stealc | hxxp://dawnloadonline[.]com/devastated/intemperate[.]ZG93bmxvYWR8M0dvTVRObE5ueDhNVFkzTVRJeE9UQTVOM3g4TWpVNE9YeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeVhR/isla/QXV0b0NBRAQXV[.]receivables?grownup

Analysis

user interaction
yes
max time kernel
149s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/02/2026, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://dawnloadonline.com/devastated/intemperate.ZG93bmxvYWR8M0dvTVRObE5ueDhNVFkzTVRJeE9UQTVOM3g4TWpVNE9YeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeVhR/isla/QXV0b0NBRAQXV.receivables?grownup
Sample260216-s5cm1ab13f

Score

10^/10

11111 discovery stealc persistence ransomware spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

11111

http://217.156.66.135

Attributes

url_path
/4a815a53876a4172.php

rc4.plain

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Executes dropped EXE 1 IoCs

pid	Process
4488	autocad.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\shopping.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1073421360\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_1073421360\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\shopping_iframe_driver.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2764	msedge.exe
2420	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	autocad.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	autocad.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134157301653220719"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2605425648-1229640847-2920638550-1000\{958944A8-CDA4-431C-B310-61D2D76713C6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4488	autocad.exe
4488	autocad.exe
3468	msedge.exe
3468	msedge.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe
4488	autocad.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	5816	7zG.exe
Token: 35	5816	7zG.exe
Token: SeSecurityPrivilege	5816	7zG.exe
Token: SeSecurityPrivilege	5816	7zG.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
5816	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4900	4552	msedge.exe	86
PID 4552 wrote to memory of 2764	4552	msedge.exe	87
PID 4552 wrote to memory of 5012	4552	msedge.exe	88
PID 4552 wrote to memory of 5012	4552	msedge.exe	88
PID 4552 wrote to memory of 5012	4552	msedge.exe	88
PID 4552 wrote to memory of 5096	4552	msedge.exe	89
PID 4552 wrote to memory of 5096	4552	msedge.exe	89
PID 4552 wrote to memory of 6136	4552	msedge.exe	90
PID 4552 wrote to memory of 6136	4552	msedge.exe	90
PID 4552 wrote to memory of 4924	4552	msedge.exe	91
PID 4552 wrote to memory of 6136	4552	msedge.exe	90
PID 4552 wrote to memory of 4924	4552	msedge.exe	91
PID 4552 wrote to memory of 4924	4552	msedge.exe	91
PID 4552 wrote to memory of 5056	4552	msedge.exe	95
PID 4552 wrote to memory of 5056	4552	msedge.exe	95
PID 4552 wrote to memory of 5056	4552	msedge.exe	95
PID 4552 wrote to memory of 2180	4552	msedge.exe	96
PID 4552 wrote to memory of 2180	4552	msedge.exe	96
PID 4552 wrote to memory of 2180	4552	msedge.exe	96
PID 4552 wrote to memory of 5316	4552	msedge.exe	101
PID 4552 wrote to memory of 5316	4552	msedge.exe	101
PID 4552 wrote to memory of 5316	4552	msedge.exe	101
PID 4552 wrote to memory of 2496	4552	msedge.exe	103
PID 4552 wrote to memory of 2592	4552	msedge.exe	104
PID 4552 wrote to memory of 2496	4552	msedge.exe	103
PID 4552 wrote to memory of 2496	4552	msedge.exe	103
PID 4552 wrote to memory of 2592	4552	msedge.exe	104
PID 4552 wrote to memory of 4248	4552	msedge.exe	105
PID 4552 wrote to memory of 4248	4552	msedge.exe	105
PID 4552 wrote to memory of 3024	4552	msedge.exe	106
PID 4552 wrote to memory of 3024	4552	msedge.exe	106
PID 4552 wrote to memory of 4152	4552	msedge.exe	108
PID 4552 wrote to memory of 4912	4552	msedge.exe	113
PID 4552 wrote to memory of 5472	4552	msedge.exe	114
