vidar | a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b

Analysis

max time kernel
149s
max time network
120s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/04/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
Size 225KB
Sample260430-3hlmhaaw5x
SHA256 a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b
MD5 744c0cb7b4a3a981f052f628a047dbc1
SHA1 88633d3981c671b726428c552ca0d456aab08987
SHA512 f646db44a63b7af63947f0a138dc3861bc46972e2577e0d251a5b3f3bb20b660d9f6fba2c5f3c4d32f6a8ee87fd50d39b52e9b2f4ea0ae615d7aaa467b4864e4
SSDEEP 3072:PPEr14JQfpUFueVxJOhOE4STfxab+dBoOjnwKOq0fSB3sA/b3qDpcLDXGo2g+Uc:XER12VxJOV1TM+BowOq06b/ba8Ko/g
TLSH
T11934126B41E5DA23D0E8E0F6037C2994A2DE35131B55ABCBF82956C145F34E9C81D8AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery vidar spyware stealer trojan upx

Malware Config

Signatures

Family: Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Detects Vidar Stealer 8 IoCs

stealer

resource	yara_rule
behavioral2/memory/764-3-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	family_vidar_v15
behavioral2/memory/764-18-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	family_vidar_v15
behavioral2/memory/764-24-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	family_vidar_v15
behavioral2/memory/764-86-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	family_vidar_v15
behavioral2/memory/764-745-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	family_vidar_v15
behavioral2/memory/764-930-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	family_vidar_v15
behavioral2/memory/764-942-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	family_vidar_v15
behavioral2/memory/764-948-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	family_vidar_v15

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/764-0-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	upx
behavioral2/memory/764-3-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	upx
behavioral2/memory/764-18-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	upx
behavioral2/memory/764-24-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	upx
behavioral2/memory/764-86-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	upx
behavioral2/memory/764-745-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	upx
behavioral2/memory/764-930-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	upx
behavioral2/memory/764-942-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	upx
behavioral2/memory/764-948-0x00007FF60A720000-0x00007FF60A827000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2008	chrome.exe
4452	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134220655152044058"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{8819DADF-D5D9-47D5-B2FB-3492CC25632D}	msedge.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda1400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997f000000010000000c000000300a06082b060105050703037e00000001000000080000000000e4add325dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
4296	chrome.exe
4296	chrome.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4296	chrome.exe
Token: SeCreatePagefilePrivilege	4296	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4296	chrome.exe
4336	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 4296	764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe	78
PID 4296 wrote to memory of 2928	4296	chrome.exe	79
PID 764 wrote to memory of 4296	764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe	78
PID 4296 wrote to memory of 2008	4296	chrome.exe	80
PID 4296 wrote to memory of 4344	4296	chrome.exe	81
PID 4296 wrote to memory of 4344	4296	chrome.exe	81
PID 4296 wrote to memory of 3684	4296	chrome.exe	82
PID 4296 wrote to memory of 3684	4296	chrome.exe	82
PID 4296 wrote to memory of 4592	4296	chrome.exe	83
PID 4296 wrote to memory of 1608	4296	chrome.exe	84
PID 4296 wrote to memory of 4592	4296	chrome.exe	83
PID 4296 wrote to memory of 1608	4296	chrome.exe	84
PID 4296 wrote to memory of 3008	4296	chrome.exe	86
PID 4296 wrote to memory of 3008	4296	chrome.exe	86
PID 4296 wrote to memory of 236	4296	chrome.exe	88
PID 4296 wrote to memory of 236	4296	chrome.exe	88
PID 764 wrote to memory of 4336	764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe	90
PID 4336 wrote to memory of 5920	4336	msedge.exe	91
PID 764 wrote to memory of 4336	764	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe	90
PID 4336 wrote to memory of 4452	4336	msedge.exe	93
PID 4336 wrote to memory of 968	4336	msedge.exe	94
PID 4336 wrote to memory of 968	4336	msedge.exe	94
PID 4336 wrote to memory of 968	4336	msedge.exe	94
PID 4336 wrote to memory of 5380	4336	msedge.exe	95
PID 4336 wrote to memory of 5380	4336	msedge.exe	95
PID 4336 wrote to memory of 1308	4336	msedge.exe	97
PID 4336 wrote to memory of 1308	4336	msedge.exe	97
PID 4336 wrote to memory of 1308	4336	msedge.exe	97
PID 4336 wrote to memory of 1776	4336	msedge.exe	98
PID 4336 wrote to memory of 1776	4336	msedge.exe	98
PID 4336 wrote to memory of 1776	4336	msedge.exe	98
PID 4336 wrote to memory of 6020	4336	msedge.exe	100
PID 4336 wrote to memory of 5404	4336	msedge.exe	101
PID 4336 wrote to memory of 6020	4336	msedge.exe	100
PID 4336 wrote to memory of 5404	4336	msedge.exe	101
PID 4336 wrote to memory of 2004	4336	msedge.exe	102
PID 4336 wrote to memory of 5016	4336	msedge.exe	104
PID 2004 wrote to memory of 736	2004	msedge.exe	105
PID 4336 wrote to memory of 444	4336	msedge.exe	106
PID 444 wrote to memory of 3572	444	msedge.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe

