0e6032fe7c0b314ef1bd5fcccde58f723f7fc762adf4d12543bf4ed77a37399b

Analysis

max time kernel
149s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 9.2MB
Sample260509-qdd1mscs2k
SHA256 0e6032fe7c0b314ef1bd5fcccde58f723f7fc762adf4d12543bf4ed77a37399b
MD5 3496fb256ec0b348a817767518d1c526
SHA1 8a9a019ec969d2e114842c112e304ca067d91ef6
SHA512 43f644efac79e4f714c9ce766c299964f6b6df63622af966c453f98d30344beba2aaf02eb06dbe9872c9328e069599d3edd48088428a252fa89752675805cf8b
SSDEEP 49152:ACr7/HQMNeGp3AVtEr7b1qJpZvb7QrmztwNSVxsECGP:A8/LDx5IDnBXCc
TLSH
T18CA67B13A89645A4D0A5E336C46BD652AB19B88DC33877C36DE29EF05F313C12F3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 2832 created 4820	2832	file.exe	80
PID 2832 created 4820	2832	file.exe	80
PID 2832 created 4820	2832	file.exe	80
PID 2832 created 3864	2832	file.exe	92
PID 2832 created 3864	2832	file.exe	92
PID 2832 created 3864	2832	file.exe	92

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2832	file.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
884	msedge.exe
1672	chrome.exe
912	chrome.exe
4584	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134228057236494599"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{D45DF2CD-54FF-442C-86E5-1090BCADCED6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
2832	file.exe
4820	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
2020	msedge.exe
2020	msedge.exe
1524	chrome.exe
1524	chrome.exe
1524	chrome.exe
1524	chrome.exe
1524	chrome.exe
1524	chrome.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
1524	chrome.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	file.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	1524	chrome.exe
Token: SeCreatePagefilePrivilege	1524	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
3864	msedge.exe
3864	msedge.exe
2020	msedge.exe
1524	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 4820	2832	file.exe	80
PID 4820 wrote to memory of 4944	4820	chrome.exe	81
PID 4820 wrote to memory of 912	4820	chrome.exe	82
PID 4820 wrote to memory of 2484	4820	chrome.exe	83
PID 4820 wrote to memory of 2484	4820	chrome.exe	83
PID 4820 wrote to memory of 2540	4820	chrome.exe	84
PID 4820 wrote to memory of 2540	4820	chrome.exe	84
PID 4820 wrote to memory of 908	4820	chrome.exe	85
PID 4820 wrote to memory of 908	4820	chrome.exe	85
PID 4820 wrote to memory of 784	4820	chrome.exe	86
PID 4820 wrote to memory of 784	4820	chrome.exe	86
PID 4820 wrote to memory of 4748	4820	chrome.exe	87
PID 4820 wrote to memory of 4748	4820	chrome.exe	87
PID 4820 wrote to memory of 1368	4820	chrome.exe	90
