vidar | fd39a100de7ae6efc732edeab31a89313d0be7e0540acffc04f6ed707c48c48d

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2025, 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe
Size

799KB
MD5

9d8735f3616aa80144974a74ddeb99fa
SHA1

70414ba52fbfe2606e8fb08d43afbab4488628eb
SHA256

fd39a100de7ae6efc732edeab31a89313d0be7e0540acffc04f6ed707c48c48d
SHA512

231c202bfa703e3c0740b990344ee2903eceba15abb79add30a0690089eb12ec64a264301fd20c46f97eb6092e80b3dbc2227c1b447844a03a422689eb34c315
SSDEEP

12288:dbGU3fK+OmAeJWcl28vZ2CYizu+9LKLdEEo4Edka+9LKLdEEo4Edk:ZGU3bNkAuaKLdjRaaKLdjR

Score

10^/10

vidar c466785b3a34d7b3c4d6db04a068b664 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

13.5

Botnet

c466785b3a34d7b3c4d6db04a068b664

https://t.me/v00rd

https://steamcommunity.com/profiles/76561199846773220

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0

Signatures

Detect Vidar Stealer 38 IoCs

stealer

resource	yara_rule
behavioral1/memory/312-0-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-1-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-2-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-9-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-10-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-15-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-16-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-19-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-23-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-24-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-25-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-29-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-32-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-75-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-76-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-77-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-80-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-81-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-85-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-89-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-90-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-174-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-343-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-381-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-390-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-393-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-395-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-396-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-399-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-400-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-401-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-402-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-406-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-407-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-408-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-409-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-410-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral1/memory/312-414-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Uses browser remote debugging 2 TTPs 10 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2472	chrome.exe
2700	msedge.exe
4332	msedge.exe
1340	msedge.exe
2844	msedge.exe
3232	chrome.exe
3096	chrome.exe
4744	chrome.exe
1704	chrome.exe
4432	msedge.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4720 set thread context of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2064	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133896315940881155"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3833542908-3750648139-3436651901-1000\{C2A3E759-C591-4FC7-9B96-8589B53B993F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
312	MSBuild.exe
312	MSBuild.exe
312	MSBuild.exe
312	MSBuild.exe
3232	chrome.exe
3232	chrome.exe
312	MSBuild.exe
312	MSBuild.exe
312	MSBuild.exe
312	MSBuild.exe
312	MSBuild.exe
312	MSBuild.exe
312	MSBuild.exe
312	MSBuild.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe
Token: SeShutdownPrivilege	3232	chrome.exe
Token: SeCreatePagefilePrivilege	3232	chrome.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
3232	chrome.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3968	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 4720 wrote to memory of 3968	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 4720 wrote to memory of 3968	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	91
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 4720 wrote to memory of 312	4720	2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe	92
PID 312 wrote to memory of 3232	312	MSBuild.exe	98
PID 312 wrote to memory of 3232	312	MSBuild.exe	98
PID 3232 wrote to memory of 1672	3232	chrome.exe	99
PID 3232 wrote to memory of 1672	3232	chrome.exe	99
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 2692	3232	chrome.exe	100
PID 3232 wrote to memory of 3160	3232	chrome.exe	101
PID 3232 wrote to memory of 3160	3232	chrome.exe	101
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103
PID 3232 wrote to memory of 1704	3232	chrome.exe	103