C:\Users\Admin\AppData\Local\Temp\a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe
"C:\Users\Admin\AppData\Local\Temp\a5b8dabd89abe68be2eb8f5739d1b3ed849f8bfae4266ca3c2d88d166e32791b.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb5a1c728,0x7fffb5a1c734,0x7fffb5a1c740
    3⤵
    PID:2928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1400,i,8796493022242658665,8236631811505928474,524288 --field-trial-handle=2088,i,8733601101098156169,11177893804503909002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2116 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,3581848471945021332,10846300182052216251,262144 --field-trial-handle=2088,i,8733601101098156169,11177893804503909002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:4344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,16349084630836932342,11870262861341877429,524288 --field-trial-handle=2088,i,8733601101098156169,11177893804503909002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2536 /prefetch:13
    3⤵
    PID:3684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,1157798044039010057,17757877779957316939,2097152 --field-trial-handle=2088,i,8733601101098156169,11177893804503909002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,6165843979362721772,7566361609644703642,2097152 --field-trial-handle=2088,i,8733601101098156169,11177893804503909002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:1608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4212,i,18336722980209590934,18047402768150174424,2097152 --field-trial-handle=2088,i,8733601101098156169,11177893804503909002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4172 /prefetch:9
    3⤵
    PID:3008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,16761699360375332638,5720951975581238125,2097152 --field-trial-handle=2088,i,8733601101098156169,11177893804503909002,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4656 /prefetch:1
    3⤵
    PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x324,0x7fffb165c188,0x7fffb165c194,0x7fffb165c1a0
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,8389656579831347417,17666986186127911659,524288 --field-trial-handle=2260,i,20971303472846622,13011358443091785934,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,7709573132597642698,16430355231989145140,262144 --field-trial-handle=2260,i,20971303472846622,13011358443091785934,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,11058644140686994875,10786956839605978345,524288 --field-trial-handle=2260,i,20971303472846622,13011358443091785934,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,16225057575650902277,3417516440954371371,2097152 --field-trial-handle=2260,i,20971303472846622,13011358443091785934,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,18259688021646390578,14514853474708070782,2097152 --field-trial-handle=2260,i,20971303472846622,13011358443091785934,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,17667284505730635129,12779004720305318682,524288 --field-trial-handle=2260,i,20971303472846622,13011358443091785934,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,7991018048425766818,10217475281520023945,524288 --field-trial-handle=2260,i,20971303472846622,13011358443091785934,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,7588165916361934800,13958582531175668831,524288 --field-trial-handle=2260,i,20971303472846622,13011358443091785934,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,14759852000506090343,1010524263618916121,524288 --field-trial-handle=2260,i,20971303472846622,13011358443091785934,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,14759852000506090343,1010524263618916121,524288 --field-trial-handle=2260,i,20971303472846622,13011358443091785934,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
    3⤵
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,2434041934111924308,17086569658235027502,524288 --field-trial-handle=2260,i,20971303472846622,13011358443091785934,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=592
      4⤵
      PID:3572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 55630d27e22e232b4f4309954f76e6c3a76b1064f6c64a322a5346c1788d4a65
MD5 bf3e2cdf4a45a8b856d3eb03e4db404e
SHA1 bdf663771907b94d10cfe4b3e0f6170d8af42e54
SHA512 230ccb8c793ffda7dcc96118d3a5880c15eda32cc10396152c230532d79b66a0a8a68ad065bde565e06c7e127f3acdceb3fac563d2883833e35e719ad0540df5
SSDEEP 1536:ubOP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNJm:B++J3qUQm08KMWF0bFTcVHr6zqm
TLSH
T1669302B9991E7D79636BC696A0179CAC8CD3DCCE111055BC30C76F0E18BA392E31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20b0f1f0-d640-4ff8-af35-e3741c01f84e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20b0f1f0-d640-4ff8-af35-e3741c01f84e.tmp
Size 26KB
SHA256 d5ce4b94ec744e5db14577785092351540c4ec7a956b10ff5a44f626cfd4a40d
MD5 fb98f52c8d848b022d0ddb98c61b3b84
SHA1 ee1859919fc62327ac8d5abf4312b315bce9271b
SHA512 38727ffa49d1ec4595a5a59d588e2fc4e638fcaa4f21cacf585f27cdc1df5e5e00fb7aa1a909ee5ca0695eb01dd57b63e2bdbf7d8d524c16fe6faa2928cb4241
SSDEEP 384:nEiFavqMg38NV8TUNTUlIxBO2+4Or4LJ26SOrfKYjLjjN7jRYV/Vw1mRZrN1k+5u:fFayv36wgO2Z268YzBHRYk1mzG
TLSH
T10DC25C35EC64CDABEDEA4FD9A74A7A07EFF001A7C48C4AD4DAD85D1D009719E130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
MD5 c5c86d9c5f7c32a8c4fd09d6ffda4aa8
SHA1 8d3978b900d523ba08075019d6235c1e176294cb
SHA512 e14f89cb3354fd6d7a68e1c291c8723a5bfd3d28140a150bf75ef42a2ef8212eddaed6f6db92cd69e603806f0897ef93b8761a51acd8b8db67878c4cf26ee23d
TLSH
T10AD0C040DAF02820D8046471242CF3C00E09CCA1CC43DA2124E0EF798D820C644C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4f20f916a46d879220b75412e974c6df37fba8f0e80e78f071a3124fdb665aee
MD5 aaac91ebbf67dbbc392d45b8ba21b7af
SHA1 c12b368a2d9e5d86e38c050c8c991930b00b017a
SHA512 d7492a4c51ec39a37fa7e0e893db326eb2afa4a19ccab42d34d8b2aa7279aedca2f5868970e4513c37d26caa55dce67a9dccd146446e47298a0c41e59869c2b9
TLSH
T145D08050DEF05960D8046571242CF7D45F59D9A1DD47DA2125E5EF799DC20C648C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d01018acaaf6308d1d104da997833d5e6101ff58ccc471819b85dd7d163b10b9
MD5 2b3c42ffc6d19951375a07d9468ed1e7
SHA1 67101ed264c86eec0493451cb0b58a02073634bd
SHA512 130e8aa32384a771ad65f0896d4bcc6020d55dc2a9f2e995e14605560086247e90eecb7e047a1d588421125d5352469813897908469fdba34eb22f0508378d0e
TLSH
T1B6E02BA6CC65DC2B58F8273870240341F76413972A50898B3A3C820C8F74E37558281C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 28KB
SHA256 2c389d1d31e74681893a1c5c2a4244c4f03e4e4d45ddd092609d900efb6e10f2
MD5 a94fef15645e1f060f47f64eb72e02ef
