedge.exe	108
PID 5176 wrote to memory of 3624	5176	msedge.exe	109
PID 5176 wrote to memory of 5872	5176	msedge.exe	110
PID 5176 wrote to memory of 1744	5176	msedge.exe	111
PID 5176 wrote to memory of 4448	5176	msedge.exe	112
PID 5176 wrote to memory of 6056	5176	msedge.exe	113
PID 5176 wrote to memory of 4864	5176	msedge.exe	114
PID 5176 wrote to memory of 5844	5176	msedge.exe	115
PID 5176 wrote to memory of 4740	5176	msedge.exe	116
PID 5176 wrote to memory of 1624	5176	msedge.exe	117
PID 5176 wrote to memory of 2096	5176	msedge.exe	118
PID 5176 wrote to memory of 3156	5176	msedge.exe	119
PID 5176 wrote to memory of 4720	5176	msedge.exe	120
PID 5176 wrote to memory of 2484	5176	msedge.exe	121
PID 5176 wrote to memory of 4800	5176	msedge.exe	122
PID 5176 wrote to memory of 4528	5176	msedge.exe	123
PID 5176 wrote to memory of 4396	5176	msedge.exe	124
PID 5176 wrote to memory of 3232	5176	msedge.exe	125
PID 5176 wrote to memory of 6520	5176	msedge.exe	126
PID 5176 wrote to memory of 6528	5176	msedge.exe	127
PID 5176 wrote to memory of 6944	5176	msedge.exe	129
PID 3196 wrote to memory of 4768	3196	chrome.exe	131
PID 3196 wrote to memory of 2488	3196	chrome.exe	132
PID 3196 wrote to memory of 5768	3196	chrome.exe	133
PID 5176 wrote to memory of 3032	5176	msedge.exe	134
PID 5176 wrote to memory of 3436	5176	msedge.exe	135
PID 5176 wrote to memory of 6004	5176	msedge.exe	136
PID 5176 wrote to memory of 2432	5176	msedge.exe	139
PID 5176 wrote to memory of 2512	5176	msedge.exe	140
PID 5176 wrote to memory of 7148	5176	msedge.exe	141
PID 5176 wrote to memory of 5572	5176	msedge.exe	142

C:\Users\Admin\AppData\Local\Temp\2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5a2918593f175a4dcba3b497c8b33e5b_glassworm_icedid_njrat.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-default-apps --disable-extensions --headless --disable-gpu --no-sandbox --disable-dev-shm-usage
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7fff2db8c728,0x7fff2db8c734,0x7fff2db8c740
    3⤵
    PID:6044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1812 /prefetch:2
    3⤵
    PID:1356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:13
    3⤵
    PID:5892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:2148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:9
    3⤵
    PID:4612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:9
    3⤵
    PID:1112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    PID:5076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:9
    3⤵
    PID:1856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
    3⤵
    PID:5804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:4768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
    3⤵
    PID:2488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171" --force-high-res-timeticks=disabled --field-trial-handle=1816,i,17139577107858292394,5900061376952793827,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-default-apps --disable-extensions --headless --disable-gpu --no-sandbox --disable-dev-shm-usage
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x228,0x258,0x25c,0x224,0x264,0x7fff208ec188,0x7fff208ec194,0x7fff208ec1a0
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:9
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:9
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:9
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:9
    3⤵
    PID:3156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:9
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:9
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:9
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
    3⤵
    PID:6520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:6528
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
    3⤵
    PID:6932
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
    3⤵
    PID:6944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
    3⤵
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
    3⤵
    PID:7148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2344,i,10162181237090960067,3925462231516473198,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
    3⤵
    PID:5572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 dc01b12ccbee203058214b146d6bfa52853845bcc2d8e37eaf09bb2d9a3aa5f9
MD5 ee54e310416cbece99f80c5bd7ed8464
SHA1 61d1b9a5f138649a3c3a5438bd9018765ba303c2
SHA512 15b7d1adc499999b0d685958c8fa8cccaf5aba051c3ede026971df9b6080d0de927eb137b407fbeb731ac62806424c281608db10e01495703a587417740b2f38
TLSH
T152A0021012C40C21EB4403B63C56094523104DFA6122535392D0388598A36E15106843
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cd49.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\Code Cache\js\index-dir\the-real-index~RFe59cd49.TMP
Size 48B
SHA256 b498ddc8ea0d04e261c27ec845dba8a7c6fee7f921ec0903e7b571899225515f
MD5 0e6c4bd99eeb72e24d63a12dd970043f
SHA1 b6fe504d2e2e3c6963ea16cb66879083b1f9e2c9
SHA512 c4957369e67b55d925b4159dbc7d5221095666373ae516e0c3e4090fe1e8552664d5f0c3b5d6ccae977fb9670ff68267b174ffdb3d04500d0c14476aecd30cea
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