PID 4552 wrote to memory of 5472	4552	msedge.exe	114
PID 4552 wrote to memory of 5472	4552	msedge.exe	114
PID 4552 wrote to memory of 5744	4552	msedge.exe	116
PID 4552 wrote to memory of 1108	4552	msedge.exe	117
PID 4552 wrote to memory of 3008	4552	msedge.exe	118
PID 4552 wrote to memory of 2468	4552	msedge.exe	120
PID 4552 wrote to memory of 2468	4552	msedge.exe	120
PID 4552 wrote to memory of 5596	4552	msedge.exe	126
PID 4552 wrote to memory of 5596	4552	msedge.exe	126
PID 4488 wrote to memory of 4980	4488	autocad.exe	127
PID 4488 wrote to memory of 4980	4488	autocad.exe	127
PID 4552 wrote to memory of 3468	4552	msedge.exe	130
PID 4488 wrote to memory of 5048	4488	autocad.exe	131
PID 4488 wrote to memory of 5048	4488	autocad.exe	131
PID 4552 wrote to memory of 2420	4552	msedge.exe	133
PID 4552 wrote to memory of 1748	4552	msedge.exe	134
PID 4552 wrote to memory of 1748	4552	msedge.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://dawnloadonline.com/devastated/intemperate.ZG93bmxvYWR8M0dvTVRObE5ueDhNVFkzTVRJeE9UQTVOM3g4TWpVNE9YeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeVhR/isla/QXV0b0NBRAQXV.receivables?grownup
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffd55bbc188,0x7ffd55bbc194,0x7ffd55bbc1a0
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,12071499109392133451,2623455022073270339,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,6225289369172280970,15742083718814114417,262144 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,10994579099219185475,2758880069510844701,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,18425898394147172714,9662169983982832584,2097152 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,5579507931477063748,9846371818952244201,2097152 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5036,i,4427623010259623609,4640250984787278237,2097152 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5352,i,8000695584504249391,6792722665063641215,2097152 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3396,i,2189072601721867136,1331148159167818868,2097152 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3668,i,4718109963695461576,2855712232456842402,2097152 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,505730045931466518,3585606708579898539,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,17353703496757631612,563999073260763828,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,1234881663663409941,4746394155230708256,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,8975848918995759737,12549342547063905766,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,8975848918995759737,12549342547063905766,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,12837353175483442833,93916522002780392,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6848,i,14293636495528379638,1914389634126272734,2097152 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,6146139415887815371,7443537658656216897,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,17997480885899074950,14474078791561210275,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,10547977614033499834,12207569276556269772,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,2947867519776717104,6223098681912294325,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1224,i,8993755799319028910,16805269408756741965,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2112,i,3193814631456991505,13668740145230361521,262144 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,18437781920594308727,9175090205214246299,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,7062557389231418125,15394309622004836759,524288 --field-trial-handle=1996,i,12098041536005490679,16716614443007514453,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4640

