0fdf28371735a3dce97a8c7d401dd316ec803efd173e3b79100bd7472efadb78

Analysis

max time kernel
119s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 752.3MB
Sample260508-2tw2yaa15j
SHA256 0fdf28371735a3dce97a8c7d401dd316ec803efd173e3b79100bd7472efadb78
MD5 60b52504739e9958d4a0f487195ae254
SHA1 f3b9ec56792c3b84eb9ec829cd42cdb711acd2a6
SHA512 6dcc141fd7f17ac6a983a6ee3c2bef6c162233e3f7c949cd8f88d8865b4c3c00757d4919b148f0c9554b2f6653abb5ee52f08ddf1d0c06aa5bd2746fafb63169
SSDEEP 49152:5GdkAGe3/mYh759Zm5oy3duuhxQzmN/fKgWXSxH0APnTcwZS:5iWm/Lhitxx8mN/igWXy/7U
TLSH
T166897C13793940E4D5E1D139CA337263AE26B889973837D31AE19D602F363C05E79B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 3384 created 4228	3384	Setup.exe	79
PID 3384 created 4228	3384	Setup.exe	79
PID 3384 created 4228	3384	Setup.exe	79
PID 3384 created 5028	3384	Setup.exe	91
PID 3384 created 5028	3384	Setup.exe	91
PID 3384 created 5028	3384	Setup.exe	91

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3384	Setup.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4876	msedge.exe
4364	chrome.exe
4844	msedge.exe
3888	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227544923658695"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{014FFA4C-1C4E-4A65-8BD3-342DC0601DF1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
3384	Setup.exe
4228	chrome.exe
4228	chrome.exe
3384	Setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