227a2309-3205-482b-9637-72c48c587bef.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\Network\227a2309-3205-482b-9637-72c48c587bef.tmp
Size 827B
SHA256 397425fac662bc6f4f68fb97738de31d20150d4348720b41e4c1e4c46793cf60
MD5 5de1c92b47bf6b162bb4a4f61d587ac8
SHA1 ea0b2a950e7945439aeac7433c4f5c0e8757ffd5
SHA512 bfa8d96a7fcd1cc36072dfe0b47f8105b326044fd3cb96cb025c9cba9e3385d2e5afcbacffca18b78c49de54bded88ae47efcd17d504e50a2bd1f65abec74387
TLSH
T131018EF7C7D4857D895502F497156A1BCE2A0608432D3C66C8D8BF5F93E2871911459F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\Preferences
Size 8KB
SHA256 c2c40410b817a6cf47e61b3d1d4ed010459a0a30e8fe8d07d835debf7c9d4a90
MD5 c8199eb6e323cb8ab0f9cad271c70bd5
SHA1 9a9f60256724a8543e04b7728d7fe6dbfa11a2ca
SHA512 4a332a704890636263f9c05dea6b39139ac87ced68bff9e1ff617649bfcbdefaec161b1c384bfdb5aede5d10bbcb48af17982127d52ae26c5eba10a425c38758
SSDEEP 192:zR3+Hv7YCPRpxLXsb+WN4csQmiyIsnAUgY:zR3+PdXFXw4cpPY
TLSH
T171029429AC14A63B9CD6E65DF9257F52E2F5203135A42D08D7FCC92C28EB6CD222B117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 fa9c2c9ca4e52095eb2adec2f7888cb77f561f175e7b7b49f512a642dab3cd74
MD5 8a8a8948b8ca488f7bc7d2ddcf17e626
SHA1 5ccd942d71fa16b840ad08adaa94181c2cd16aef
SHA512 3d0ab13361cb7a9cc177409659145565da348e3f38910735bad3ac7374e24090ffd3d49105071dbe361673bcf3ff357312c9689c8c220bb01a1fdcf06d2879da
TLSH
T1E4B011028003082AC08083B0A880008830A2EE3BC2222282A2E00A8AC8032A00322C20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cea1.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59cea1.TMP
Size 72B
SHA256 2d0ee3572242046e2ad3a85e594ca329de768a009f58205591349530e62ee3e5
MD5 0abdb81dadce9ca244672a40ad653903
SHA1 78d897aabe5f7452d3c4eaaa7e3a172cc568fac1
SHA512 0f35250762da5f4b7c1ce52c02d3f4f04672d050679e42ef2f3ce107df5c47ef64445601cd845a5c7893c992039215b52749537c31b2b068064164cd9b5b4f7c
TLSH
T1AAA002210240C551D20002B03C4187981210BE698045076776D103879C650548A51545
MD5 SHA1 SHA512 TLSH