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\autocad\" -spe -an -ai#7zMap15002:74:7zEvent9233
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5816

C:\Users\Admin\Downloads\autocad\autocad.exe
"C:\Users\Admin\Downloads\autocad\autocad.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C311DA9E-8979-7DE2-6506-F10A1DEEE9B2.txt

Path C:\ProgramData\C311DA9E-8979-7DE2-6506-F10A1DEEE9B2.txt
Size 64B
SHA256 3a1220b086d46600c7fc08c7fbe41b0efe2c1af046ed152a3de150eaa3368b9e
MD5 e859f3d0a81b4681c96b1097ad463288
SHA1 526d44a6e24c828dbf1cb0a8e344977284f11e1d
SHA512 9762582cd000f37b25dc3dd6ef3667ad295a54ba3f64ded88d06efed1f2f69149e0e32e873aa3e26e8b768fb2b300663a82cfd0da934dc8cb961560616deb8b2
TLSH
T1B8A002756104B05B0085D43DE7E1D1534C8BB4865719E1AD126F53611C5A145CB92142
MD5 SHA1 SHA512 TLSH

Submit Download

C311DA9E-8979-7DE2-6506-F10A1DEEE9B2.txt

Path C:\ProgramData\C311DA9E-8979-7DE2-6506-F10A1DEEE9B2.txt
Size 64B
SHA256 eac8fb446b702db80f463249997d0c5c6481bbb86e948715f1ce9c04c3cfd8ee
MD5 9d1c67870859820ad2b7ae9867541704
SHA1 1ed61ec12144e279e028e19db7c968f6f8219554
SHA512 dc097d16eadc297408e1c40bfaf27d8a175d68dc2da16b1f32add0ae69df771dc5804e30603b85e3ef99569a69d11fd9df33a03e622c1b12c1a20a0f56f8629c
TLSH
T1E1A002854054D66CF59B3AA81644ED451845A56F3D1062CC486F96CC4D575A424AC248
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1877fbc0c43a45e793044a62162a5fb8c5c9dacc6820f192e229549bf23e282
MD5 d7f6a0a3a239b65bbc4d7200cee11fea
SHA1 bc633583358feec3947b57794222463c529d6a40
SHA512 ac97a2816b8d8e6c559e30dec4991e0c20f54b4e6f42611680d63a9ff163e987f62a0d16d6d81e1b2ad20caa1759922ad0c71c527bcd24a2b835bea2edb0a9ba
TLSH
T171D08008A2777C30C4A8D470244F7B453919C5774653571558723D685C6305114469D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 693630de12772afbca58d0e311382ac6546952d2c7417697c9cf04290bb383f7
MD5 650f9e39d68dc868fc760e52f68f7fb5
SHA1 8b7b2b313c1da23b2f296a7f87709a346e2744fb
SHA512 98ea53683e8cb8bc12fffcf18d524224e29f680dfca75b769a7dd80a6420fb8b47b781e800f0fc1baa2bdb4aa711d5432260a9c09219b84450a279883f25dcbf
TLSH
T140D08004A2737C30C494D470248F7B453A29C5774653571558723D785C6305118469D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 50bd91a9f00acaf636fcb30f96be804914a5534294c6c4e31855705e1ccc022f
MD5 9b65c4eec6db8669f9f1437b0b049f7e
SHA1 810514c88eb98b9069738b6e0a6d35b4cef41eca
SHA512 e1fd4585e0dc0b52115875c72124f795039dfb009e3cdb2a190038ee5a2647afb432da9c46b8ac8deec7b8fbc6bd9c88d110627a2803b8123ce1173eac2cd4e5
TLSH
T17DF0F9B9C920AC3719FC0B1C61550B4BE79013673A91455F3E3D910D4FB163B8546C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cc2ee4db05d26ef90c82837c928587d82aebc3dc8291163ec296b04ffae4f18f
MD5 53b2717c059fbd8b593da09fc6495308
SHA1 3b1e2602f10d3d1ce0552f0e61b8bc890d6f164e