C:\Users\Admin\AppData\Local\Temp\2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-20_9d8735f3616aa80144974a74ddeb99fa_black-basta_cobalt-strike_ryuk_satacom.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe4760dcf8,0x7ffe4760dd04,0x7ffe4760dd10
      4⤵
      PID:1672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1968,i,14419114533917537819,17347643152208670433,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=1948 /prefetch:2
      4⤵
      PID:2692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1572,i,14419114533917537819,17347643152208670433,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2244 /prefetch:3
      4⤵
      PID:3160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2396,i,14419114533917537819,17347643152208670433,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:4296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3032,i,14419114533917537819,17347643152208670433,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3100 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3024,i,14419114533917537819,17347643152208670433,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=3076 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4272,i,14419114533917537819,17347643152208670433,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4300 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:4744
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3788,i,14419114533917537819,17347643152208670433,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=4672 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5312,i,14419114533917537819,17347643152208670433,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5276 /prefetch:8
      4⤵
      PID:4852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5352,i,14419114533917537819,17347643152208670433,262144 --variations-seed-version=20250410-050051.531000 --mojo-platform-channel-handle=5480 /prefetch:8
      4⤵
      PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe464cf208,0x7ffe464cf214,0x7ffe464cf220
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1944,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2160,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2388,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:8
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3556,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3588,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2520,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4184,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:1340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3808,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:8
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5144,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5232,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3724,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5976,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5976,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6148,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6256,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6756,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6724,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6236,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7072,i,9301688614404145614,6129221492829199690,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
      4⤵
      PID:4588
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\q9zua" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3760
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 11
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2064

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
1f92f78d7090599c147cbf41f08a4225

SHA1
0bda0a06e8ff97650922ff43e52200347bd553dd

SHA256
f4eb0ac6a93915233817a09542b02e3907a2a4a04d63321a42e20a66cb2c48e8

SHA512
3bb44a705b4b131640520627d119c99d7522afcce5cce655eb0a220a38d7a049bc4b4c49e7755d1292d2f7b1b05942dbd8cee4f6195ccb441365b237a1c9534c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
78KB

MD5
404f533b73de3d5a05f3801f6f46f66a

SHA1
a488a08781f1bc7180a25e30c1c92044687a47d1

SHA256
8d58356f03ea43fc200e1c12d8dc69b31ff4f3399bc28a5757a291391386d459

SHA512
4fabff9dbb7f54aee2df014d406329177cfb141e2ed6edf23fda007a6cadf302aead6f439efd3a261a533e3c2a563da862c246df3d49fccdf89c5e82b9acfa3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist

Filesize
105KB

MD5
6e82345aefe362b4c5071e7df6c07407

SHA1
44176a6b5c2722280699b8cc9a174d168fd4c161

SHA256
ee1ec48b6b166582c51a4141a84f48731ce18a62e4b7faeb9d60560c8f9c382a

SHA512
20c0f5862226a3eb17832e7c793f809f2333e0e0068dbe61b5865517fdd9f84bb5ca8d97bdb19a005a25b789ac75a09067350940f042fb5123cdb682ce2c98d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
16d866444174f56021f3b8a32126a79f

SHA1
487ecf8312a06dc849d90418de2cbf7e42d8dee6

SHA256
4f6b9aa5ccb03e16a99c1bc90d963e5e105f812ece646764e00b0ee593d56c8c

SHA512
83251093985709749995d32ae849764f26352048d270e9246ffa1e1fa56eb647df327a5557a068b7e99b8a690a75e4381eea59ee2851c52d1d428d28fe9a8c4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
d9785e91e611c063a66ed926a2b4e8df

SHA1
a26cc634c8e2faa4079541779b2cbccbbfbfb7c1

SHA256
8d86adb417adc05b1a8d52677af389732a1379ae4ea5d922a935c7a9855eeba8

SHA512
505a6a04c5b5f560fc70a91bc9d9519197209c55380c608421291ac0a241b99d48e6bae3e8d254964078ce9da085c1725fa1343171c8ede338a9de1f03fcf242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
0722bdc07c7e0af9e20da5d491d811c1

SHA1
17a074413aa7ce1bfdc3ba6f6bad547ae3546541

SHA256
23623472219b27f1ed929c76d51f9d76d90ad02c4bf8d37d4da9404d61dfe2ff

SHA512
7fd5b8edcec6191f45b5ef076782154a40a0321cf47d434376ce483c622d6f3d5fa3b24288646b28b340c757e4348da7cb410ed70629b16f8f3397c0f5491dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e1ea54a-1430-4fbe-9836-a181ccd52900.tmp

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\72413560-e6d6-4e6a-9df8-edca72438a6b\index-dir\the-real-index