Submit Download

e3ed2dd0-54cc-4d98-a4c1-eb35388f4604.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Default\e3ed2dd0-54cc-4d98-a4c1-eb35388f4604.tmp
Size 7KB
SHA256 6ce65f4357c4467f3518f3cd4a6a8be6c1386b0d5888c435674af6db2bc02198
MD5 a83b3df765dacf43149488a8b69c2c43
SHA1 394c08a48b4add6f63ef41d192add8dafd3dc67c
SHA512 23480586ef25a0c7ee439ff6748f4ae5153b70840f8c76f5107613e7c1f39e7eb719160da9aceb9c5ab04df2090defade42926a34592b05b14b6f2b610377f33
SSDEEP 192:zR3+Hv7YAPRp2LXsb+WN48Q6iyIsnAUgY:zR3+PvX8Xw45zY
TLSH
T1D6F1842DAD24A63F9CD6E21DFE257B42E2F5102135942D08D7FCC92C28EB6CD222B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Local State
Size 123KB
SHA256 741d1989c636343a57207d2d2477fd67e880b393174079ba6582d092b81ba602
MD5 f21fe66e48ccabfb6ef589a971ad08f3
SHA1 21762b766edf3c960870141f66d50ddf466bca77
SHA512 2588c3ba6f4b2c6234b1484474fed9660b1a740c401c390c9f248d3bca48dac2d85e4a162faeb80bc120d77e660d7c85b942c8e53c38a7d4d1c841cc0f95117d
SSDEEP 3072:g3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8GC:LX4NwhgqKR4ILo59R57lOYo8n
TLSH
T132C312F1E5371BA89CBA8DBE30043960CFF1F29DA2D8E545DA9935A9320E468870D53D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Local State
Size 122KB
SHA256 10cad51b5aaf4790580afad342c8d08a0eca51e9a2b662aa21bdf678350173f7
MD5 f521e3e4ab5e4b6643f1c0975bda867f
SHA1 190c53323962aa004d179348eb78c2551bdb9f9f
SHA512 867a67ba54d91bfd3894072d8d83e3e31809a305584cafe1da9dc0535c6d243a902401a5a749aab31f96e537f53f99dec86f9a5cdf62e82abd660261c773e176
SSDEEP 3072:L3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8GC:2X4NwhgqKR4ILo59R57lOYo8n
TLSH
T15EC312F1E5372BEC5C7ED9BF30142A60CFF1A19CA2D8A546CAD175A9310E898930D53E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Local State
Size 122KB
SHA256 8c98ba26767762bfd5661e2a96c818610b464888c383d6820343dd57e1b9bbd0
MD5 ed2cd096093a15bfbd35ea60e0af197e
SHA1 0a273fe09325effe556169bfa9922e240547d625
SHA512 b6dc4888625a21243ed7e02a2224abd8bc41f5f3353402ecea391b8dd3a9e3e7737e2ae9e371eca3948d3d83646fc6c58b064695cfeb7b71b903c7cec932ffe0
SSDEEP 3072:m3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8GC:1X4NwhgqKR4ILo59R57lOYo8n
TLSH
T1D1C312F1E5372BEC5C7ED9BF30142A60CBF1A19CA2D8A546CAD175A9310E898930D53E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Local State
Size 124KB
SHA256 b4f43a9ed8ff584aaf35ed91e81634cd03049d03fbbeb2cea9b3d22a050ad39b
MD5 bdfd8bf2b3712d57c4b7943181585df7
SHA1 738cd709995da55a0333cc42568bbbc0c180e347
SHA512 b7c8b20e0122c3317b90346bd1cf88d3b8a9d96d5cb02b238146ea9e672825280c60a85a223b61677a56613d3ab7e68e3ec4596a55d67ace40dd3f8a40df6a0e
SSDEEP 3072:x3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8GC:IX4NwhgqKR4ILo59R57lOYo8n
TLSH
T1E1C312F1E9372BA89CBA8DBE300439618FF2F28DE2C8E505DA99355D310E468870D53D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59a31c.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3196240745171\Local State~RFe59a31c.TMP
Size 1KB
SHA256 db1ac2aa265ae37b864657f8f92964a5f27ce08226a4fef86fa9b0d7948036eb
MD5 330baf2e7b94fcef263a1f1b7759e4d6
SHA1 960c29c40e98dc6b705e3315588c35ec19f6e705
SHA512 d67d2ee09e57038b137d140a80a5906c2afd9856aa24f237dc0437c7f6622f7ff5165c982157de7f8f58e385ee905a653b18258fe024237c5ede9ef3e39773ee
TLSH
T1D01175B171793632AC45851DD50147A3DFB9622FD512CE4837D93B0511777981B1A434
MD5 SHA1 SHA512 TLSH

