066a5d1f0c5c5026609d27685d6e458d29a60f9b4ca40e831d806752da221ccd

Analysis

max time kernel
148s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
__zst____r_64-v.9.180.exe
Size 2.8MB
Sample260601-ehbwaset2q
SHA256 066a5d1f0c5c5026609d27685d6e458d29a60f9b4ca40e831d806752da221ccd
MD5 f5d087934cdf52b295e547fcdf53fb17
SHA1 8cc7ef29a8ba777d027a5e49764692790471aae7
SHA512 c6b25b8249904861990eb99f0f7317ac04b96277a964c1f40f04c97740924d721c1c6ed8d8d3814403d5fc117ded438ee27421df2506bbd40ccd5deda5b6cc12
SSDEEP 49152:eTyBNmMHhWdKb4ptvSrHkUFe57zYj0uYSYetRq+5:eTcpgMb4za2Y0uYjetRx
TLSH
T1BED54887A862F1E1C81472F7646341797B68AC253B75A3FB29DC25351F722C048F6FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 25 IoCs

description	pid	Process	procid_target
PID 4608 created 488	4608	__zst____r_64-v.9.180.exe	80
PID 4608 created 3764	4608	__zst____r_64-v.9.180.exe	81
PID 4608 created 1868	4608	__zst____r_64-v.9.180.exe	82
PID 4608 created 3712	4608	__zst____r_64-v.9.180.exe	83
PID 4608 created 2908	4608	__zst____r_64-v.9.180.exe	84
PID 4608 created 4940	4608	__zst____r_64-v.9.180.exe	85
PID 4608 created 2252	4608	__zst____r_64-v.9.180.exe	86
PID 4608 created 3440	4608	__zst____r_64-v.9.180.exe	87
PID 4608 created 488	4608	__zst____r_64-v.9.180.exe	80
PID 4608 created 488	4608	__zst____r_64-v.9.180.exe	80
PID 4608 created 1868	4608	__zst____r_64-v.9.180.exe	82
PID 4608 created 1868	4608	__zst____r_64-v.9.180.exe	82
PID 4608 created 5460	4608	__zst____r_64-v.9.180.exe	92
PID 4608 created 5540	4608	__zst____r_64-v.9.180.exe	93
PID 4608 created 5476	4608	__zst____r_64-v.9.180.exe	95
PID 4608 created 5400	4608	__zst____r_64-v.9.180.exe	96
PID 4608 created 5584	4608	__zst____r_64-v.9.180.exe	97
PID 4608 created 5616	4608	__zst____r_64-v.9.180.exe	99
PID 4608 created 5932	4608	__zst____r_64-v.9.180.exe	101
PID 4608 created 5948	4608	__zst____r_64-v.9.180.exe	102
PID 4608 created 5964	4608	__zst____r_64-v.9.180.exe	103
PID 4608 created 5460	4608	__zst____r_64-v.9.180.exe	92
PID 4608 created 5460	4608	__zst____r_64-v.9.180.exe	92
PID 4608 created 5400	4608	__zst____r_64-v.9.180.exe	96
PID 4608 created 5400	4608	__zst____r_64-v.9.180.exe	96