SHA512 0a2e9021e8b6f72489328de2121eaaeccf10ad7814d381714317724c5d786ff377d30d2a858e82d0eb7c7d87d10dfd0473363b40aabe008fd741afa6fcd9066a
TLSH
T14C51FBA08996866AFBFF42704AE73151337788E856463F5826EBC1BCAA47B131137038
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584c27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584c27.TMP
Size 2KB
SHA256 1e20215a44e2d2d10340faa76367b94ceb896746eb81da9a4a237752a4f2d817
MD5 dc71e9d85777289a1770859697e25211
SHA1 6a4d7463c7946e0e1895438ba7d7c1f6d35762b3
SHA512 569b2e233160656e5eb774baf618ac975df417ccc347e07ee1a61f3dc57b7e193a4b601aab86799ee62419537b45c77e3f3b2944b640977bfa176ce26a4f1682
TLSH
T1BC510AA08986C51AFBFF42704AEB3151337788E846063F5926EBC1FCAA47B131137038
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 105KB
SHA256 a3e0ed3b7b22eb63f8d684039026c6d1cf309dea226c1060864a6dde8ef4297c
MD5 35ae3b10ff09df4a55dc35b6a13e7f7a
SHA1 fe687665d50274195c09df8c0da43a3281143963
SHA512 6e0f0955ecc244ee48e49a902266addd795478331bd0f0865b92d66a08f660efe55cd0ca570f6116b5ba85970c359854e921faf3b517b566cbdc2ec1c6e7719b
SSDEEP 1536:IEpH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:rHSRhPjU1
TLSH
T172B35227D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8421b592-3c09-4c48-bb8b-04c97e7e52ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8421b592-3c09-4c48-bb8b-04c97e7e52ac.tmp
Size 1KB
SHA256 ee95e44ed6e70b2d5697784e49a838128e6879579643504b91b16bf6b7eda57a
MD5 9c2aef9e554b03b675d08a73f9df06e6
SHA1 43c1f1b10f11dec2c88764beba7e8e23856e2677
SHA512 ff1db95c96963716a96820d5813a8c261cb87b7451f4360b8f3fc71cb07d7fda9d45b5ca6653419a4cf22b426ecc45a9b5cf1ac36615073c64d53ad4c3897bf0
TLSH
T11D31E0F3C3E8953D8A1195F0A6187F2BCE690955932C3D9EC4E49E0F93E28F5E14085B
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 f1ac95813934a157dccbc3f20ab9538b77de5bb979f91a2c3260f11079afdedc
MD5 a8eead4ed7cb2c37de753aaf71b0e353
SHA1 757855c8be6e23800c10b587ef41374cee202e1b
SHA512 427f63b5c3e70688ce342d11d1d5a869725632e0eaf6336a8ef4c6eac132b25c82b797e67a9e07a5157e8c113d6c28e66b5d921c3968472cd7dac8689859163f
SSDEEP 48:T2SLopFMatSaw/auUOt8B7XOGUXOgBjoXZWwR/zrvPO1KwH:iSeMatUaAKjg8WQ7rOoA
TLSH
T10A92841E1F343211C0B65FB6DED4495F2F3D142CC3B32656DA1414F38DA2A8AF00B5AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 06908f645c27bbe470c0452194b3999631b592f720ba53389850fb6bb8171378
MD5 99996edd4df34c881198a1ac3c057421
SHA1 0ad9aeb9683cf93280ebcde9568b3f199d1b25ba
SHA512 7d148bf5fae5a676557088858c837a3ac617d7897aabbb7f09fe3b5ae30274ec5de7ae958697bd23ae31864db9db6033475dbf3a3f313b971bbf5115342e351e
SSDEEP 96:DV1OuC+ctcld+Os8zPXepuCUuCXkcqn5HdcFGj6Ziw08j:DV4f+ksd+Os8rXepfUfXkdn5Hd6Gj6ZH
TLSH
T1D3A1A0F7C2E8866DD91155F0AA187E2BDE5D0914432C3D6EC4E8EF0FA3E24B1E24165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ac44d28782a5056a192d5e0a4b355e962257fc6e9128c615c1372307e3b915f8