SHA1 9bf6ce7a263d9aeb769d91b1e57df66512d2e2d0
SHA512 43bb107c0324aefe27b9910dd44111f4a2842af186e96286982053b1add0c4dc082543d2ea98150e4e9fb665fba4445c8cb84aaf8168766057b10cc452b7bf80
SSDEEP 192:isLaSaBIlVk05D3FhrFW3hLjiOXBFloE+naYRIjN24t+NZEEO:iMv0H05D3bFMLjiOXbiE+aVaZEEO
TLSH
T102D206FF2ED0204DF5DB6A3094A75CB12C792043BA03F4BE11BD52615C71AB2BA364E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 634fa8f91f86f8b365c38672167f128a8e685f57e325344e3c6dd23ea8a408e5
MD5 58217e4f73fcf93c6c74dc8518891dee
SHA1 e247b7766fadca789dbbb6aa39a1c1e86ac09376
SHA512 42346588e1a3ee5dfef3fb40a019765ae30fac386f707fc15ce6461fb1bb39bb8c233c067b1484f51282e0f8c259e1f8aef820c6cef1482ebd091f5d99c4e2ed
SSDEEP 192:sxZAQUncRCyMqZ/K1Ml8M4//fTsSfLM4f8VobNA8odp9d/W6+WNBcR/Y0tj1pqI6:sxZGncDg//fTsSTMs2YA5n/b+/5EjJ
TLSH
T1E782E9166928597BCCD7D218F916BB93D6F91163D6844E489AFCCA0C04E6BED3213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41a6118a-7bab-4b6b-93f6-ef0a6b01628e\index-dir\the-real-index
Size 72B
SHA256 eaebdd108dc29bfcadff46c175020a49b17deccc41951da58442fbcce7e386ce
MD5 73d27961fe1cc8501897eb8f4a755cf9
SHA1 6b07ad2a7b39ed9e5cfeb9cf7772ca34f73899a0
SHA512 dd08681856d47e79ec5a48fd5e3dacf69975b48c6818e5ffc7032b261441157b642b0fbbc330cb51fbc539cbfa736f3716a6d400db280fe04f7d047d36e545c2
TLSH
T153A0022101D3C21ED2104B71204157ED73109811551A520150D14F44F8702C24B05028
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ecbc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41a6118a-7bab-4b6b-93f6-ef0a6b01628e\index-dir\the-real-index~RFe58ecbc.TMP
Size 48B
SHA256 76c0af0de044912a4ddb3842af1eb084bb415b3a4ec2aec11c55e77f861ebf70
MD5 03db8f7158456dbfe9f9b1906d9dc9fc
SHA1 403b78f298a978b8be4433e972b7e6bc81f29bf1
SHA512 f99beb84d22ee4015009f9be76db89a4d7c8dd87b4b84f7f4fea97aa8c37926cd4e512a87f1a9eaec308b684c8683b1c3da5352634c805ff2b12942a20c074c8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bfd31c79-dcb3-4a30-94de-98ae2d63164e\index-dir\the-real-index
Size 72B
SHA256 e98b430ddd3c0e01f8d0784aec74f7be41293ce4d84c7b1f87bc5b82865dcad2
MD5 49ec3050426f2d635da3a2739c2b60bc
SHA1 c63498cff9cdecd2041fb316748d3b1f5437d3b9
SHA512 5ce4fd0a450b6f0b021987874d43da914042294ccd7d2ea885bea2930390cc70b3efef30c05c3a845c8b995f283a6d2ec0b25740944058f798f7622b9ac1c44e
TLSH
T16EA0025407C11005C42353F429A70346A394CC34430D730751A15548DC945504D8102C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ee53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bfd31c79-dcb3-4a30-94de-98ae2d63164e\index-dir\the-real-index~RFe58ee53.TMP
Size 72B
SHA256 04d1357629db2fdfc9a7cff956b3c2902e690dafb28c2a665655af11a66e0727
MD5 6fa8e8876860ba31983cb19010de79ae
SHA1 fc98411dbd40b9bbeeea200120f27308b6a9ee4f
SHA512 d685b4a0aff4cbc0333d6a99f4bb53a3d952529a4b5010ccf617fe54dc6af722c0c6e55c6a1827127d3f6791999c25ec44c0bf1902b95bf4f1fd8d5a817291a6
TLSH
T1C9A0021063883006E41621B19F6642431300CC505711160A41D91144CC58852554921C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c62679d3-3ed8-4233-864f-c73e30ee629a\index-dir\the-real-index
Size 72B
SHA256 2ddc6fa66739daf15f7bf81b78e5aea0d88c018d75b8262b3ea36854711ff607
MD5 60c172bd6b355a6e1ec4b06feb7bd14d
SHA1 ad218993c284db31163c77bfaf83f68f974d93be
SHA512 eda93af18e03945c5e18b1a9788bc485ac0aee9335cdca656b4ae824ae70fccedf267a108146eed7730d82dff758625cd3b64d64b6d4091a7f75e731ca0075d5