PID 2832 wrote to memory of 3864	2832	file.exe	92
PID 3864 wrote to memory of 3564	3864	msedge.exe	93
PID 3864 wrote to memory of 4584	3864	msedge.exe	94
PID 3864 wrote to memory of 2724	3864	msedge.exe	97
PID 3864 wrote to memory of 2724	3864	msedge.exe	97
PID 3864 wrote to memory of 1992	3864	msedge.exe	98
PID 3864 wrote to memory of 1992	3864	msedge.exe	98
PID 3864 wrote to memory of 3148	3864	msedge.exe	99
PID 3864 wrote to memory of 1992	3864	msedge.exe	98
PID 3864 wrote to memory of 3148	3864	msedge.exe	99
PID 3864 wrote to memory of 3148	3864	msedge.exe	99
PID 3864 wrote to memory of 4048	3864	msedge.exe	95
PID 3864 wrote to memory of 4048	3864	msedge.exe	95
PID 3864 wrote to memory of 4048	3864	msedge.exe	95
PID 3864 wrote to memory of 244	3864	msedge.exe	100
PID 3864 wrote to memory of 244	3864	msedge.exe	100
PID 3864 wrote to memory of 244	3864	msedge.exe	100
PID 3864 wrote to memory of 1316	3864	msedge.exe	103
PID 3864 wrote to memory of 1316	3864	msedge.exe	103
PID 3864 wrote to memory of 1316	3864	msedge.exe	103
PID 3864 wrote to memory of 4844	3864	msedge.exe	102
PID 3864 wrote to memory of 4844	3864	msedge.exe	102
PID 3864 wrote to memory of 4844	3864	msedge.exe	102
PID 3864 wrote to memory of 1632	3864	msedge.exe	101
PID 3864 wrote to memory of 1632	3864	msedge.exe	101
PID 3864 wrote to memory of 1632	3864	msedge.exe	101
PID 3864 wrote to memory of 4620	3864	msedge.exe	104
PID 3864 wrote to memory of 4620	3864	msedge.exe	104
PID 3864 wrote to memory of 908	3864	msedge.exe	105
PID 3864 wrote to memory of 908	3864	msedge.exe	105
PID 3864 wrote to memory of 2916	3864	msedge.exe	106
PID 3864 wrote to memory of 2916	3864	msedge.exe	106
PID 3864 wrote to memory of 1456	3864	msedge.exe	107
PID 3864 wrote to memory of 3868	3864	msedge.exe	109
PID 1456 wrote to memory of 4932	1456	msedge.exe	110
PID 3864 wrote to memory of 244	3864	msedge.exe	111
PID 244 wrote to memory of 2968	244	msedge.exe	112
PID 3864 wrote to memory of 940	3864	msedge.exe	113
PID 3864 wrote to memory of 940	3864	msedge.exe	113
PID 3864 wrote to memory of 132	3864	msedge.exe	114
PID 3864 wrote to memory of 132	3864	msedge.exe	114
PID 3864 wrote to memory of 3812	3864	msedge.exe	115
PID 3864 wrote to memory of 3812	3864	msedge.exe	115
PID 3864 wrote to memory of 1072	3864	msedge.exe	116
PID 3864 wrote to memory of 1072	3864	msedge.exe	116
PID 2832 wrote to memory of 1524	2832	file.exe	117
PID 2832 wrote to memory of 2020	2832	file.exe	118
PID 2832 wrote to memory of 4288	2832	file.exe	119
PID 1524 wrote to memory of 4244	1524	chrome.exe	120
PID 4288 wrote to memory of 2560	4288	firefox.exe	121