MD5 53c00191e802d607dc6e7f023ee19c29
SHA1 886ce14cfc0af1c04aa3f514a7db144b1cfb82be
SHA512 4afe4de9062c3192fccc36d08712a88bbe2199d3b40a9b9eaa12151aa86e8d8a0f13b229459057707577f5e3bef57c06e9730175af6e2cb1ca6a23de701e1c05
SSDEEP 384:sxZntqFi/f0s4l5YRTNtHbi/eB5YVZ8Bm:svcFi/fIYBXHbYeB5YVZb
TLSH
T1C772E756A6385977CCD7D219FA857F93D7F81563A1904E489AFCCA0C04E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 412b28c3382cbf15d16e78ae9e35a76c9f7b7b86149158d4837713ebb9c3778e
MD5 1ad6aab0f896feed4fedc298273628c5
SHA1 2fca8dc3a1aba25f7912898a8b5033e03d8143eb
SHA512 420968d3822b32ee66547098383033a5ae58ae3bec211e82aa8f1a6576d3113cee523e24f8b1775e6206d29473c3c0814ccf189eb2afa92e389573e29bc23d57
SSDEEP 192:sxZnRyyMqZ/K1Ml8M9i/f0s4vd5gGhyTa6RQvzodpiNkHW6+WNXdif/egRhYzxY7:sxZnt1i/f0s4l5gRTNtHbi/eBtYVZ8pa
TLSH
T19172F8566638697BCCD7D219FA457F93D7F81563E1904E48AAFCCA0C04D6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9cee8fd16c518bc7965a88fef604bc17d3cfe9defb1728309d3a06e30f39daa3
MD5 d165dca25bbbdb77e5e23407a19e0fef
SHA1 0c5e2b2eef6c7b75df5f5075670b77ddd9021006
SHA512 8252eb617f0880d97add8a8a4b1de6054de746d85443f6cd8cc9853b0bb8a8cdc144118aa15737df162afac33f323108c5c47f177ed22f964dfe27bdd8ef395f
SSDEEP 192:sxZrRyyMqZ/K1Ml8Mki/f0sQjvd5gGhyTa6RQvzodpiNkHW6+WNXdif/egRhYzf4:sxZrtMi/f0sul5gRTNtHbi/eB7YVZ2ja
TLSH
T16072E7566638697BCCD7D219FA457F93D7F81563E1904E48AAFCCA0C04D6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b40c15c358af304a75b274c9fac01da602c0105eaf2c0717bbd37b55d76b4eae
MD5 bc6f1ba19d3d90443ce1490ad4fb2356
SHA1 034d0fdc1c5e13b6f2510ad5ee0b866fede9f5a8
SHA512 c447a1db45a983de7fbe4459e7504220de6d731f5e5d0d6a98d22f64e058d39bb1f9d26b6f924be34a46681c9e6027ba173e9e7b3978ce4ccfaade6cf21a1f94
SSDEEP 768:QyMj2O97pLuL/OmWvOKvC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjj+xLlh7WxLrof:QyMj2OrE/OmWvOKvCu1jaSj+xLLqx4/X
TLSH
T181F2FB3B284CCB7A4F844E9CDC2A7E8A7DE801CF96D8895447FA884C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 6ff3c9b05560bce61d35347f2c40f401fe8c16eaca1f5237a53f6273b891b5df
MD5 cf0ff36bc4b61908cf53ef0273956ecb
SHA1 e5df8065b10f8b37c80a68c2177ac4de3a7264ff
SHA512 407d2d5c55975e4f5c2a685a7f6b5ee27551220e5540847385303d4d569534c4c238c0cd61a8c8474400ba5cfabfa8213dff6c59f1ed16ae9a9b6468a9b2f15a
SSDEEP 768:Q1Mj2O97pLuL/OmWvOKvC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjj+xLlh7WxLroe:Q1Mj2OrE/OmWvOKvCu1jaSj+xLLqx4JU
TLSH
T1D4F2FB3B284CCB7E4F804E9CEC2A7E9A7DE801CB56D8895447FA884C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 c898e0d3d91be8bbd14dfe5f3b7e54cb1006d78a6fb5d9dcd27692241e1f39c9
MD5 775e54c4d9db10efd65a264fcc06e0ce
SHA1 e8cb8ae31e94a69a01be5d1a3aa59f0b0d9c0eaa
SHA512 1f53dd5e1eb3d732b2d53af2f5649b47c3c11861a045034fa9eaf3668f418b576b5d796a7d8e5896090ac0addb75c3bb902f58591a8824b2d1dd8776b0a0473d