pid	Process
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
5028	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
4196	chrome.exe
4196	chrome.exe
1596	msedge.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe
4196	chrome.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3384	Setup.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4228	chrome.exe
Token: SeCreatePagefilePrivilege	4228	chrome.exe
Token: SeShutdownPrivilege	4196	chrome.exe
Token: SeCreatePagefilePrivilege	4196	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
4228	chrome.exe
5028	msedge.exe
5028	msedge.exe
1596	msedge.exe
4196	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4228	3384	Setup.exe	79
PID 4228 wrote to memory of 3860	4228	chrome.exe	80
PID 4228 wrote to memory of 2864	4228	chrome.exe	81
PID 4228 wrote to memory of 2864	4228	chrome.exe	81
PID 4228 wrote to memory of 3888	4228	chrome.exe	82
PID 4228 wrote to memory of 3984	4228	chrome.exe	83
PID 4228 wrote to memory of 3984	4228	chrome.exe	83
PID 4228 wrote to memory of 912	4228	chrome.exe	85
PID 4228 wrote to memory of 912	4228	chrome.exe	85
PID 4228 wrote to memory of 2476	4228	chrome.exe	86
PID 4228 wrote to memory of 2476	4228	chrome.exe	86
PID 4228 wrote to memory of 3104	4228	chrome.exe	88
PID 4228 wrote to memory of 3104	4228	chrome.exe	88
PID 4228 wrote to memory of 4616	4228	chrome.exe	89
PID 3384 wrote to memory of 5028	3384	Setup.exe	91
PID 5028 wrote to memory of 1196	5028	msedge.exe	92
PID 5028 wrote to memory of 4876	5028	msedge.exe	93
PID 5028 wrote to memory of 1804	5028	msedge.exe	94
PID 5028 wrote to memory of 1804	5028	msedge.exe	94
PID 5028 wrote to memory of 1804	5028	msedge.exe	94
PID 5028 wrote to memory of 3140	5028	msedge.exe	95
PID 5028 wrote to memory of 3140	5028	msedge.exe	95
PID 5028 wrote to memory of 4672	5028	msedge.exe	97
PID 5028 wrote to memory of 4672	5028	msedge.exe	97
PID 5028 wrote to memory of 4672	5028	msedge.exe	97
PID 5028 wrote to memory of 4944	5028	msedge.exe	98
PID 5028 wrote to memory of 4944	5028	msedge.exe	98
PID 5028 wrote to memory of 4944	5028	msedge.exe	98
PID 5028 wrote to memory of 4448	5028	msedge.exe	99
PID 5028 wrote to memory of 4448	5028	msedge.exe	99
PID 5028 wrote to memory of 4448	5028	msedge.exe	99
PID 5028 wrote to memory of 4764	5028	msedge.exe	100
PID 5028 wrote to memory of 4764	5028	msedge.exe	100
PID 5028 wrote to memory of 4764	5028	msedge.exe	100
PID 5028 wrote to memory of 3036	5028	msedge.exe	101
PID 5028 wrote to memory of 3036	5028	msedge.exe	101
PID 5028 wrote to memory of 3036	5028	msedge.exe	101
PID 5028 wrote to memory of 1080	5028	msedge.exe	102
PID 5028 wrote to memory of 1080	5028	msedge.exe	102
PID 5028 wrote to memory of 1080	5028	msedge.exe	102
PID 5028 wrote to memory of 3136	5028	msedge.exe	103
PID 5028 wrote to memory of 3136	5028	msedge.exe	103
PID 5028 wrote to memory of 4308	5028	msedge.exe	104
PID 5028 wrote to memory of 4308	5028	msedge.exe	104
PID 5028 wrote to memory of 1652	5028	msedge.exe	105
PID 5028 wrote to memory of 1652	5028	msedge.exe	105
PID 5028 wrote to memory of 4988	5028	msedge.exe	106
PID 5028 wrote to memory of 4988	5028	msedge.exe	106
PID 5028 wrote to memory of 1900	5028	msedge.exe	107
PID 5028 wrote to memory of 608	5028	msedge.exe	109
PID 1900 wrote to memory of 3984	1900	msedge.exe	110
PID 5028 wrote to memory of 2508	5028	msedge.exe	111
PID 2508 wrote to memory of 4356	2508	msedge.exe	112
PID 5028 wrote to memory of 2100	5028	msedge.exe	113
PID 5028 wrote to memory of 2100	5028	msedge.exe	113
PID 5028 wrote to memory of 4148	5028	msedge.exe	114
PID 5028 wrote to memory of 4148	5028	msedge.exe	114
PID 5028 wrote to memory of 4048	5028	msedge.exe	115
PID 5028 wrote to memory of 4048	5028	msedge.exe	115
PID 5028 wrote to memory of 4824	5028	msedge.exe	116
PID 5028 wrote to memory of 4824	5028	msedge.exe	116
PID 5028 wrote to memory of 656	5028	msedge.exe	129
PID 5028 wrote to memory of 656	5028	msedge.exe	129
PID 3384 wrote to memory of 4196	3384	Setup.exe	118