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97bc1c728,0x7ff97bc1c734,0x7ff97bc1c740
    3⤵
    PID:4944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1804,i,11806171809576305077,13073049564309729377,524288 --field-trial-handle=1960,i,14206374242393361195,3539406198931069256,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2008 /prefetch:11
    3⤵
    - System Time Discovery
    PID:912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1604,i,1725672090828470754,3289678715920493235,262144 --field-trial-handle=1960,i,14206374242393361195,3539406198931069256,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1944 /prefetch:2
    3⤵
    PID:2484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,484866109638033192,12895611196513283523,524288 --field-trial-handle=1960,i,14206374242393361195,3539406198931069256,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2408 /prefetch:13
    3⤵
    PID:2540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2992,i,12906040545834828627,16559291783081173891,2097152 --field-trial-handle=1960,i,14206374242393361195,3539406198931069256,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3068 /prefetch:1
    3⤵
    PID:908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3076,i,3995134074200749763,9141398137079890174,2097152 --field-trial-handle=1960,i,14206374242393361195,3539406198931069256,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    PID:784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4152,i,3013223328131341603,17457568062835047477,2097152 --field-trial-handle=1960,i,14206374242393361195,3539406198931069256,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4160 /prefetch:9
    3⤵
    PID:4748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5272,i,3833310797834527902,13972753903215391885,524288 --field-trial-handle=1960,i,14206374242393361195,3539406198931069256,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x280,0x7ff96863c188,0x7ff96863c194,0x7ff96863c1a0
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,18388488823211014653,12271451181804098817,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1644,i,5061646613809253376,12356051021660739717,262144 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1380,i,4470214539401538645,3433843543262794009,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3332,i,9334603985799319036,14141721243639939390,2097152 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3352,i,6297717503670521108,5508024756460633822,2097152 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3996,i,14199593709206833696,5383183350224654215,2097152 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4024,i,10725073241660288968,8333286019996233303,2097152 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:9
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4052,i,985435846352438761,16445325794359225107,2097152 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4116,i,7672684648891153854,16035205460252389748,2097152 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:9
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,1663605773726317908,12578901500286662337,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,2072868678974458242,9987551536870182234,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,15051223067449224696,3077929855655647079,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:14
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,2952232501903429919,15179274241621954208,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1140
      4⤵
      PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,11135622431155190458,3425216434329312006,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,11135622431155190458,3425216434329312006,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,14676916093672244654,18335381895412273058,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=592
      4⤵
      PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,4179534776309003747,17741891713591783729,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,8218150494175116997,4051705172512266118,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
    3⤵
    PID:132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,12933129641345082601,12895220858020453283,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,5759606912400963821,14800335824303427495,524288 --field-trial-handle=2188,i,1440041915447366302,9368820993942176760,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff97c33c728,0x7ff97c33c734,0x7ff97c33c740
    3⤵
    PID:4244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1960,i,16871990535934180780,5899423647133929535,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1988 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1960,i,16871990535934180780,5899423647133929535,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1956 /prefetch:2
    3⤵
    PID:4740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093" --force-high-res-timeticks=disabled --field-trial-handle=1960,i,16871990535934180780,5899423647133929535,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2192 /prefetch:13
    3⤵
    PID:3968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1960,i,16871990535934180780,5899423647133929535,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3140 /prefetch:1
    3⤵
    PID:4928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1960,i,16871990535934180780,5899423647133929535,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3160 /prefetch:1
    3⤵
    PID:2548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1960,i,16871990535934180780,5899423647133929535,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3696 /prefetch:9
    3⤵
    PID:2616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1960,i,16871990535934180780,5899423647133929535,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3704 /prefetch:9
    3⤵