Submit Download

06c189a1-36ab-499a-9e5a-3df87c0ef86e.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\06c189a1-36ab-499a-9e5a-3df87c0ef86e.tmp
Size 6KB
SHA256 c14d6f78e5b663dbf6589fced4f406e1ed7ec834cbe51817c816a4eceecea3fa
MD5 31bc69f64ff11dac5c90d8c4400454ce
SHA1 06cb32fef7d1d9f95515fbd38de9f8f124918ab7
SHA512 1d2f70c4e95b18fb75da6a56d080bdc6871e2a8465461f78e812389129e20d71664a34a40e34fe74c8e59612e1131f6a6e85d60a0a4f8876c249407329f32af2
SSDEEP 96:uuu3Ngq8Nkk2EQamuofVWo8vhz7vN8Frh/cInURcDotoJ5u2mvDpBVT4Uvi9Z61f:uusL8NGNWo8vlqocDUu2Lvx4/611Gg
TLSH
T13BD1DA716834EC3398E6E609B5893B63AEB42077E8947F9CD6DC5B1C04E739C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Crashpad\settings.dat
Size 280B
SHA256 1bd667cbfa9a3ed2074df7ad54ce78a22fe5168dd646dd79c1fd65f190bea8c6
MD5 10aa389c567726a69eeb74e08ace6143
SHA1 b44c4384e7be32081bacfb2b249bf5a750ed20e8
SHA512 a89ec15585394a09edfcf8dc95830dceee42be3f6c8af2f8696622af9061c01cf3b67d3ef280f7dd2f96c0f494d3a8f7e3903fd0f2c1643c3a11e516b453e894
TLSH
T105D0047075C0300FD501F035C511D1300511544014331114F33041440555400030D301
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Crashpad\settings.dat
Size 280B
SHA256 250e3f329be985c5db7bef124c0a5da723217820ddfd1face48e1eb202f3c06e
MD5 b571c363338fdd4ed7827b950265c5cf
SHA1 53bcaa764abdbf2cc5a063e2187260626141d5de
SHA512 e608f2c9dfe867ffb051fdceb66461275d64beba46efbc398516ad94008571c8177d93235e5346d4a4f25e67ff9002e4a93f702027aa26fa790571ecc2a7df16
TLSH
T157D001B0BB91608BF787A03AA611A63659A1B8A05476152CA2A0624449A9815262A2A9
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

