38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
Size 2.1MB
Sample260530-a42lmacv4v
SHA256 38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b
MD5 2cb9a583c9a057d6091c7a4dea5e794b
SHA1 2477e59a5d36df7ac06177ca73d2b098b61d95da
SHA512 1bc0cfbfd8a0cd7a4018f9a9592e78fc42c50f6f2ccc59a9d03cd993d3de1214c9e334430c62e7ac092814ae141808d4d85c9754bf636cdd3ab6b88d9a07a97b
SSDEEP 24576:6tYT4uQ7Bz3W0aX1nh/SCtoGAko1bw/xA3XpkHLSdjm3q8FHmu0/MBele5ZK2hhv:6tG4ugBzG0aX7/noGgbachm3qArH
TLSH
T197A58D0A7CE009FAD0A663328CF651917B75B80A0B3227D72E60B2783FB67D49D75764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 1964 created 680	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	80
PID 1964 created 4180	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	81
PID 1964 created 2000	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	82
PID 1964 created 1400	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	83
PID 1964 created 4860	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	85
PID 1964 created 4940	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	86
PID 1964 created 3836	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	87
PID 1964 created 1728	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	89
PID 1964 created 680	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	80
PID 1964 created 680	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	80
PID 1964 created 4888	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	91
PID 1964 created 1692	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	92
PID 1964 created 3400	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	93
PID 1964 created 2860	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	94
PID 1964 created 4808	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	95
PID 1964 created 3044	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	98
PID 1964 created 4452	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	100
PID 1964 created 1152	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	101
PID 1964 created 1636	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	102
PID 1964 created 4888	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	91
PID 1964 created 4888	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	91
PID 1964 created 3400	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	93
PID 1964 created 3400	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	93

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1400	chrome.exe
3400	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245756389533680"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{E434C477-4497-4566-B9BD-29043DCCBCEE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
680	chrome.exe
680	chrome.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
680	chrome.exe
680	chrome.exe
680	chrome.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe
Token: SeShutdownPrivilege	680	chrome.exe
Token: SeCreatePagefilePrivilege	680	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
680	chrome.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 680	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	80
PID 680 wrote to memory of 4180	680	chrome.exe	81
PID 680 wrote to memory of 2000	680	chrome.exe	82
PID 680 wrote to memory of 1400	680	chrome.exe	83
PID 680 wrote to memory of 2000	680	chrome.exe	82
PID 680 wrote to memory of 4860	680	chrome.exe	85
PID 680 wrote to memory of 4860	680	chrome.exe	85
PID 680 wrote to memory of 4940	680	chrome.exe	86
PID 680 wrote to memory of 4940	680	chrome.exe	86
PID 680 wrote to memory of 3836	680	chrome.exe	87
PID 680 wrote to memory of 3836	680	chrome.exe	87
PID 680 wrote to memory of 1728	680	chrome.exe	89
PID 680 wrote to memory of 1728	680	chrome.exe	89
PID 680 wrote to memory of 3724	680	chrome.exe	90
PID 1964 wrote to memory of 4888	1964	38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe	91
PID 4888 wrote to memory of 1692	4888	msedge.exe	92
PID 4888 wrote to memory of 3400	4888	msedge.exe	93
PID 4888 wrote to memory of 2860	4888	msedge.exe	94
PID 4888 wrote to memory of 2860	4888	msedge.exe	94
PID 4888 wrote to memory of 2860	4888	msedge.exe	94
PID 4888 wrote to memory of 4808	4888	msedge.exe	95
PID 4888 wrote to memory of 4808	4888	msedge.exe	95
PID 4888 wrote to memory of 4600	4888	msedge.exe	97
PID 4888 wrote to memory of 4600	4888	msedge.exe	97
PID 4888 wrote to memory of 4600	4888	msedge.exe	97
PID 4888 wrote to memory of 3044	4888	msedge.exe	98
PID 4888 wrote to memory of 3044	4888	msedge.exe	98
PID 4888 wrote to memory of 3044	4888	msedge.exe	98
PID 4888 wrote to memory of 4204	4888	msedge.exe	99
PID 4888 wrote to memory of 4204	4888	msedge.exe	99
PID 4888 wrote to memory of 4204	4888	msedge.exe	99
PID 4888 wrote to memory of 1152	4888	msedge.exe	101