SSDEEP 192:sh1WlDub/kDnmtTYB19srn97bQHSr/54UdaVtq/5bfsRLSzJNVg:sHWJujkjmxYpYTslSFN2
TLSH
T1F7B22611323A02803A7EB9CA8195B95F46C370737158E42B7BB914A64F6BE21DDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 f5956d681a31d82295b43533693670f249ad8d6c307476c9fdbc2c06b67e9ba1
MD5 fa61d38db4fb7747d7ae36eff1de7d7d
SHA1 c72a237166e02dd70b508b173b19aeb4e01501cb
SHA512 21b34deac0230f8c835408c1915d435a863edf4b0528ca5ae4bcab40f224e30279e82edf31c71d1705a2e87ebe29d73006a58b8b1ff477cb0b54284e43cce582
SSDEEP 192:P+xWF5ffT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxkfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1BB24630A7B747001EDE6D9725CB080771E3CB16ECF22A6915DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 92693493fb1f8f7e27087e45ad8a0a24820c12906c13c4d7ce32e5175454311a
MD5 62177a8f080aa7583dad2e8211d14dd1
SHA1 bb7eec57cae199eac99a3796953b22cb7c35a934
SHA512 704afe095e072fabac3f128a400221b62a6cdab99c9c9ceac00abfa8315f3e330daa91bbc4f799fde3e5f23c673d7982e35c50182970444b83728b3f1be85a6f
SSDEEP 384:nTyiFavqMg3sNG8TUNTUlImkrOgU+Tn+03zz4fbY3kZjO8VaXeKVRYV/Vw1mRDCu:T5Fayv3vwg2aeYUZjO8meyRYk1mh/0Fw
TLSH
T1B7C23935EC58CDABEDEA9FC9A70A7A03DEE01167C59C4AD8DAD81D1E00D719E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0466ea4114eeff016d075f4a6ab108f985b035883e208dd46009eee7faee5f41
MD5 25ce0fe64331cab38c651ddb5e209b9b
SHA1 925040b50f0d36473b60e7578e57168fe4582279
SHA512 77693cedd5148bbb16aaa517cd58b5c20c660f7393b0e9f4a4556ae84a932431bc47e4a36e68f3d735cafac13644158062be190733370211320285918e7080e0
SSDEEP 384:nyyiFavqMmsN68TUNTUlI4kSOgU+9nruG+z4fbY3kZjO8VaGXUD+Utp7KNAUZhux:y5Fay37wgnO1YUZjO8Dirtp21q5gA
TLSH
T139C24A31E868CEB7F8EA9F89E34A7643DEE011A785CC4AD8DAD91D1D009719E134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4d61d157f9bfd335a018c014563c1ce4ef69d1c0d6b0444a5c2ba50c1a61a48c
MD5 1ce8474e9ed5a3f20305a6fc6d613aae
SHA1 41a0d762865f0bc0dd48411b012de8c9711a812a
SHA512 36c0d5335742a29df4e7f73b0b2dda30da07a3fec5507df0230a1bf4b63f79bf8d6624ceb1d2a1507ba270c5deb2171d56170955260edefcb44de795394ffa55
SSDEEP 384:nRyiFavqMVsN68TUNTUlI4kSOgU+YnruG+z4fbY3kZjO8VaGXUD+Utp7KNAUZhux:R5Fay47wgnB1YUZjO8Dirtp21q5gA
TLSH
T1F7C25A31E868CEB7F8E69F89E34A7643DEE011A7C5CC4AD8DAD91D1D009719E134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 09d804937d19fb94180699fee3a8bdfee4adb024c1dac0fe3dd1134155108722
MD5 2f0659b0ed4619808e51c8a998b902b3
SHA1 bd45cf52c1872c34dc2a5fc068fc7839e3a5c14b
SHA512 e4799c804abfac3fe121d75d8544a0a8d99a77d03347a3a412100a0ccd48979a82db71d862728414a56a3d407986aa890006193dd947c6d296057024fb3a7b47
SSDEEP 384:nRyiFavqMMsN68TUNTUlI4kZOgU+YnruG+z4fbY3kZjO8VaGXUD+Utp7Kay2Z4rV:R5Fayx7wg2B1YUZjO8Dirtp2ayIsV
TLSH
T1E8B22971E858CEA7F8EA9F8AE74A7A43DEE01197C48C4AD8DAD81D1D009719E134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7a9bcf48e187e1022d1e944f5a49043cc724dd0396e89624527586ba135ba610