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff92a6cc728,0x7ff92a6cc734,0x7ff92a6cc740
    3⤵
    PID:3860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1696,i,16065896651900601631,10958805480291626924,262144 --field-trial-handle=1916,i,1765486655064944132,2479267685724682284,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1912 /prefetch:2
    3⤵
    PID:2864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1524,i,16916037213936856671,2518069335153271975,524288 --field-trial-handle=1916,i,1765486655064944132,2479267685724682284,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2152 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,9413364136253954541,8197941488095005928,524288 --field-trial-handle=1916,i,1765486655064944132,2479267685724682284,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2480 /prefetch:13
    3⤵
    PID:3984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,8488565104040353874,12480620003353774676,2097152 --field-trial-handle=1916,i,1765486655064944132,2479267685724682284,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,9476198102264657843,11012971462520260004,2097152 --field-trial-handle=1916,i,1765486655064944132,2479267685724682284,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:2476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4220,i,1535645861243732734,18399373462791751572,2097152 --field-trial-handle=1916,i,1765486655064944132,2479267685724682284,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4228 /prefetch:9
    3⤵
    PID:3104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,9504891689770999350,12395833436451799235,524288 --field-trial-handle=1916,i,1765486655064944132,2479267685724682284,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5232 /prefetch:14
    3⤵
    PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff925ebc188,0x7ff925ebc194,0x7ff925ebc1a0
    3⤵
    PID:1196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,3621584861802613524,16666900970189818235,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1700,i,5251861983086931383,8018408181214512258,262144 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,16701652227034502634,9353488846588623275,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,12307552418412415180,11200663627959242531,2097152 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8295512752855535678,12570870116332646538,2097152 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4036,i,16241732556681366160,18025227546685200892,2097152 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4088,i,14127924477366701611,17093862800951164341,2097152 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:9
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4196,i,9055528835123262900,4807655400942021154,2097152 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4208,i,16034829200816277611,16903701793583858712,2097152 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,5936227737062306722,16083405027390566120,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,2522616550635587064,7979093333196832690,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,921603416160492471,12612680925670766068,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,10481673959798496735,4569063548743784748,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,8781288811364801231,5166152622627221598,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,15151045890564016260,1685083976653264998,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,15151045890564016260,1685083976653264998,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,15879752494298897749,16077071941292241349,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=596
      4⤵
      PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,12499047179903106418,8161627008205481048,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,14636225994212592596,2570814239460743548,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,9911736944539293173,8346284306883999644,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,995271969380413678,4637859768431129117,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,11347927818090404494,7993642531249638009,524288 --field-trial-handle=2152,i,4075409596419889205,2668614604179570906,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
    3⤵
    PID:656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff92a6cc728,0x7ff92a6cc734,0x7ff92a6cc740
    3⤵
    PID:324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406" --force-high-res-timeticks=disabled --field-trial-handle=2164,i,13207031246095034230,7629169677601524880,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2204 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2164,i,13207031246095034230,7629169677601524880,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406" --force-high-res-timeticks=disabled --field-trial-handle=2164,i,13207031246095034230,7629169677601524880,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2212 /prefetch:13
    3⤵
    PID:656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2164,i,13207031246095034230,7629169677601524880,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:5344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2164,i,13207031246095034230,7629169677601524880,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:5352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2164,i,13207031246095034230,7629169677601524880,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3696 /prefetch:1