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4608	__zst____r_64-v.9.180.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1868	chrome.exe
5400	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	__zst____r_64-v.9.180.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	__zst____r_64-v.9.180.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247597842019822"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{580A6A37-9A9A-4995-9B1F-1467B99E66F6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
488	chrome.exe
488	chrome.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe
4608	__zst____r_64-v.9.180.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
488	chrome.exe
488	chrome.exe
488	chrome.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	__zst____r_64-v.9.180.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe
Token: SeShutdownPrivilege	488	chrome.exe
Token: SeCreatePagefilePrivilege	488	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
488	chrome.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 488	4608	__zst____r_64-v.9.180.exe	80
PID 488 wrote to memory of 3764	488	chrome.exe	81
PID 488 wrote to memory of 3712	488	chrome.exe	83
PID 488 wrote to memory of 1868	488	chrome.exe	82
PID 488 wrote to memory of 3712	488	chrome.exe	83
PID 488 wrote to memory of 2908	488	chrome.exe	84
PID 488 wrote to memory of 2908	488	chrome.exe	84
PID 488 wrote to memory of 2252	488	chrome.exe	86
PID 488 wrote to memory of 2252	488	chrome.exe	86
PID 488 wrote to memory of 4940	488	chrome.exe	85
PID 488 wrote to memory of 4940	488	chrome.exe	85
PID 488 wrote to memory of 3440	488	chrome.exe	87
PID 488 wrote to memory of 3440	488	chrome.exe	87
PID 488 wrote to memory of 3972	488	chrome.exe	90
PID 4608 wrote to memory of 5460	4608	__zst____r_64-v.9.180.exe	92
PID 5460 wrote to memory of 5540	5460	msedge.exe	93
PID 5460 wrote to memory of 5476	5460	msedge.exe	95
PID 5460 wrote to memory of 5400	5460	msedge.exe	96
PID 5460 wrote to memory of 5476	5460	msedge.exe	95
PID 5460 wrote to memory of 5476	5460	msedge.exe	95
PID 5460 wrote to memory of 5584	5460	msedge.exe	97
PID 5460 wrote to memory of 5600	5460	msedge.exe	98
PID 5460 wrote to memory of 5584	5460	msedge.exe	97
PID 5460 wrote to memory of 5600	5460	msedge.exe	98
PID 5460 wrote to memory of 5600	5460	msedge.exe	98
PID 5460 wrote to memory of 5616	5460	msedge.exe	99
PID 5460 wrote to memory of 5616	5460	msedge.exe	99
PID 5460 wrote to memory of 5616	5460	msedge.exe	99
PID 5460 wrote to memory of 5916	5460	msedge.exe	100
PID 5460 wrote to memory of 5932	5460	msedge.exe	101
PID 5460 wrote to memory of 5948	5460	msedge.exe	102
PID 5460 wrote to memory of 5916	5460	msedge.exe	100
PID 5460 wrote to memory of 5916	5460	msedge.exe	100
PID 5460 wrote to memory of 5932	5460	msedge.exe	101
PID 5460 wrote to memory of 5932	5460	msedge.exe	101
PID 5460 wrote to memory of 5948	5460	msedge.exe	102
PID 5460 wrote to memory of 5948	5460	msedge.exe	102
PID 5460 wrote to memory of 5964	5460	msedge.exe	103
PID 5460 wrote to memory of 5964	5460	msedge.exe	103
PID 5460 wrote to memory of 5964	5460	msedge.exe	103
PID 5460 wrote to memory of 6116	5460	msedge.exe	104
PID 5460 wrote to memory of 6116	5460	msedge.exe	104
PID 5460 wrote to memory of 2348	5460	msedge.exe	105
PID 5460 wrote to memory of 2348	5460	msedge.exe	105
PID 5460 wrote to memory of 1968	5460	msedge.exe	106
PID 5460 wrote to memory of 1968	5460	msedge.exe	106
PID 5460 wrote to memory of 4316	5460	msedge.exe	107
PID 5460 wrote to memory of 4316	5460	msedge.exe	107
PID 5460 wrote to memory of 2312	5460	msedge.exe	109
PID 5460 wrote to memory of 6020	5460	msedge.exe	110
PID 6020 wrote to memory of 392	6020	msedge.exe	111
PID 5460 wrote to memory of 4292	5460	msedge.exe	112
PID 4292 wrote to memory of 3560	4292	msedge.exe	113
PID 5460 wrote to memory of 5140	5460	msedge.exe	114
PID 5460 wrote to memory of 5140	5460	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\__zst____r_64-v.9.180.exe
"C:\Users\Admin\AppData\Local\Temp\__zst____r_64-v.9.180.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d449c728,0x7ff9d449c734,0x7ff9d449c740
    3⤵
    PID:3764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,8704416276390114816,10936348701540191101,524288 --field-trial-handle=2040,i,12407393320070443115,6556599596630754868,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2072 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1600,i,3247036803872947876,17635798897824200627,262144 --field-trial-handle=2040,i,12407393320070443115,6556599596630754868,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2036 /prefetch:2
    3⤵
    PID:3712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,7339012620683301473,1276858087035503796,524288 --field-trial-handle=2040,i,12407393320070443115,6556599596630754868,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2448 /prefetch:13
    3⤵
    PID:2908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3076,i,1546395845645070037,11347712082876290177,2097152 --field-trial-handle=2040,i,12407393320070443115,6556599596630754868,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3084,i,12129872151818132935,6909470039941171530,2097152 --field-trial-handle=2040,i,12407393320070443115,6556599596630754868,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:2252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4172,i,5229842078079950401,11390159808276394275,2097152 --field-trial-handle=2040,i,12407393320070443115,6556599596630754868,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4188 /prefetch:9
    3⤵
    PID:3440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,707935471990115406,4332127588376965205,524288 --field-trial-handle=2040,i,12407393320070443115,6556599596630754868,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5620 /prefetch:14