MD5 ceb795339c64aefebe1f1ff0abeb64f2
SHA1 4a9a463924ba089efb88bc75abe90fd1419c3cbd
SHA512 c80ad180d4e29e3715226a6ef44aab5ea1bf643ca4914e32490bd17475b53df7ca92120a80eebdf2d6faa386f7bee1e3606486d2c35979e78e3f025f2dd5ecae
SSDEEP 384:nyyiFqvqMJsN68TUNTUlI4ASOgU+9nruG+z4fbY3kZjO8VaGXUD+Utp7KNAUZhux:y5Fqy87wg7O1YUZjO8Dirtp21q5gA
TLSH
T1EDC25B31E868CEB7F8E69F89F34A7643DEE0119785CC4AD8DAD91D1D009719E134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 e83333ef364db9374b89b6a7a69c2d3020aca5e778d71abdfc5884e9dd1c69b2
MD5 b1e8ba58c16c2f2f83b268d922138d0f
SHA1 9ab8e2944ba3fb7b3bf028731395c4737a6e972c
SHA512 73c6bcbea62a26018907461a1f9f652e8ef6f122f21f8fabf543de2bf1da8b25d4ac53f843d4abd3f22e79d3cb0425770d8881e9fa8bb957bb411cc9ef3fd7ce
SSDEEP 384:nyWiFqvqM0BsNic8TUNTUlI4ASOgU+9nmuG+z4fRY3kZjO8VaGXUD+UtIJ7KNAUE:y9FqyXTcwg7lXYUZjO8DirtIJ21q5gA
TLSH
T149E2A2F198D78976E89E4B87A37D6D429EBCC153B4884988F7D41D0CCC961BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 859fbcf1506521fc002c9e56ca19d449c84880e05ee26de14dd0e0a89f74d9be
MD5 ca49f8705b9924f1ffee9efef885c3d5
SHA1 1418d9d5b919428dbd092bca4e4b80cd85c590bc
SHA512 84c544259c84ca684083b6d0d5f12acf3eef21d8b6033654d793cc99f7f9623e31df3a872a0b0621eb8dc6b0cfc502500547d07e186e039c989277e6a2ac9ff0
SSDEEP 384:nyWiFqvqM0BsN68TUNTUlI4ASOgU+9nruG+z4fbY3kZjO8VaGXUD+UtJ7KNAUZhQ:y9FqyX7wg7O1YUZjO8DirtJ21q5gA
TLSH
T1F6C24B31E868CEB7F8E69F89F34A7643DEE0119785CC4AD8DAD91D0D009719E134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fd48e1342ea7072d20e1088176cbe47085ddcb8ab61d5e46d924cb2d5d35d80d
MD5 1d3447e72f0e8905ddf8cb012f77608e
SHA1 882cbfd3eef0f4ea1dbe42458e1ad45fb4942736
SHA512 d2bc7a263b80f40578ae811289a016ba47b79b693dc289af5a9312022f84ff706a60a85cc75ca1de715534f08463a83debdf9554b8eb37781a4b10ed2285b00e
TLSH
T1FA4160D04C3D66E2D4BD1E3EA08738FCD5DCD622F4A4357A2854EA88463AA2D648503F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ac47b9b5ec6a19270437d1d32b6f8ed3b0fc171db937e17d64a3cd9641401412
MD5 e6dadca9f082e9919eb61f94bad99735
SHA1 da3d352d3b643c622d4a4e6294bec4b0039f51f2
SHA512 0eb8c258bd3b1f6de024dda01d2b662f0a08ad1ad6278c38cb2d7e316801d1400e46190cc175eddab9277def20e1d5cadb10c7a7fee5244b81fc24f65c15362c
TLSH
T1444160D04C3E66D2D8BD1E3EA08B78FCD1DCD626F4A4357E2C54EA88463A92D648403F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ca35138f27b6ba9a98d11b9b70de7611714d8e35d59685f8059956d438e34672
MD5 c31f360ade3c09ffd701b0974899165b
SHA1 916d36590427f2d8b6926af90cd8a9b5fbeecc0e
SHA512 54d0c18332a76ff4b16f91d056524cf11b35e3b57f480387f2aebccf71ceea4b0596b600b482500cd860b9e7a76c0387bf5f542eb565bc15a204959a8222b6da
TLSH
T1ED411859A5E91148B3B77E56ABF6986E887FBC732F4AC49D10010E4E0A66B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