    3⤵
    PID:5636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2164,i,13207031246095034230,7629169677601524880,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3724 /prefetch:9
    3⤵
    PID:5644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2164,i,13207031246095034230,7629169677601524880,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3716 /prefetch:9
    3⤵
    PID:5652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4196240674406" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2164,i,13207031246095034230,7629169677601524880,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4416 /prefetch:1
    3⤵
    PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff92a4fc188,0x7ff92a4fc194,0x7ff92a4fc1a0
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2372 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2328 /prefetch:2
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2380 /prefetch:13
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3756 /prefetch:1
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3760 /prefetch:9
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3928 /prefetch:1
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4036 /prefetch:9
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4152 /prefetch:1
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4400 /prefetch:9
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4440 /prefetch:1
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4200 /prefetch:9
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5292 /prefetch:9
    3⤵
    PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4108 /prefetch:9
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5412 /prefetch:9
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5696 /prefetch:9
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=5644 /prefetch:9
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2332,i,15203816989903605676,7071735836745958871,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=6276 /prefetch:1
    3⤵
    PID:5608
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  PID:1764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
    3⤵
    - Checks processor information in registry
    PID:412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 0309e7491123c30348f7c32f08925a04ebb70ed48e039ae99b2b99e6fd2b3515
MD5 3c478319c2d3487fdb1fc72a332b7d0e
SHA1 b9868bb89cacb947434ac243e6883dc30ae3cad7
SHA512 3c2e0232cde136d0842317bdc9c1e3594eaca3a42e8035ce83839775825bc6c4cda8bfe02be30b968548fec5aa5ad1c0308e191c65fe9cd760593f9d79fb84f5
SSDEEP 1536:hZIP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:G++J3qUQm08KMWF0bFTcVHr6zT
TLSH
T15E9302BA9D1E7D39636AC39690079CAC8CD38CCE1514557C30C7AB1E14BA393A30B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9dfa6aedebac0b2a7a6a4b7cf7a5385b714d5fbe36a5f334877adc4e59f7bed3
MD5 3c974a700ca35a09f8c2b49b1532d825
SHA1 c8bfc7bbffa5a8b16f303fb3855c7272f8cd2207
SHA512 d0f0c915c5c5723353ebb14545f03ebb586f6004eadf2c4989a392b096d18eb0d4d7b393ef79d0e5b3d4fcce239d92a12d86c978f01ea96a23a5eccc24d012f9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T1AAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 23dc03dd9d89c856a5e9c589378693751b551d514efd23e1cb56c0cfeb3884f8
MD5 2306e7e017c2d7aa4a8651c1bedc633a
SHA1 60533cca0f485bacf041ec0aee988c103486cf49
SHA512 af316699a79f3c35afd22eb0d7ab14ba455fc98cd9d96a71976ad2365a5fd5e1b22a727f8a8981413b2048e9dade6d3bbf0f07ea31d05048bc1d1c5b0453818a
SSDEEP 96:K84YKhq+mzCKccGiykKzy4lqKek6dLMLtL4LsLeL+LOLywLWLHLBqL8LyKiL3qLv:y7hJfqVJNJg
TLSH
T1BAF12450B13A0341397D298981E5F83E96C235A3301CA63B7BFD41A60F66E25DDFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 9081c80e48d6086db9fb097aa85fa97e89c25321b1c77f8b5c10a9583c971d03
MD5 c306d4e70c1627eaceb86379d8d5c47a
SHA1 202e7f9fb094df23789ff03ea5cfde549a08919a
SHA512 c06aed3b37f7316f2b118e6b64bb16032f54be6097fba5d978e261fa2f1918c815fc53407e2129b4be2a233eb5b9a203394d42e8e3508d3f42e96b2cf1bdb059
SSDEEP 192:Fvo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1DC24530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 19b9e1329c9873c92aff6ff1ad388143b932497e22fabeafad6aaa706e352cd4
MD5 b1b1685dcbdf1a788376d4569955d1cd
SHA1 819ae6357eba1c14e5f2fadfe04fa08070372180
SHA512 be5a73576e21f623cb24edc92b791d2bca313d71615e021e78b6a2e77d5871a699d7a80d119ad283bfbfbb8258f322c475980e701386ef895d3223d9af385f4f
SSDEEP 192:ZGN86Pt3QmiUyKcAqB/Fl8W+yn7rcfFU6:ZGN86FZp3qB/Fv+6gFU6
TLSH
T1DE021A3578786C778EE39E55F087B7235FA4207BDAA45F98DAE41B1D00C769C2303822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d0fefe205671bd130082f3fd23d066c17d350e0902bd0d6896dec0f7619f9294
MD5 86f8339a422c53046406a54fc53ac798
SHA1 985b69d2c406cb27dc73f04079a2523ea1ebaa5b
SHA512 b5bbba474b084a2be748f0699f42eb22515cd8c25737f2341b33ebaf5a291cdb95e81bbcbe252a3d47f7e7304e3e5abf58f204811ebdda6817e67b1376272cae
SSDEEP 192:DGNa6PtyQmiUyEnAcB/Fl8W+y5Hzn45qkEoU6:DGNa6FuJAcB/Fv+UsHEoU6
TLSH
T10A12193568786C778EE3AE61F047B7239FA420BBDA945F94D9D41B1D05CB69C2307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a65c918