79093af8-7e97-46f1-91fa-9244c58b8b92.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\79093af8-7e97-46f1-91fa-9244c58b8b92.tmp
Size 24KB
SHA256 690c802a494c32c1de4920355e50775765242ea270f8cb57b4bfc0378520f7dc
MD5 b6686121b3acca0a9fd41834ebc65e64
SHA1 3aa734c7b4f2bbba922985df375b04ccd6f621b2
SHA512 1f287f410f60252cc2a1b0a2ef884adf46b5ec716a1c15acc9dcb8315734a37c39f523ed6a79f028a4321bde689b1bb1090455743c2b75c4328810cb133f49cf
SSDEEP 768:HxhoZgWDP9fzv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUgxqfrosCB:HxhoZgWDP9fzvu1ja1SqMZB
TLSH
T12FB2FA2F600DCB7E8F804A9DD8557F9B6E6C01CB96948D4047FA994C03C77EB921A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 3f25eadae3bd0476789bbd3a7399ce7bd89c6419f5a58e4526a01baae95a9dd2
MD5 323051b94435f85bf61b99455546a7be
SHA1 a6b055be9724333157ed3ff532483a40d1ff5814
SHA512 60890ac00d229eb96b8bd90ebf0c8ba7d7205048ef7767f768fe7b506ee391864e71347aeb64047942d1aa415b5095cec336cc1b9d265af2b39234989d127946
TLSH
T17CE0978E0FD52C93CF2872B02C00CC88220811230C8A33ABC580BC88B9030E29600F8E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e8c0.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\Code Cache\js\index-dir\the-real-index~RFe59e8c0.TMP
Size 48B
SHA256 c91d34cb5fdffe59f195f1cd1e1e254360b78f1fb14e1430d28f0bfeda94501a
MD5 07798613ed53e634d402caf85befe3c6
SHA1 69ddd1745626efc296775df503f18ce86154ec4c
SHA512 ba24ad9e20e3b5bbf9290092536ee3ff4fe76e97f716c2c82f4301320526e9972edb4351c586fd0ec3470a89cdff0424fdfece98d34156036e91e280e5c2ca1d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\Network\Network Persistent State
Size 949B
SHA256 182aec3790a30cb026d19c47a59d283093dbc27d576491fe1a73ff842d30e52f
MD5 252fa21e7e04c91389cea01728cfdfb1
SHA1 682b7709aa9b5f87051cc0c893bc4469ef722dac
SHA512 0ae3bb5180eb5a847dea32c4769f5dce5ce92e7cfe9033e56f6e9a65f7710a9dd5175124852e284b68f76d97db1aa14260578f04072daa1a7f66d18aee2f9075
TLSH
T181115BB3C3E585AE891516F05A24AE1BCE2D061642187C1995D4EF2B93E3465E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\Preferences
Size 8KB
SHA256 005464971ef9ddd5b38d4dc351c9032f8380026708336d1cffd4c78f7ab340bb
MD5 a9d92f0b0cec40769fbb702f2e18ae1b
SHA1 d27e1f3aac9feded3822c1b0b7bb38972b338551
SHA512 45c638efa32b54412f571c7bdf05cd37669b0fb5cae8c2952b1b67fc9c355df5c2a367499b79fd835d12d380b6a1eb4af07f32779904f6fb0abafd3b605add16
SSDEEP 192:sxRcRMB/f4sUuiI/pY/gb+WNVdSYyhgBJ:sxRcSB/f4sUuZY/cVtL
TLSH
T1D102A7566E28A97B8CC7E21D7B257F53F2F5502260C51E189BFC961C04EB9CD230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\Preferences
Size 8KB
SHA256 0fe20ef21a169a8330651f0d263efca912da596a95e47d671f76bc6edcd33a26
MD5 79173de055c771b7fd639153944d57e3
SHA1 bcc8ce426d038d526303276cc5f49e6435051394
SHA512 2e83a24eaea5cccad9a889a310fe102dfc3272a381defb63446f2977030919614e916946a7e945704d1fe631d24cadc5e30693d8a61d66011596fb3eecea04e3
SSDEEP 192:sxRcRMB/f4sU7iI/pY/gb+WNVdSIyhgrJ:sxRcSB/f4sU7ZY/cVT9
TLSH
T19C0296566E28A93B4CC7E21DBB257F53F2F55022A0C51E589BFC951C04EBACD221B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\Preferences
Size 8KB
SHA256 ec11a7403c383270593822534714570e1229b0067da79d67dfd59df8f1f70901
MD5 ba597163862e42dba257edf13dc05d35
SHA1 694e8f532464dfd12e7b0e62dcc06e32007b3f4b
SHA512 43eae16c2a81d23bfa0a76b63556b44be6804e105c56ec856b629c2eb258468df0077ebcfba9f989816bac7513e192c213ae4801915fbecacabc2ade64c9824f
SSDEEP 192:sxRcRMB/f4sUuiI/pq/gb+WNVdS3yhgBJ:sxRcSB/f4sUuZq/cVML
TLSH
T18D02B8566E28693B8CC7E21DBB257F63F2F5503260C51E189BFC961C04EB9CD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59e16d.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\Preferences~RFe59e16d.TMP
Size 8KB
SHA256 4ba8cf56f1127a00b4076d64e437aaf4ff61ec98c0971e88d4fa8a70a4b58e51
MD5 56d1db07eebe80009b7290b80815b2ca
SHA1 d5ce0cedcd6de64ef3eb9a9fce46b352f08cafb4
SHA512 357fbb13f3e737bb286a95d9f9772ca951170859cde3d9c03335580ad8e22c07a622f37d1d13690a5358d90cf1ab99cc0c65c9d01085adca0eac61a54a9dfb64
SSDEEP 192:sxRcRMB/f4sO7iI/pY/gb+WNVdSIyhgrJ:sxRcSB/f4sO7ZY/cVT9
TLSH
T10C0296566E28A93B8CC7E21DBB257F53F2F55022A0C51E58DBFC951C04AB9CD230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 146daf09b7df9777edab668a27062f321bdd76fb88fd2732e63d4b211b8dd6d8
MD5 521d78126a2c8c35432c1bad1b51e159
SHA1 acc7c094a68281c4e3ed0e87661e76b88141652e
SHA512 0b2b4d0bf915b65f03c7957b6f8a19075649de9bb5f29777c6b367b553274385e3a55f5b42cb27b81c2e1ef4b3fc46a606639dcd2b0284c514b6892fbff3ce62
TLSH
T12BA0026919C88C42C90153701A87455032304D21854753074A905CD9E9532E44A01914
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e843.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index~RFe59e843.TMP
Size 48B
SHA256 84d582653c4920b0c36c099179034f094eafa84c3aa46ec7b70b0c5c8526de07
MD5 15b71a104b11460106a7091ee37fc5ab
SHA1 56498527e81fc40cd27f21efca562481bf4a58b4
SHA512 601eda9da40c7637ca5bc7cd6d7e1b7557d7874b70bc3b28f3ef81e224e8779dda09c65862c8cf3b5f0fb62ff40311446dcfd86d13de16c8e436d5049f435cce
MD5 SHA1 SHA512