autocad.7z.crdownload

Path C:\Users\Admin\Downloads\autocad.7z.crdownload
Size 14.2MB
SHA256 02dbfd5ec074aaabc6710a1d0f71bcf1a00f46b496551934f9c21e2b00705867
MD5 4c5bcb28b7f201c485011eacf5b83790
SHA1 8b69ffe34cd91e1cc485f8ac6b4204b8abb5ad30
SHA512 759e8f1c8e663e90d15432c3e16cc5a913c84660a353fd13c0685d441243fed85e808936374682874424d56d4d6495c4c1a0f6e6f295dcc8106f461cd96bd28f
SSDEEP 393216:5nWbY4VBYsHt/wG6ulY2wPfkCgo8JGmf0aMglLnO5uJaGT:KY4jZzu1UCg3rsaMgM5uoo
TLSH
T196E6335D50C1AB1E749EA38519DE7A03F973AE657E490DBD2A0C3C99B524C2302D3ECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4552_720946989\edge_checkout_page_validator.js
Size 983KB
SHA256 24e61bd2cd840f1d0c31b656fda800ad032e71850768d77b04fc45c65ac1b3ce
MD5 11d46bdcb9f1d19a351b2ff865b9b0f2
SHA1 2b498365ca6530fe83eb376740a2c0849e08bcb1
SHA512 2a1acca19f93be135db3a81aa55c64e44f7f080f91d8d32ef8e8ec6eebc8e7dda7bcd064cb2e5ca16d5960b47bb4a204ff88e0ea71e8dca11cfa24dc6b06cd78
SSDEEP 24576:cs41mRAps6vGNkrQAQHAQUwzEB4hWQtDBLIfIeBCs6oam5dXKLRzMEiJsfasHPZ1:cs41mRAq6vGNkrQAQHAQUwzEB4hrtDBt
TLSH
T135253C84E1E2253466D74CB960B7D2C4B9DC04583399F1E8FA6C588ADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3008-370-0x000001AB1A950000-0x000001AB1AA7B000-memory.dmp

Download

memory/4152-232-0x00000273D5200000-0x00000273D532B000-memory.dmp

Download

memory/4488-368-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-376-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-358-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-357-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-369-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-360-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-364-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-361-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-401-0x0000017CF2580000-0x0000017CF26AB000-memory.dmp

Download

memory/4488-363-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-374-0x0000017CF2580000-0x0000017CF26AB000-memory.dmp

Download

memory/4488-359-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-365-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-366-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-367-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-362-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4488-400-0x0000000140000000-0x00000001400CC000-memory.dmp

Download

memory/4640-275-0x000001E57A410000-0x000001E57A4B0000-memory.dmp

Download

memory/5816-332-0x000002CCEC050000-0x000002CCEC0F0000-memory.dmp

Download

memory/5816-321-0x000002CCEC050000-0x000002CCEC0F0000-memory.dmp

Download

memory/5856-372-0x000001FFAA3A0000-0x000001FFAA4CB000-memory.dmp

Download