Path C:\Users\Admin\AppData\Local\Temp\32a3e017\2a65c918
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3efab175

Path C:\Users\Admin\AppData\Local\Temp\32a3e017\3efab175
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cbca615

Path C:\Users\Admin\AppData\Local\Temp\32a3e017\4cbca615
Size 5.0MB
SHA256 7381bd07610b1eed77cd4c0165df3c57fc6425501815f24a6aa861b770adbb86
MD5 a1fab7a40af7a1961783944e9561f0c2
SHA1 77ba87a217f26db357d00f24c6f04255bc2e7409
SHA512 a1734991e20cff5c06c276ee455d41f374b97a377b06b143ae247927273433c0a2540d9980035375212f9a8e989ebfc31ed2efa27e98575e87f021c12ef88caf
SSDEEP 96:D4k1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ84:M8rJQaXoMXp0VW9FxWHTFs07WQpZm
TLSH
T19736111F7A201150D4EAA132ACE36F562C3F71168A3736933DA4696D4DD0723B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54f4bbdf

Path C:\Users\Admin\AppData\Local\Temp\32a3e017\54f4bbdf
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5983d1e0

Path C:\Users\Admin\AppData\Local\Temp\32a3e017\5983d1e0
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d0ac294

Path C:\Users\Admin\AppData\Local\Temp\32a3e017\5d0ac294
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8febb11c

Path C:\Users\Admin\AppData\Local\Temp\32a3e017\8febb11c
Size 138KB
SHA256 7ab72e9472f8bb9b145eeb90eeaf5cfd7a2a1473026fb8f65f0b62b05f697f8c
MD5 7ca5a2dc336e2e572be282cb8276ce2d
SHA1 7fd8ca1811aa5d681a4b70646e4f7e10373708b7
SHA512 75aa4aa62bac6dfe2100bd441a93475207e6ef55804d58f8e374e41a8dff3d3b0e61843b5db7d71591933f1b2606e7a2dd0e9602f4347b67de46e5d1a5c75296
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2O7pX6Oq4VumjPBwkLl:zeuvBnhJsueMEGvIW1DcP2O1rVumdn5
TLSH
T1F4D3864B3A747002EDE69A722CE0547B5E3CB16D4F55E5D428B620588EF2923A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b23bacec

Path C:\Users\Admin\AppData\Local\Temp\32a3e017\b23bacec
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bee075fc

Path C:\Users\Admin\AppData\Local\Temp\32a3e017\bee075fc
Size 288KB
SHA256 7d4f825333a2ad75d6d9c44a8ebb241e530d86f9cd3aed2f5ed9e3aef59ebff9
MD5 4647f14c2888984173fd0edf650c96ac
SHA1 8598095ac546e9f634b5bf6c7bd71ff25a43cadc
SHA512 fdc65c99aaae4ce510f297563fa3c81bbcc27fb7873ef744250e207322b91e5f4d0f436d8984bd8c3e2336ffe6ddb4d0f40f255a81e57bb8134b396c0c22ab42
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vuHJa9+CO+1:f1zkVmvQhyn+Zoz67fo9TO+1
TLSH
T13954CE47EDC4F10AD70A6830C6455DF27901AB0447815E6BDBFC1E7E1EB264DB9AC1C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eac691d2

Path C:\Users\Admin\AppData\Local\Temp\32a3e017\eac691d2
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4cfcfb8

Path C:\Users\Admin\AppData\Local\Temp\32a3e017\f4cfcfb8
Size 20KB
SHA256 f132e4f2d10443fc8a027f18a907bfdb5e9c31f551a5656a6c2c903822c42782
MD5 580c587f3b76548b597b470d775f9120
SHA1 fc4036272013f22409605702525a443db23fc335
SHA512 ad5e613c87b8cf8c9c7714a6edc05dcbed752f9e727134ef5b8fb25bc4b7e4e8d8515dcd7d21e3fb45eeb7adb8bf3253fc407deb04fc259b9403e819549145d7
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBnwd5m0mEtLvd0qkNqu1Uj:TeW9aw/aHLopFMavU1iBwHlNvo0
TLSH
T11A92508F0F303601C1F8467AE8C2089B1F7C112C8363AA89EE8014F28C835ABF1065B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96fa19f6-8d0d-4307-975e-7a25e418195b.tmp

Path C:\Users\Admin\AppData\Local\Temp\96fa19f6-8d0d-4307-975e-7a25e418195b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9d708677-eb5a-4d78-84bd-cba6f14fb906.tmp