    PID:4396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1960,i,16871990535934180780,5899423647133929535,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1960,i,16871990535934180780,5899423647133929535,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4392 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1960,i,16871990535934180780,5899423647133929535,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4756 /prefetch:9
    3⤵
    PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2020240740187 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2020240740187\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ff97bdbc188,0x7ff97bdbc194,0x7ff97bdbc1a0
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2388 /prefetch:11
    3⤵
    - System Time Discovery
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2756 /prefetch:13
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3708 /prefetch:1
    3⤵
    PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3840 /prefetch:9
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3868 /prefetch:1
    3⤵
    PID:560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3880 /prefetch:9
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3872 /prefetch:1
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4012 /prefetch:9
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3300 /prefetch:9
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4040 /prefetch:9
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3956 /prefetch:1
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4060 /prefetch:9
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4144 /prefetch:9
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4148 /prefetch:9
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4160 /prefetch:9
    3⤵
    PID:128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2264,i,3264806725006843307,11194449712150195385,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:5272
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
    3⤵
    - Checks processor information in registry
    PID:2560
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2372 -prefsLen 27097 -prefMapHandle 2376 -prefMapSize 270315 -ipcHandle 2440 -initialChannelId {3bb577c4-85ae-47e3-aa48-afeeffd49cac} -parentPid 2560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:5472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 b17799d4b7bfd0b42f59d84cc7ad6a559e3190afc6ce18f8cd417b7ae9bc071f
MD5 798f90b48ce6d068655876a57534ca5a
SHA1 6cf2d438d02c6766bd30542b03b97e6ac6bd6801
SHA512 8e97081c909e8bd650ba6b7db0f1e2e3fdb16e5dbc6fe0d0442df065c327dfcba3a795401d74ed9b04e3e032970204a260ff22ad06b78abde05beb988a9276da
SSDEEP 1536:XKP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:g++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T17F9302B9991E7C79536BD696A0079DAC8CD3DCCD111451BC30C76F0E14BA3A3A31B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 346ea60a0ae4d17c01949616e7832cf3b359983afcbb7e8912fe8a59321ed461
MD5 203e8ac15dc2fa01607dca121531cbf9
SHA1 6bb9e33e0eaaee142dcc669c175ec6b9508af90e
SHA512 9cbb9572308545c1a11487db03ac7301a81dad98c83fd39ad60fc0ba640dee016818808cbd7f5e840f2b2084982cd60ac725f84529aac2387baa86bafeb505f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf89531d0e3eaeb6193d0eb94b0bec959bbc3dbf51f4b1135a0c78cf16adaa46
MD5 38938711ef0446937338851ec79a0894
SHA1 179778fce333dbfd0c0e890d77eef83f40e68189
SHA512 f43a9b63b4232462afb2de768f45ce89cf129900c80bd1d32946f956e184aba1b903c62f63f5ff2ed8fb9fb615cb1ac6ddffb909f174000b4a41a45f7daef6fc
TLSH
T104D0805C33B15C74CC968E71140DBF063699C4B2545553333C332C691C471811ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b3fe3c1f53c120f20ea643b0dc7ed8623f9d208eb1c4d7232edcc97f0b69b6
MD5 7c01ab9b4147641f5e78fe413048da53
SHA1 8e1e36c184f8a953d84d6bcf9a23a2aeccf11785
SHA512 f42cfb7a46a1c4450f02942035de8f5b217382c91026f29ea332e7a448ba0045eb1f7a5acb7c8eddde74daa258d80f1a8ba7fcf32be1c93b64cbb997ca2c55ef
TLSH
T1E7D0805C33715C74C8968E71140DBF063699C4B2545553333C332C691C471411ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 231d9248eea0c3f0df28d86673f4167fd40a410f3a742c75311d9b0563109472
MD5 7011968dd0e5a5932aa08f059c8ef341
SHA1 a4b36406fccc58e030327e71b2ed5b3d608ac42a
SHA512 c1ffa6fb7cd951f74b146cff7932cd4e9fc7cb73198ae9f1d0f6234739dc3eb5ae837a15bdf2aae5ec9d22228fd1f321b9c895f0f284c6f096ad66fccb10fd1f
SSDEEP 96:KAhyKisSKgIKpKeq+sKLq8+kK3qC2/GKMsk:olnrH4PZF
TLSH
T18AE1F651B23A12E0397E696A85D4B47E51C231A33418F43B37BD11A60FA6E21DCFECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 9081c80e48d6086db9fb097aa85fa97e89c25321b1c77f8b5c10a9583c971d03
MD5 c306d4e70c1627eaceb86379d8d5c47a
SHA1 202e7f9fb094df23789ff03ea5cfde549a08919a
SHA512 c06aed3b37f7316f2b118e6b64bb16032f54be6097fba5d978e261fa2f1918c815fc53407e2129b4be2a233eb5b9a203394d42e8e3508d3f42e96b2cf1bdb059
SSDEEP 192:Fvo3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:a3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T1DC24530A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 07a9fbc4a7079c589b64a645506e5e43fc858d39871e9482690aebf01c57eb96
MD5 6b5c43d208b290f620ae72150f6cb946
SHA1 9444caf767f71aee00e416daf62d346785f07724
SHA512 2616c91f9463af129f5e9ebfcc8881417a1cf7176635f49651bc5e2ec91be1085d9d85cd58c68028478469fbb59c8cac78e09a4854e2e125994fa41d0442f22e
SSDEEP 192:xGNj6Eaj4QmiUymktRvAwr0lNXSJrzupFdqUU6:xGNj6EfctRvAwr0lNiJrEFFU6
TLSH
T14F12F935A8787CAB8FF3AD55B0877A175FE5112BEA842F54D9E80A0C40DB39C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1e7bdabcfd2b1f236a3b9be8afcb109a38732fd13885a4144cead95707cedff4
MD5 b53e27fbb3207f295acbc530054a43ac
SHA1 7f27cb450e90af1bcecda2d98be556287f968b32
SHA512 d8b0ea599d1b7774ff8ba118650c0845f7b55430e2812dff9829138a1fd78d696e2ea4758b6f7ee50da4b0467ab991740f9fb9ded412ca6b06563872d38a345e
SSDEEP 96:uqGNkMQsjpfiajNL0fe5ih/cIPURHl8h4otop5Rs1wLDR+B/PEvdp0vRuwy0mJQ3:VGNY6EajeQmiUy2w/knRvAwr5q6FceU6
TLSH
T1FA02E63568BC7CBB8EF3AD45B4876B276FE5112BE9942F84D9E81B0D40DB24C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55305f3e-fd5b-4cc8-be9f-8f002f76e72b.tmp