Submit Download

6c5e4060-2b9d-4c4d-a710-11afa8649948.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6c5e4060-2b9d-4c4d-a710-11afa8649948.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

9ae252fd-8c50-4edd-b05d-99ea1af752dc.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Edge Cloud Config\9ae252fd-8c50-4edd-b05d-99ea1af752dc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Local State
Size 19KB
SHA256 2e558100642358ea5852b0cc383c59a0395013da12c198c2e81542a38e141dd6
MD5 125ed6fefa174e5bc781befae8b5f95f
SHA1 a5718d52e8a0225cde5101499025d69f28184d5b
SHA512 fc78eae4ad6a4ac2a531e7bffb144cd595498a5c23eff430ea34e63998b8df321572f5c39c6c3cf79354b914c42ee2f516262a23d1afbc9e2b97df761d4670b0
SSDEEP 384:n0ZcIh8NDJvvaSDmxOTJOOpSHK/d7Fd+HlytEDq1wCUbx:yhY5+4bpYK/d7Fay6Dq6bx
TLSH
T1C29249F047651937BBAAA9F9A4BB3A02CFB41027D1942958FEDB5EED0C4F1D903C6421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Local State
Size 3KB
SHA256 d7a2ce17d305e32b9d01a7009fc34ce8d668b2d102af910a9f5f026860f83cd9
MD5 7712a8f4d7444a63a948f93866c3978e
SHA1 08717eab668dbf2da4cbd69ddd1bd6ca10f9778e
SHA512 566ed3de980ed5a1942d820ef9bdf5265bdcb66d54891abb9ee5b46dda91d0c9c28a853039b3278ab2d847ef73d706ccd61852ae2c025eef5278c3af8a4a6c85
TLSH
T1B981A8B16429EC3795E9AA08758A37A39E7871B3DC55AF54D5C8232C00F725C2B0E827
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Local State
Size 15KB
SHA256 42ea98215d928849189aec8916cae9805d8ec1d2b129059b3f601634d9d6d8c2
MD5 9a95286ad71d7630f1b2b97226ffa7ad
SHA1 a790cc18b7bea667a329f9099748692dcc7f8aba
SHA512 1516ef02cd6868ed240f049dd4edd766c4a2d24ef2fb025141fda5ba7e2e2acf9b13a73f076d69dd57c3f35624f4275f2c4aba0f906396fa8a9de7b720bad2cf
SSDEEP 192:uu6m+xasuheOwQxMG8NGUWo8vlqocDUu2Lvx4/611Ggwt2lU0BytEDq1cTxCUb1n:n5ZcIh8NGJvvaSDmCHHlytEDq1wCUbx
TLSH
T1D4628D7014746D3394EFE10AF88C3A179EF86073E9E46E88E5DCAB2D00A7199170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Local State
Size 4KB
SHA256 2abb189c152b9035236b42ea94836bf6951860c7dcd83da06788eec3744007c3
MD5 69e99796a6890ed6956912e1e4fc4a60
SHA1 c126dc5ad3cd52ff01efa4feae32357c2252bc0d
SHA512 cc0cb1eb40ca38fe7cf61e8fb9acd39bb5af8697c82be728f2a4024605dbd022919f011133700a92b6c7ade895bdb74b7ef656be2030f13ed56948db87c2b7c0
SSDEEP 96:lqGNkPQsFfVWo81v58Frh/cInURcDotovuwUDnBVq3vi/v10eUcGHmq4a:cGNvUWo80ocDUwdiB3v11G7
TLSH
T117A1D8716439EC3799E6AA08B4CA3797AEA43173EC857F98D5DC1A1C00E7388274A813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Local State
Size 50KB
SHA256 68094e2c033316c8094781386ed337aa70a98ef1d97ef0e2c6c04dbcf97d0c26
MD5 e207779a675971999b4c704cf0805d90
SHA1 d0d45a6bf43ce7ce7652986a0aed3d37282f4696
SHA512 d926bc910a94cb3e1c20d65d6d5d9d469eecf4b5bec5ef8f8bf65bce3bfb94438ac06880a1876aea04628534305d6c9fd6c5e2f4c12af3f30b5927f580323a91
SSDEEP 768:gFQhOwgr5pVhkZiEzOimUct8P0gTz42lKmcQSHxC5R2a9C4bpYK/d7F1y6Dq6bx:Th8hkZiWjctzh28wM45R2c1biK/dBXnl
TLSH
T1BB33AEB0CA569627BBEB5AE5A6677506CFF00667D08C98C4EDCB2DDC0C4B6CD0389C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5993ca.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\Local State~RFe5993ca.TMP
Size 1KB
SHA256 083f97ba0ba01f201b3f65174a988346563bc5c8bccb6b880df0e5ddc7d5b17d
MD5 3e434823530096851beb4c79e960bda4
SHA1 e09be8d87c0ba32d583f0e298607bd400ceda800
SHA512 dca1e9971425958fd633badfc5c0a6d0dbd5d4ad5d48cb1b3877104b874e1a10cf6ff79e516409579f8443e52c863bef2f0da6862f761ada42f64cab3740958b
TLSH
T13C31B7B0686C3CB3F8A1564AA30EBB675E3471B2D0966E5C80DD152C04F769C220FC37
MD5 SHA1 SHA512 TLSH