Path C:\Users\Admin\AppData\Local\Temp\9d708677-eb5a-4d78-84bd-cba6f14fb906.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453\Crashpad\settings.dat
Size 280B
SHA256 3be25518d50eb9bcf67ad41bd122b6254b37dc9f56155ccc9b65d9f131b8e75f
MD5 695bf17d44cc1d53409ad34b86f5a86c
SHA1 e7bf4903a7e253606a59d8b40eb99a66d0a91a7c
SHA512 636b09fe102f8f353ec86e60f269b1471dd8f0861897bb7aeebb4e64f6f02b10afd87b68bb614ebe7f04b69f686c2971642aee5a19f0e9fec505c7ae9b1adf0d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453\Crashpad\settings.dat
Size 280B
SHA256 a8274c512f6258d5642972c8d5a19943cb87a58fb39f6099a19d27835e04483a
MD5 b1293abb42768eddd781a3715c9f27b9
SHA1 4cfddb289e432e12a34337a1a08f7b97075c4b4f
SHA512 947c6b09ce9c6b62e0c2e22c637cb582aac8eb4a4d298cb6e5ab29138f7792e52a6db3040a6c7d39a4df2c046ff93123f22c0a262db407669c6a80a564b09cb8
TLSH
T108D022B3BB0C8EECC0022333B030E38C00C8CC08832BE288023000880880000C28C8EE
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453\Local State
Size 4KB
SHA256 e096fa9b1d244964cac75dae58f799a290af55623b61a641ddaead8023789498
MD5 6d2d29c8bfccd13d4e2e21ac867e0fa2
SHA1 0c0cc0ff52261d2ca16acb136a7f4f48b086d26b
SHA512 2b8ea5762d5c7de0e2d90e755f1ef88eac476b3e9110bf3c5a0d22dfefa1fa137e6c0dc50b8c3780d6e10e198124193e2f3fe1cb2f6c2914bc0357e668ba2509
SSDEEP 96:EqGNkZQsFfjvAdX/mMc58Frh/cInURcDotovUaDHB3avXrHn0eUcaSDS4SYSuSD7:vGNtG8e6ocDUwjh6Hn1Y
TLSH
T181A1B7336878ED374DE19E45B48A36039FA59123E7887F95D1DC2B0C05EF6985306C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453\Local State
Size 3KB
SHA256 291b71f265ab2425dbc093022ad45c7a9085ea31e829c3be490d36a763e4112e
MD5 44a28b222eae93feb3ab487197272b44
SHA1 0ddc50e217f0ab956f8e40eb6f5726401bd92bc6
SHA512 1b022a2f572e363715fcb51c9ff2886b01bce5f5ffc4367e24064c182816a98e55ef38bafc191fddc0d018360964e4c8475bd6d009db531a3b99bcf5b1bf39bb
TLSH
T1F581C633A868AD775EE15E84B48A35138E79D623E7547F9151CC230C05FF66C9306C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe586944.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge1596240674453\Local State~RFe586944.TMP
Size 1KB
SHA256 7dd1ce3d9fa57e8fa59cd208ba45d40c69db85e706c7b4136d326e28e7355526
MD5 d299fffe6933a284f2aa90ce216eb5d5
SHA1 e92acc8182a87b53d195e2336c4235bef41cb768
SHA512 4382e40d03c1f4ccb910a4046ef4b42a59552a0507844a33dd420681614bde7ade614bb3d0b121836fe163836240b566cfe8a73ac87536723e4adb9dfcb43f98
TLSH
T12D319371A9AC2D73B8A10B4EB68DFB975E386432A2512B8411EC030901D7A9C1307C3B
MD5 SHA1 SHA512 TLSH

Submit Download

d90b6a50-7a55-45b7-8473-856fc6c8f72d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5028_1276854884\d90b6a50-7a55-45b7-8473-856fc6c8f72d.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5028_1983135433\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/608-637-0x0000020C65E40000-0x0000020C65F2A000-memory.dmp

Download

memory/3384-80-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-15-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-4-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-633-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-634-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-5-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-638-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-639-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-640-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-642-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-643-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-641-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-2-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-9-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-10-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-6-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-246-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-249-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1015-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-7-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-17-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-11-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-12-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-8-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-919-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-13-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-14-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-132-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-313-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-979-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-978-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-977-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-49-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-3-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-16-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1014-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-962-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-18-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-0-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-984-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-990-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-987-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-994-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-995-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-992-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-996-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1000-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-999-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-998-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-986-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1001-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-988-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1002-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1003-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1004-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1005-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1006-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1007-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1008-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1009-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1011-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1010-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1012-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3384-1013-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/3984-379-0x000001AFE44E0000-0x000001AFE45CA000-memory.dmp

Download

memory/4356-445-0x000001C1337A0000-0x000001C13388A000-memory.dmp

Download