TLSH
T18AA0023817961041C0699BF1A1420390232CDC5D1345432740D4196A8C65558CD01054
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 2c612667eded755b087c05ce27498d96ae6bfc0113b2c0b4f375bdb5bfc25c0a
MD5 de2889bd15615077f480ca24f392b06b
SHA1 85a9bf8fbe1172e5f091cf5b1da239ab1c66164e
SHA512 d610ba889d978c64e5a91bd0b333a2026fdb9ae2ca5bc4b7545b67b58a8c051485b951d19f15453bac95e3d30146f1cfadba3b490dffae0b74cdcaead85f1091
TLSH
T1D3F05CB36EF70808FD5FD7FA6872446901667C59C501BC0F1417B1DBD0B1319255ECA2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9c94cec0c40f3e03c1c02261f7a4d58d3aea3ad83ba1ddaead02b11e9d2a6a90
MD5 57930ad57a8017c6e206895948184652
SHA1 8a2dab61d7cb35925c84ebd98b7d8c7e753efe69
SHA512 6a1a6fe0351279489da3d5c446aa87817eb782724091b8f6af116abee105be3ce405a062ffa882b3edc9faa75380fa1396450a47abdf117e6b2321f46285357e
SSDEEP 96:KcMgKNqmuzuK8AzGYK7CWiGMKrqkEYKR6kGfOKUMLXaKMg3CWIKnKYfeKQo++Jm9:qD1rjvYZ5V8fO9ddTXkrno9BxnVP
TLSH
T10BB25C11713B13903ABE358A8155B8AF52C271633018E47B7B7904AA4F6BE34DDFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 7ff379c814ab6c17b8246bf9ebeab026c311ab769845c73303cf7e791a2c2b9b
MD5 60ab9496b4dfecadea24b2e535acc800
SHA1 934801ea019cb424da18c4753fcbefe9785a6aa0
SHA512 8879d42e11c790a9e977f69c2feaad782257c3cde83428a8aa74e8e41e7ba6a8d8b50f4c48cc195ec1f6e31c4c680278342e33c56ed07c6594aa0208b52a2742
SSDEEP 192:FvoWXs0fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:af0fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T15D24640A7B747001EDE7E9725CB080771A3CB16DCF22A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf9844a6-daaa-4380-b7b3-0d945cc386d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf9844a6-daaa-4380-b7b3-0d945cc386d9.tmp
Size 36KB
SHA256 a5130726453d361219217a1a5fc9c081664301b4ec295b8d9193218f07800c11
MD5 70affd3360e778299d290938a345a18b
SHA1 9d5e5467cf22851d9820ba307621dd7e9218004a
SHA512 aa77e4a22e7f0c7f242d76e4c486a687c1e750138792b5716c0474b33a07ad00b71854e4ab8444d3582b224a89414749c8530112df057d921c354daff5827908
SSDEEP 768:2DhVP8b320P7pLuL/mKWRmmeQRe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KWWlLli:2DhVP8b320JE/mKWRmmeQReu1jaKKWWa
TLSH
T1EE030C3B280CCB7F4F844E9CEC27BE9A6DE8018B9698899447FA444C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 173fd6fc04b3ee37238e4c22cb3d0525aa8ea662db026577d8b31019d79a5d93
MD5 f00fe90c005df6619cc7c4d3762cd51b
SHA1 f60563ac1f8e7cb1796d140cd9eb47e0e5ed7220
SHA512 966236d9de398b47c702b1419eee078e76eeb93a9441335782b26dfc96f44a9821955d52ae1f4ca5769556679977534ac445782f0ba295911e5ecf84297ba18b
SSDEEP 384:n8iFrcXqnX38N28TUNTUlIRPTk2+4Or4LQS5JOrfKYjLjCAiqtH5jejzSDkJlrN7:nFzX31wgm2ZnpYzCnUH5qLF
TLSH
T114C24B72E894CDABECEA4FD9A34E7643EEE00153858C5AD4D6D96D0D00D71ED630BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3589006dd94c7fc086ea62db8c9b4e27756406eaa2b0535dcc4499aacccc858b
MD5 154e95c9c3a840f0a5094ffc35252306
SHA1 c6ea9b1769cc5cc5a2bfe1f123bf62bce36d385f
SHA512 dd1275c44980c8191264e3a65dd28298c2db0b800b279d6c6e7ec6397e4946e3c44879a0add5a885ce5e2d858beb31a43d5c781390e6dd3ac71250c1c612af4a
SSDEEP 384:n9iFavqMg38Nq8TUNTUlIxBO2+4Or4L6faOrfKYjLjCAiqtRYV/Vw1mRZrN1k+5u:0Fayv3FwgO2ZyUYzCnURYk1mzG
TLSH
T1EDC25B32E854CDABEDE64FD9E74A7603EEF00257C98C4AD4D6D85D1D009B1AE530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eXuFBCGR1T1L