PID 4888 wrote to memory of 1152	4888	msedge.exe	101
PID 4888 wrote to memory of 1152	4888	msedge.exe	101
PID 4888 wrote to memory of 1636	4888	msedge.exe	102
PID 4888 wrote to memory of 1636	4888	msedge.exe	102
PID 4888 wrote to memory of 1636	4888	msedge.exe	102
PID 4888 wrote to memory of 4452	4888	msedge.exe	100
PID 4888 wrote to memory of 4452	4888	msedge.exe	100
PID 4888 wrote to memory of 4452	4888	msedge.exe	100
PID 4888 wrote to memory of 4560	4888	msedge.exe	103
PID 4888 wrote to memory of 4560	4888	msedge.exe	103
PID 4888 wrote to memory of 4016	4888	msedge.exe	104
PID 4888 wrote to memory of 4016	4888	msedge.exe	104
PID 4888 wrote to memory of 5444	4888	msedge.exe	106
PID 4888 wrote to memory of 5444	4888	msedge.exe	106
PID 4888 wrote to memory of 5436	4888	msedge.exe	105
PID 4888 wrote to memory of 5436	4888	msedge.exe	105
PID 4888 wrote to memory of 4280	4888	msedge.exe	108
PID 4888 wrote to memory of 4728	4888	msedge.exe	109
PID 4728 wrote to memory of 32	4728	msedge.exe	110
PID 4888 wrote to memory of 2660	4888	msedge.exe	111
PID 2660 wrote to memory of 5308	2660	msedge.exe	112
PID 4888 wrote to memory of 5524	4888	msedge.exe	113
PID 4888 wrote to memory of 5524	4888	msedge.exe	113
PID 4888 wrote to memory of 6112	4888	msedge.exe	114
PID 4888 wrote to memory of 6112	4888	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe
"C:\Users\Admin\AppData\Local\Temp\38c7e9de33a266c60848d528ff37328b3462bb603b7996c1c0d35db29b37c16b.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ee1dc728,0x7ff8ee1dc734,0x7ff8ee1dc740
    3⤵
    PID:4180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1620,i,9910324920353363978,11670750106102174895,262144 --field-trial-handle=1912,i,75005271535514842,14830392200130939522,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1908 /prefetch:2
    3⤵
    PID:2000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2060,i,14218220186138168152,11761624869629154054,524288 --field-trial-handle=1912,i,75005271535514842,14830392200130939522,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2068 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,15192852043808048287,6785132876773928913,524288 --field-trial-handle=1912,i,75005271535514842,14830392200130939522,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2320 /prefetch:13
    3⤵
    PID:4860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3080,i,17406548876716174690,1757829780830321140,2097152 --field-trial-handle=1912,i,75005271535514842,14830392200130939522,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3088,i,5239765542122683093,1413611344450026242,2097152 --field-trial-handle=1912,i,75005271535514842,14830392200130939522,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3124 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4228,i,18208816987001675576,9675932066072958447,2097152 --field-trial-handle=1912,i,75005271535514842,14830392200130939522,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4236 /prefetch:9
    3⤵
    PID:1728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,8048059927183371390,7402296461799229323,524288 --field-trial-handle=1912,i,75005271535514842,14830392200130939522,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5652 /prefetch:14
    3⤵
    PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff8d9fec188,0x7ff8d9fec194,0x7ff8d9fec1a0
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,10608844631087441335,8262068189977549900,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1648,i,17500446530155576239,6193997569130458946,262144 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,659338945917497857,9529813073281414592,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,797423352172210940,8707849743545962719,2097152 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,482639545133451994,15220916401913068219,2097152 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4068,i,9861466506723555372,10590838655522049060,2097152 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:1
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4112,i,9044019608197432285,10911554290711507991,2097152 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:9
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4132,i,17531767356672217497,17732831300843502985,2097152 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4204,i,14949607493714508157,158590186658205076,2097152 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:9