Submit Download

0b22fbe0-a106-45cd-b263-de3489841738.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\component_crx_cache\0b22fbe0-a106-45cd-b263-de3489841738.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge5176240751031\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

log.txt

Path C:\Users\Admin\AppData\Local\Temp\log.txt
Size 3KB
SHA256 a29c8076abcd521286b1c8e35fa5729fc40d92bf2e16e7f8984a6813d3930f70
MD5 569e28efc2dee597ef63a5dcf9f9d72a
SHA1 b04d9989b42e4dac6a55ef6ec0864fc092756a89
SHA512 b78b04c727e7f54dbb2aa5eb8feaff0ddc31f838b70738f489e0f756094ac9ff748f82635c4bf4f8a317152ccf3b583cafa158e205a090a5afbe368f75d51afa
TLSH
T15B71E2511EEE9E560ED34348F8184B3D12567062336D30917BE80D45A8EAD1FEFE6AB2
MD5 SHA1 SHA512 TLSH

Submit Download

log.txt

Path C:\Users\Admin\AppData\Local\Temp\log.txt
Size 4KB
SHA256 99d207a94a454585d2cd736119e158525ffcf25d508d8528ff01a2bcb1f47dc0
MD5 0db682d22d82881b0b55276d87fb654c
SHA1 c4f95b80034f0fed99a6d60800bc47223b2f7359
SHA512 5a2f0acf20b889efd1ca939288b40d6a46167b960db8f61c7e67e3b02a7b4bc00698dd4382d50a59059cfbdba2d4aa821d8dd5a8b1316a7df2f4b4acbb34a749
SSDEEP 96:OmtA1/ZCSEZVH/TORbQ/2Jv/eYm/oNQ4hH8sY:+8ZVOd5JuYfNQ4hH8sY
TLSH
T13C9133520DEE9E570ED34348F8184F3E16467062372D31907BA80945A8D9E1FEFE5AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 9d82f2488aff9e34f41058192e1fa1b3d18559de1ea234c387051c1289a87993
MD5 8f4a54a7c8c9c5ca88078d57417db25f
SHA1 2c14d3ff72fd72df8d0ccbc539f57dc064c04f9c
SHA512 abe076a8632f8befdee8a493f87dba0924e0dc41db9c359d218f13b2e4e0397e2229bef3db722c2c01157638eeb88b9a10ca3a5c437f0ca481418442c3b0190b
TLSH
T12C81D0019FE24E0AF3F3A9B265B27B20BF77FD0896048B0D058655190C72B0499ADFB7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3260-419-0x00007FF6F6640000-0x00007FF6F6A4B000-memory.dmp

Download

memory/3260-4-0x00007FF6F6640000-0x00007FF6F6A4B000-memory.dmp

Download

memory/3260-595-0x00007FF6F6640000-0x00007FF6F6A4B000-memory.dmp

Download