Path C:\Users\Admin\AppData\Local\Temp\55305f3e-fd5b-4cc8-be9f-8f002f76e72b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62fa6603-16ca-4a76-8a20-f5e0e9fea9b3.tmp

Path C:\Users\Admin\AppData\Local\Temp\62fa6603-16ca-4a76-8a20-f5e0e9fea9b3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1524240740093\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2020240740187\Crashpad\settings.dat
Size 280B
SHA256 626566a2be2bf27abc21d2359931e96f33e5e6f542db9334026ab39938d71393
MD5 58f1f0a1855d474d26e8d620a1862400
SHA1 c9ec746f6ee118375d4910154ed9d948c973dc90
SHA512 36a97340c2b55726f817891b8d2b621ecd9831368c2b221a1e81bf3bb2e6b35777d31084a6ae6fc449bd8e1debee80b004478e47e4cea331e646291fab0e26cb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2020240740187\Crashpad\settings.dat
Size 280B
SHA256 d4bc9652080cf3ad0483c8667f9517cb8f2043062b859224ea898b5cc45d8044
MD5 a47ab4f691239ba942f3b695912e22ef
SHA1 9ce4dfa073eb58aa54081ea02dcc668fd24c6c7e
SHA512 520c5a8a43eac22c9d740301f3529c7346d1df9f06ad6797fbda7f85937325e1b7dbd0eeb3fc7119c8b0b5566bff163f655c677860594a2b1048ae153d7b632b
TLSH
T103D022C2E32A0023C8C0083300003B3EB8CBEC0BAC23B0000080300A0CA0A880C02200
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2020240740187\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2020240740187\Default\DawnGraphiteCache\data_1
Size 8KB
SHA256 35bb2f189c643dcf52ecf037603d104035ecdc490bf059b7736e58ef7d821a09
MD5 259e7ed5fb3c6c90533b963da5b2fc1b
SHA1 df90eabda434ca50828abb039b4f80b7f051ec77
SHA512 9d401053ac21a73863b461b0361df1a17850f42fd5fc7a77763a124aa33f2e9493fad018c78cdff63ca10f6710e53255ce891ad6ec56ec77d770c4630f274933
SSDEEP 3:MsEllllkXl:/M/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2020240740187\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2020240740187\Local State
Size 4KB
SHA256 982ef8d5e3793605e3af50a3c5d1195e62ef555b3c7e9f61a397b7612fad0a15
MD5 221fb139ffedb89eb0bf06554aee5a8d
SHA1 312db60e2f0eafd708bcb9b3d71f5e6b85501568
SHA512 78bdd75c768e17740ceef4d85b9fa8b7fe475d84a02363d95ec5bc8a2221f234b7976ee537eb4299abdf1978f6c873f69137d8d9eee34397e8dde869573676a1
SSDEEP 96:sqGNkHQsFf3vs58Frh/cInURcDotovcvD+BanvFB8wSk0eUc1VSDS4SYSuSDSDS1:3GNvq3ocDUwc+uSk1H
TLSH
T1B0A1A7736964EC2B5DE2A944B48A36135EF59223E6887FD8D6DC2B0C05EF29C5305C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2020240740187\Local State
Size 3KB
SHA256 0f68b87d009ea9f1d46f91ef0da81b1b8b17d7534bb6d5c606c844f5f35b7516
MD5 673da3beda4c20ef88329b58bff80a9b
SHA1 3aff2056e7fbcdd5e21524502e62c8284de901cb
SHA512 ac8fa9284f6176ad29e68f9d037fab872dfaa597aaf12c2df7ed2ff3933f3f198f718b7c447b9ac5985d85d8a1896ae76595ee2914f1ce6c0e7477acbd30284f
TLSH
T13C81B773A824EC3B5DE16A84B44A36134EB5E223E754BF9492DC370C05EF69C9305C7A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe596cca.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge2020240740187\Local State~RFe596cca.TMP
Size 1KB
SHA256 fc47f58e0d4e65c614592bdaee7d184250ee54bb2ab4549b55cc6af3c9a63ae9
MD5 0754178d0d2b67ae781b299b822f02d0
SHA1 3feea5b168be4c0c7d6071685bbd7e3177b08e4e
SHA512 f4abbaec728cb5d0d174dfa08379c54416d011398d58bdae8c9b1eec81b4d30a834448fcc17beeef8d8f2a2c7e9e685bd67f0b1fb3dd877c5d9de0e2b9106b77
TLSH
T1173193B2A8686C7BBCC06605B246BBA70E70613281515ED883DC5A0804DB28C1219C3E
MD5 SHA1 SHA512 TLSH