Path C:\Users\Admin\AppData\Local\Temp\eXuFBCGR1T1L
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/736-434-0x000001B408310000-0x000001B40837F000-memory.dmp

Download

memory/764-86-0x00007FF60A720000-0x00007FF60A827000-memory.dmp

Download

memory/764-25-0x000002360D180000-0x000002360D1EF000-memory.dmp

Download

memory/764-4-0x000002360D180000-0x000002360D1EF000-memory.dmp

Download

memory/764-946-0x000002360D180000-0x000002360D1EF000-memory.dmp

Download

memory/764-0-0x00007FF60A720000-0x00007FF60A827000-memory.dmp

Download

memory/764-885-0x000002360D180000-0x000002360D1EF000-memory.dmp

Download

memory/764-745-0x00007FF60A720000-0x00007FF60A827000-memory.dmp

Download

memory/764-24-0x00007FF60A720000-0x00007FF60A827000-memory.dmp

Download

memory/764-746-0x000002360D180000-0x000002360D1EF000-memory.dmp

Download

memory/764-18-0x00007FF60A720000-0x00007FF60A827000-memory.dmp

Download

memory/764-3-0x00007FF60A720000-0x00007FF60A827000-memory.dmp

Download

memory/764-5-0x000002360D250000-0x000002360D25C000-memory.dmp

Download

memory/764-87-0x000002360D180000-0x000002360D1EF000-memory.dmp

Download

memory/764-930-0x00007FF60A720000-0x00007FF60A827000-memory.dmp

Download

memory/764-942-0x00007FF60A720000-0x00007FF60A827000-memory.dmp

Download

memory/764-948-0x00007FF60A720000-0x00007FF60A827000-memory.dmp

Download

memory/764-947-0x000002360D250000-0x000002360D25C000-memory.dmp

Download

memory/3572-449-0x0000026A2BD40000-0x0000026A2BDAF000-memory.dmp

Download