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,13064859462274588855,15846822794657736234,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,16410648011065705182,17009751954451116268,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,17820443463078387219,2320773662474337573,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,16438938288212032873,15758009730503702820,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,8069561517239220576,8212021063336095153,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,8069561517239220576,8212021063336095153,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,18278744138160434163,7263533369609153336,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1132
      4⤵
      PID:32
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,10525944748235003221,6286748729159191077,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=596
      4⤵
      PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,11293343828829662995,14346215791526888080,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
    3⤵
    PID:5524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,7858307550999168397,13097883944722969385,524288 --field-trial-handle=2012,i,2712092478154407302,4879011554591851084,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
    3⤵
    PID:6112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c41355b30f4cc4a1072a03ee12d7a854369c8f9c9fd98682295fd3af13898c8a
MD5 8742077b7574dd3535c1033831e2f3dc
SHA1 137e876cc0787416b0b23eeb9cce3f9767f4f9fb
SHA512 6628524d7f465a876d65fb36cfc9904d1cf163525d134c1741d4c838b3ef2121301634f4dd575e99a8ebe07d2ce45fe97eb038e275e52ee488c4431d7e5c4901
SSDEEP 192:GRvBZo0GYORm5sv7+pAPRp279uHsb+WNnEAPy5Xvkwm+SVyIsnAUge:GRvBmjg46UXkUwXPylie
TLSH
T1BA42D82EAE14757B9CCFD229F9667753D7F9112231942E84EAFC8A2C14E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 b191fbf28d456dab4daada09a156589e7035dc04faf04342119753454172c18d
MD5 3deaf5e7efdee746e28e568fc5b79feb
SHA1 ba448748d06e2bb893b29d2841529eb57a720026
SHA512 609c501ddcce5aaf92015ec7523f22901581ed135820e32ab512b8c7eb85c8620086926d4b667fbc05138d5ab8695f4cbca0262f43b877c9041a21adca014461
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OzEgaVumrLnPto:1nbZeMrv/hGtzFSLnW
TLSH
T16DD3874B3A743102DDE69A721CE051BB5E3CB17D8F51A5D428B620588EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ac5534355a58fc52d6fe88be98df22208e1aa260458fd4d020c4f10e4f15b8f2
MD5 532f816eb9004f5659f9282707cffc22
SHA1 3047ab6ae40299763d44c98d3d0ce1d129bac0cb
SHA512 c7bf3072f03c6363329fa4004d498bb6cca280c650ab84bb9bc9089d250f2ce6e30d5ce72dceac844b94b9294d65435a757e482905b277aeb45e033eea2598e6
SSDEEP 3072:P8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:JwCcmXKegIh6jh9JvexhQ
TLSH
T16CB3125A29273DA688BC6EB37457338286A353A26C05F14E90CCDF0B45DDDB415EF8B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7d441e1a4a34d460605ccf5341c540007dbaed264a1ed9d9010f371e6a4427a7
MD5 9b47ddac3becad0c585a7a296ddb34e2
SHA1 91afadc8925e4bf0f537f8da531df2610360096d
SHA512 a2a527f4858d6b1115ae5c03b40a153f49b3a7236ab9524d28fcad78d99f9fda5965beb5bec12dfd8ac87871754c2bc599c0e8fb9c1425c3fa5bf8977ff1aa99
SSDEEP 3072:B8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nW:3wCcmXKegIh6jh9JvexhB
TLSH
T17BC3125929273DA688FDAEB3745333828AA353A26D05F14E90CCDF0B45CDDB419EF464
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 432578c91dc4a722fb23319e03fb075631906c174018d3e0cd14ba3e6f5d8ebc
MD5 d6dbddc8ee896031774f1292e0e4086f
SHA1 a4c5c30f63aa0691ca0e470bc207eee8125bb551
SHA512 4a37d67b0ab07bbe33d3a1bab87cb3ddb915a2390d30b140abe65ec4026ba50e931048d071ddce836c52ab7e3a4008acf9d6bb3210531d060ffb44eed0e2ccef
SSDEEP 48:KcAIjKpiUny9bI9KQ0onydnIRKogE8xCdRHJ:KcAAKpimOb+KQ0K+nuKogbxCdRHJ
TLSH
T1689177D272BA02333D7D25088A5997370A4277A33259E53B3BA964714E66E334CFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 f661c081a131e1b5ef3960ae4b80cbebe372a74dff66abf6bc78ebed8d0d02ae
MD5 78d02dd047f65d60d2cafb4c231179f2
SHA1 bccc85f44bf4221c158c968f01cb20208b597f99
SHA512 541da04c14df05b09225760bdde4ce2fb809cba27e36aaa852bde96eb17fef773d1dcfc79855714bebfce6baf948436fa00d06b712a11b6adcbbd0b097360dc2
SSDEEP 192:FvoWcP/FfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aTPtfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T16824740A7B747001DDE7E9725CB080771A3CB16ECF22A6D15DA254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 44db255a0721e02403e391f12f3d3e8aeb8145d97bf90990ddfe2d2d91e072b3
MD5 45a4bd70532d44c98b6e6eace7ef5219
SHA1 5e38256e96c19c1217a3e8beb4e38de740715d48
SHA512 a8ae9ebc86df97e7211a19e83bf0f4365f3da185e296e9b4388c1492a365a2e0b7d57e4dcaacbaae4d99d847df98386bf810d54a2355ead2df450e23ee647e6d
SSDEEP 192:1GNy6t6H3BQmiUyvHBH+2Qq/rUH5mnRf+D9MDtU6:1GNy6MXfYg2Qq/E5K5BU6
TLSH
T1E702D83878A8ACAB8EB3AE45B48777135F94112FE7D55F88D6E81B1C40DB29C1306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 542bbef49a7903c8bc83ae67e5d0347da0090b9b69f98f8d6ee34934356d9f03
MD5 153645ff01ab7df4c49949f4dde8ba33
SHA1 88f11de7727fc7151c495fe5493af26f406b442b
SHA512 d54ee59087d54ee59dd0eb8056585269018c4aecd340014bfd46dc308b25667ede00dbc6f5d11a55efb4d1b19c3e6e2c64d7d09d9ff523d1295634cef1adfb53