    3⤵
    PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ff9c01fc188,0x7ff9c01fc194,0x7ff9c01fc1a0
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1556,i,13892997010395824204,2042037223437095095,262144 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,9483585615875060313,13863179712408636000,524288 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,4918640383567779949,15196582636841779123,524288 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:13
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3240,i,2700981213702957638,5242686634827942221,2097152 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3264,i,7815543949148818649,14187512639284710538,2097152 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4036,i,6862468586341873796,5242556176114656618,2097152 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4052,i,6244721304169175200,2242512434474219238,2097152 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:9
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4080,i,2689665706622456951,10107009985165359805,2097152 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:9
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4068,i,4756890628896509120,5153383587323015286,2097152 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:1
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,956377519419920292,11435359811638002403,524288 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
    3⤵
    PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,11304792672938418481,17193901419256014556,524288 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,12988260329367777572,6664595170653071205,524288 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,17434704872686234124,12324562893611993297,524288 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,7938897376417475190,1696234390392923311,524288 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,7938897376417475190,1696234390392923311,524288 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,8405944099963836315,5022663325713426287,524288 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,10538257196012450089,8583730763263188497,524288 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=592
      4⤵
      PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,1959185566789223562,15940308439289539164,524288 --field-trial-handle=2156,i,13157753722932884934,11177970356893750018,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
    3⤵
    PID:5140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7505413ee7505671406cc2edcd7cedd5f7eb2f48d997915c67a48297e3a8415c
MD5 26719ccd4dcd8488c7843c95f3a16a29
SHA1 8ea012a0952ca1f90e3402524c01b37594b1bc71
SHA512 c67036f6005b4e5e2f3077dcdd836b1d18cf6c970d871ce4fab8c97bfdd0ad562cda0f8ef6a330d9073efbeb8b80bfe98513285557b735f4a21a354ed5c01150
SSDEEP 192:GRBtjaMga3VWv7+pAPRp279uHsb+WNnimPt9Bkw7dVyIsnAUgtaJ:GRBthHi6UXkUw3P9v8
TLSH
T19342B52EAE54743B5CDBC32AFD227B53D3F5102221952E84EAFC8A2C04DB5CC221706B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 92a5fcab93f54ac23d755194f70c8cdc443ba58d948c6040444991c53aab2593
MD5 1f3480e2d7455b1da8d1e76b16c8c8ec
SHA1 c31786500efd84be9e6960eb01e4f0ab4e98c09a
SHA512 8085fa1b2e9d0cce79e0fffe11ae0c0dc3eb96392efab10ffbcde4f836793dde131f5db421341eb128c73c7a5792cbb145560d77281394f3ccf0a93c3bc6c785
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OzigaVumrLnPto:1nbZeMrv/hGtz7SLnW
TLSH
T135D3874B3A743102DDE69A721CE051BB5E3CB16D8F51A5D428B620588EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 5e0f70e71d93c55c1de2c6b3b0dd97ac699cd171db35c38b21090eccbd1619e1
MD5 f85b07a618b49dfbbfab49ff8da4780e
SHA1 b13314ec18f5a7d9da6133a098e6c8eabc28fd52
SHA512 31100eda7fa5bc01979141a647bcf26ec6f81ce4b1b5e31c27b078986a65c334c15946de5603da267a36239a7ed1aba4ce2f48a07bb96e555de46a9a36284fe7
SSDEEP 6144:iVFm4vCuuwbzIUqSs1qKmwCcmXKegIh6jh9JvexhY:i2zwbzIUfImwCHHgVUxy
TLSH
T14A3413A9B99F3DE584BC18F271573282968193D20E11BD4E84CB8F0B5EDE9A44D9FC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2acdf789f4cf5e839833a6c024e30e47b89d7ff9c4c912db6bfd722d15365540
MD5 25134707b8bef4963b75223ce75353e2
SHA1 ba75730ca4ddb33c84483553602e5c5dc23ab3b0
SHA512 c340200f4c772fbf28796417a97472aaba10506dac5e3b0038d25ab0b8f6ac853c1e63dab8e2a71678457e30e67c00adacd504d65e67f690b5587159884276ab
SSDEEP 3072:/8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:ZwCcmXKegIh6jh9JvexhQ
TLSH
T16CB3125A29273DA68CBC6EB37453338286A357A26C05F14E90CCDF0B45DDDB415EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3b442494723fd224268df79958ea0f6d02b8bba5bea3b3ac773cd572188d3a54
MD5 744bc3e383e66c5e221c69d7866979a3
SHA1 a89cee038cab1b053cd20cf1ba1a2467efcfef52
SHA512 62751edb16ad3ba8ef9ff81ec4a923799479a4deb5a75300cbebc6ae373e5658010fe133cf354458f41695b960e04c278e50b65bb42bcb75fd101221aac3c409
TLSH
T1B4D02B643B0E7041D701003188128380116C50461073D20370F8004CDC8544053840C3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 864dd3bbb3ce737cae15840f7c2a495b6ff3bbbc119619801c5dd2190a7a1c07
MD5 a217e9c33f389e3d61c374dcef1f9e90
SHA1 737b2aaff1ff6d7ab5c68d62ae1fe6556c4c039a
SHA512 6a22d93bd242b736ba0db5cad44060748be92640c9c6bf39c794f81b3f9503e8ee658b3978a434f6521a0f56ba1962a18f6b4266e0aa4f03a2a3e6de0f7a7d6f
SSDEEP 48:KhK3Gqw44+qIllIzK+KYLg8+0SuNdsafyNjI9K4UYQbI9KQEYfypIIzKhqMi:KotiKmwCujOK4U/bWKQEaqIoKhqF
TLSH
T133B18311307A22053C3EBA58C396966B064371A3310DA53B7FE911BA9E6BE165DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 1f34e5dbd07e1ffdb35ab9d78f8e59616c0c362c4f719943eb65ed28b7825642
MD5 c0614d2bb6751134cf6c01a1862ae920
SHA1 8ed5fd3258f8d929c18b1ca6a256879f8d0fca91