Submit Download

1740d314

Path C:\Users\Admin\AppData\Local\Temp\e14b37e9\1740d314
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32b1ae44

Path C:\Users\Admin\AppData\Local\Temp\e14b37e9\32b1ae44
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35052577

Path C:\Users\Admin\AppData\Local\Temp\e14b37e9\35052577
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48085850

Path C:\Users\Admin\AppData\Local\Temp\e14b37e9\48085850
Size 20KB
SHA256 e5934d7bc7276bfcf686e9d5cb1672b10ecc1a79e5fb8de0872223d3e9d94fd8
MD5 6563843ae72e6c6ab418ed901a078e08
SHA1 5e4ca4180f2be77929cb582dc30372ee4ba38ed8
SHA512 74b7e5c677f1a5bd8fb5a7f6b8f8797f062426b25b5abc09278b8cbaf86fb8c341d6e835f944317d7ab7e99b4bd5099dc8f088050f07c7515f665b54ac58bd1f
SSDEEP 48:TeW9aw/aHLopFMavU1iBwHm/iaDc0Xd9NH:nPareMaZz/iaoulH
TLSH
T15292004F2F303610C4F84B32E9D2546B2E7D112D83637A9AEE1468B39DC25ABF1055E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

536b9169

Path C:\Users\Admin\AppData\Local\Temp\e14b37e9\536b9169
Size 138KB
SHA256 149c1a433e3a72d2b816d4136fc02404b2288ccfa8521cd6b156321489cb8e67
MD5 8ebb107c3e7835976940935223cbba9b
SHA1 ae1475637457ff9e697820bdd7d1ba7fd2acfb13
SHA512 c93794e1776f43d0ce451dac51873e835f2da8866d8c8c23a8024393f9d296c21845bb53b52492ee4196c3e612790e4c5d8089c2104075b89bd9ec7e91636b22
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2ODQGNHLVumbnEbXyuR:FnbZeMrv/hGtDQGNHDnEzyuR
TLSH
T1E8D3A84B3A747002EDE59A721CE051BB4E3C716D8F55A5D528B620688EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e26b5e0

Path C:\Users\Admin\AppData\Local\Temp\e14b37e9\5e26b5e0
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

701f5c4c

Path C:\Users\Admin\AppData\Local\Temp\e14b37e9\701f5c4c
Size 5.0MB
SHA256 f7263fbc1cf7dc51635915ada8c5e748662c9be2766851eecd8e51af954f84ec
MD5 fd77542176d8065a3079b639ea2d4af7
SHA1 8727317bcee4ba06b42070500414728c3548fda0
SHA512 2a9f9d955433af766a479a69da363296d369e15e527ed837a20c46bae3d9e3776cd1e0dcf599f6a042686d62f6c187d3a842219f6e51bdae060ef707d738eecb
SSDEEP 192:M8rJQaXoMXp0VW9FxWHNasfVPV3jK4ZE:M8r54w0VW3xWt7VW
TLSH
T1C636100F6A212150D4DAA232BCE36F161C3F70169A3336933DA4656D4DE0767B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fd1cbde

Path C:\Users\Admin\AppData\Local\Temp\e14b37e9\7fd1cbde
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac31fac5

Path C:\Users\Admin\AppData\Local\Temp\e14b37e9\ac31fac5
Size 288KB
SHA256 97977dbf44ac3fd12f06545d49d454bcdde5c7355b5648c9b4f539284cdc3e30
MD5 ced0ee489ff140c52bff13780836fca9
SHA1 a46c3cbad80faada19c1a73d0ca4b18ff648594b
SHA512 9aa7d85cbbd40b9b09823af238d53bca969bfddc1cd60f2a9130d0441badecb7bab6fcedc76b4e34c099bc4d98d1238628dd6b17403a4f72480033df8a6c2af1
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v4L9+CCww:f1zkVmvQhyn+Zoz67f9Tzw
TLSH
T19754CB47EE84B519D71A2830CA444DF37A00AB0447821E2BDBFC1E7E1EB264DBAAD5C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdc4e625

Path C:\Users\Admin\AppData\Local\Temp\e14b37e9\bdc4e625
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d31b860c

Path C:\Users\Admin\AppData\Local\Temp\e14b37e9\d31b860c
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3864_1787215026\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48384d11-5800-4fa8-a666-3ef88f638a4d.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3864_703389016\48384d11-5800-4fa8-a666-3ef88f638a4d.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\96276qki.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2832-588-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-14-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-590-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-591-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-593-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-7-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-592-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-6-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-17-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-584-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-5-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-4-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-585-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-3-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-2-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-0-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-8-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-9-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-10-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-11-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-13-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-350-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-911-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-358-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-250-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-120-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-943-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-50-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-12-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-974-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-976-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-975-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-589-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-15-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-16-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-19-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-18-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-984-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-991-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-987-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-986-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-983-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-981-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-989-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-988-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-993-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-995-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-996-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-998-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-999-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-997-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1000-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1001-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1002-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1003-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1004-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1005-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1006-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1008-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1009-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1007-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1010-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1011-0x0000000570000000-0x0000000570532000-memory.dmp

Download

memory/2832-1012-0x0000000570000000-0x0000000570532000-memory.dmp

Download