Filesize
936B

MD5
01d901c0ed2e2dba0d6be16796a113f7

SHA1
262afde93b1f3e124aa52c82dd0a7d4170c377cc

SHA256
53c67c315528a6f0d59eade1307a8e7124970bb7f7c0aafd9b54aee00b68f5ab

SHA512
364caa83c0ea7d3ab12e626f84895d660845115caab6b670675de12eabe495e2bf1c47d82175472ef1475e87d1798019835c51d63b7188288f5552a54e44f33a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\72413560-e6d6-4e6a-9df8-edca72438a6b\index-dir\the-real-index~RFe5800a7.TMP

Filesize
936B

MD5
0e63b3f094c508b327d3b38458e8dd7c

SHA1
f74f67fe7f19e93780209897d2d3e32b53b61d78

SHA256
d3959bade2294ae4e4aa62be17c13051550db048a3ad8ba594a7bcb0c8098f37

SHA512
c1de17ea557278ce3b472d185e713fcb49eedd9cd7405c47adead457a690c7c02ea101824da1804427eea52403b745cd74f106419a25059a4c37f61dd9058cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
50882127a778be4de5c8f508dd7009fb

SHA1
ac37b120f709c3c55ed30d409c1044488f820e64

SHA256
7c78a2e116b68b93d1501b0843b346a39831ff7a15ad9e422909416e6ad78161

SHA512
bbeb78ab821db1004f5c9c756f303af4d62080050ad45efb7ec47b4d11c55503dfb754fe8613122555724ec7f5d0aca0364bb2d69cda6aec24c1060a6c5c45d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
624108fed1c5fea731a744ad04874544

SHA1
9ce5a1f12dc821267d09a803fbd2af7981f7b3a6

SHA256
c50c219e05e5826a92c5e408c043ae051bf3365cff9e00633df234bc84c6daa4

SHA512
4e99036bab58cba97211fa72255ef238d1e24c4333c71d23f9e3eafa56987fec627b8e9a4e2065c892a875910864e3a7b750c56c069e319d45c0b57761f5bda0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
e477ca854ae36111a0571fb4b7e7d073

SHA1
02a7e4b9e6d1fd22608bb6a3777430dda7f323a4

SHA256
fd3b28de6e29a65ac468783a53792e34cc48169c5ee25bba7600472bd8eb281f

SHA512
72377049b04b6ed3e97ceb84821ee7752b96e94d51f1f9f2d8e392c853867c995f172a5d0633d9f35468a1828ed8190cc0b18a134eddc2504598ef8d05469828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
e833a20f3374adb940f56707062af26c

SHA1
b3e2bba1ddea18e933fb4625d2e63e0b761d2a4f

SHA256
e60c4eddb2ece20dccb9c3c92a88e92fb45601e4c057dd37799f16e3251f1e05

SHA512
21dbada3b2840834889a3c43186cde98369da5d94bfcf0c30b41bc834c16142b858c306c78c408f9cb5d0ba646e3fe7b4808016306235a152fc490622e612e96

Download Submit
C:\Users\Admin\AppData\Local\Temp\07a8e508-cb7a-42fa-bd1e-5db5078f52a5.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\382a93ee-a354-4466-832c-2a032129ee92.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2700_160333530\320444dc-887b-4436-abf8-ccc852d03a21.tmp

Filesize
153KB

MD5
b0917d8e6c5b6be358bff67f84eb8336

SHA1
a6e221edcb19a1cc81575b4ddd927fd9a6fbdd6d

SHA256
dff2c9d9755f96713c08f4932a9091080808ec34c0823feac2206fa526f91e60

SHA512
cd5822bbf91e8f7f5ab2b471a4bf8b464bde95465e2fccc6a57e5a287ca55d5062bdd6d4b3cd76f8529ee7a9081b6a7aad7dc2a7581c344ce4fd2d3256bdf451

Download Submit
memory/312-85-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-29-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-25-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-89-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-90-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-80-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-77-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-174-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-75-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-23-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-24-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-32-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-81-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-343-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-381-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-390-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-393-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-395-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-396-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-399-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-400-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-401-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-402-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-406-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-407-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-408-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-409-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-410-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/312-414-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download