SSDEEP 192:1GNa6t6H36QmiUyn0+2lq/rUH5mnRfSzm/9n6qdU6:1GNa6MX2s2lq/E5KSz2VU6
TLSH
T1B712F974A8A87C6F9EE39E55F48737179F95116FE7C55F98D9E80B1C00CB29C230A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b9266a9-d649-4a79-b778-f35375d992d0.tmp

Path C:\Users\Admin\AppData\Local\Temp\4b9266a9-d649-4a79-b778-f35375d992d0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dfcfa5a-94eb-4c4b-8750-a3bffa1872ca.tmp

Path C:\Users\Admin\AppData\Local\Temp\4dfcfa5a-94eb-4c4b-8750-a3bffa1872ca.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

60fc0ce8

Path C:\Users\Admin\AppData\Local\Temp\cc22762c\60fc0ce8
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ea72d54-9953-491d-9688-1ba5b0ffd0fc.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4888_1004113490\4ea72d54-9953-491d-9688-1ba5b0ffd0fc.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1964-120-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-92-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-74-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-83-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-118-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-131-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-152-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-151-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-150-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-149-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-148-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-147-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-146-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-130-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-129-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-128-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-127-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-126-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-125-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-124-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-123-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-122-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-121-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-32-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-119-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-116-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-117-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-115-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-114-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-72-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-90-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-94-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-93-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-49-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-91-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-89-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-88-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-87-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-86-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-85-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-84-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-82-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-81-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-80-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-79-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-78-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-77-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-76-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-17-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-16-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-15-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-14-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-13-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-12-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-11-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-9-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-10-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-8-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-7-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-6-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-5-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-4-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-1-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-0-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-75-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-73-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/1964-2513-0x0000000410000000-0x00000004101E9000-memory.dmp

Download