SHA512 ebb381bc4e4d8a0efc94582bf3c4019d310cc3c9457144edc6cc7c58031f2356f2925604afac3c40c6fa2472adaf0678c38e46c4628e90369adeaa32c0036ef7
SSDEEP 192:FvoWdOA+HfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:agyHfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T16624530A6B747001EDE7D9725CB080771A3CB16ECF22A6915DA254698DB3853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 650a119349d688ed6789fdf3cc0f2481d8881d2dcda92a64aeb0d2d90b22942b
MD5 4fdbc64cefb90ace8c179974c77650d1
SHA1 5988c8e6cd74d400dcdf6ba02e733473e956249c
SHA512 c2c17d843a20644d57904412f4f4ccfa8842369c64fed67946eed6c36dcc6d8030530b757c5994755a2f71e8a53430bb5a1bc7d7725ee1b3313eff7dbcaabbba
SSDEEP 192:1GNJ6t6H3BQmiUy2HBHf2Qq/rUH5miQn/D9MXP2U6:1GNJ6MXfFZ2Qq/E5T0aXuU6
TLSH
T16D02D8387868BCBB8DA3AE45B48777239F95217FA7941F84D9E81B1D01DB68C1342832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 52c632f8cfc86349241ec09d35ac90a6c3aad207a466acfd317dc7c7775d0074
MD5 5745887e0836f44abae8737215ea82c2
SHA1 2096a119b8fbc664ccdf4303423a6e514288d834
SHA512 3756ad30e50c618ad6aff472b0cdbf43195c5f1e17780287050d419d076238a5e2f8fa0b0b449fff4e137caacd13f3d7ae05e06ceed6bc398e486d4488502f14
SSDEEP 192:1GN4x6t6H3RQmiUyg0f2vq/rUH5miQnpKY9/9nXvgqAU6:1GN4x6MXvM2vq/E5T0pKYrXv+U6
TLSH
T12912093478A8ACAB5EA3AE55F44777139FA4117BEBD41F84D9E90B1D01CB6882306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fe8c656-7b09-4955-ab87-5081738ea2cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\0fe8c656-7b09-4955-ab87-5081738ea2cd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

1b7a8f7e

Path C:\Users\Admin\AppData\Local\Temp\b7b2daf0\1b7a8f7e
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

842330a8-08ae-4db9-9bd2-cbdf08be68bd.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5460_332573106\842330a8-08ae-4db9-9bd2-cbdf08be68bd.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4608-122-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-96-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-17-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-36-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-49-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-76-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-85-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-123-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-131-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-153-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-152-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-151-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-150-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-137-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-136-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-135-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-134-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-133-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-132-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-130-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-129-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-128-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-127-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-126-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-15-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-125-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-124-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-121-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-120-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-119-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-74-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-98-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-97-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-16-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-95-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-94-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-91-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-90-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-89-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-88-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-86-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-84-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-83-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-82-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-81-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-80-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-79-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-78-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-77-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-93-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-92-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-14-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-13-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-12-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-11-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-10-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-9-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-8-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-7-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-6-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-5-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-4-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-1-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-0-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-87-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-75-0x0000000410000000-0x00000004101E9000-memory.dmp

Download

memory/4608-2501-0x0000000410000000-0x00000004101E9000-memory.dmp

Download